DOP-C02 Security and Compliance Practice Test 16 — 15 Questions

Question 1

A company is using AWS CodeCommit for source control. A developer accidentally committed a file containing AWS access keys. The keys have been removed from the file, but the commit history still contains them. What is the most secure way to remove the keys from the repository?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use git filter-branch to remove the file from all commits and force push the changes.. Git filter-branch can rewrite history to remove the file from all commits. However, AWS recommends using the AWS CLI's git-secrets or the AWS CodeCommit console's 'delete repository' option. But the most secure and straightforward approach is to use git filter-branch to purge the file and then force push. Option A is wrong because simply reverting the commit leaves the keys in history. Option B is wrong because deleting the file and committing does not remove history. Option D is wrong because AWS does not provide a built-in command to remove a file from history.

Answer

Delete the file from the repository and commit the deletion.

Answer

Use the AWS CLI command 'aws codecommit delete-file' with the --keep-history flag.

Answer

Revert the commit that added the keys.

Question 2

A company uses a centralized AWS KMS customer master key (CMK) in the security account to encrypt data in S3 buckets across multiple accounts. The S3 buckets are accessed by EC2 instances in the same accounts. The security team wants to ensure that the CMK can only be used by authorized IAM roles in the member accounts. Which policy configuration should be used?

Accepted Answer

Add a statement to the KMS key policy that grants the IAM roles in the member accounts permission to use the key.. To allow cross-account use of a KMS CMK, you must add a key policy that grants the necessary permissions to the IAM roles in the member accounts. Option B is correct because the key policy explicitly allows the IAM roles to use the key. Option A is incorrect because an IAM policy alone cannot grant cross-account access; the key policy must allow it. Option C is incorrect because SCPs can only deny permissions, not grant. Option D is incorrect because VPC endpoint policies control access to the KMS API via VPC endpoints, not the permissions to use the key.

Answer

Attach an IAM policy to the IAM roles in the member accounts that allows kms:Decrypt on the CMK.

Answer

Create a service control policy (SCP) that allows kms:Decrypt for the CMK.

Answer

Use a VPC endpoint policy for KMS to allow access from the member accounts' VPCs.

Question 3

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service can be used to achieve this?

Accepted Answer

Use AWS Config with a custom Lambda function to rotate keys when they are older than 90 days.. AWS IAM does not have a built-in automatic rotation feature for access keys. AWS Secrets Manager can store secrets and rotate them, but it does not natively rotate IAM access keys; it supports rotation for RDS, Redshift, and DocumentDB, but not IAM. AWS CloudTrail is a logging service and cannot rotate keys. However, AWS Config can be used with a custom AWS Lambda function to create a rule that triggers rotation when access keys are older than 90 days. Therefore, option D is the correct answer.

Answer

Store the access keys in AWS Secrets Manager and enable automatic rotation.

Answer

Use AWS CloudTrail to detect old keys and send notifications to administrators.

Answer

Use IAM's built-in access key rotation feature.

Question 4

Which TWO actions should a DevOps engineer take to secure a web application running on EC2 instances behind an Application Load Balancer? (Choose two.)

Accepted Answer

Enable AWS WAF on the ALB to filter malicious requests.. Correct answers are D and E. Option D: AWS WAF on the ALB helps filter out common web exploits. Option E: Configuring the EC2 security group to allow inbound traffic only from the ALB's security group ensures that direct access to instances is blocked, forcing traffic through the ALB. Option A is incorrect because allowing all inbound traffic (0.0.0.0/0) on port 443 exposes instances directly to the internet, bypassing the ALB. Option B is incorrect: network ACLs are stateless and less granular than security groups; using a NACL to allow traffic from the ALB's subnet is not a recommended practice for instance-level security. Option C is incorrect: placing EC2 instances behind CloudFront is a content delivery optimization, not a security measure to protect the application layer; it does not replace the need for WAF or security group restrictions.

Answer

Configure the EC2 instance security group to allow inbound traffic from 0.0.0.0/0 on port 443.

Answer

Use a network ACL to allow inbound HTTP/S traffic only from the ALB's subnet.

Answer

Place the EC2 instances behind an Amazon CloudFront distribution.

Question 5

Which THREE measures can be taken to protect sensitive data stored in an Amazon S3 bucket? (Choose three.)

Accepted Answer

Enable default encryption on the bucket (SSE-S3 or SSE-KMS).. Enabling default encryption, blocking public access, and enabling versioning are key security measures to protect sensitive data at rest, prevent unauthorized access, and protect against accidental deletion or overwrite respectively. Option A (Enable server access logging) is incorrect because server access logging is used for auditing and monitoring, not for direct protection of data. Option B (Enable cross-region replication) is incorrect because cross-region replication is primarily for disaster recovery and data availability, not for security. Option E (Configure a bucket policy that denies all access) is incorrect because denying all access would prevent any legitimate use of the bucket; proper security uses least privilege, not an outright deny all.

Answer

Enable server access logging for the bucket.

Answer

Enable cross-region replication.

Answer

Configure a bucket policy that denies all access.

Question 6

Which TWO AWS services can be used to monitor and detect unauthorized access to AWS resources? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing VPC Flow Logs, DNS logs, and AWS CloudTrail management and data events. It uses machine learning and integrated threat intelligence to detect anomalies such as unusual API calls, crypto-mining activity, or compromised credentials, making it a correct choice for detecting unauthorized access.

Answer

AWS Shield

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A company has a multi-account AWS environment using AWS Organizations. The security team has implemented a service control policy (SCP) that denies the creation of IAM users and roles with full admin access. The SCP is attached to all accounts. However, a DevOps engineer in a member account reports that they are able to create an IAM role with an administrator access policy attached. The engineer uses the AWS Management Console to create the role. The SCP is confirmed to be in place. What is the most likely reason the SCP is not preventing the role creation?

Accepted Answer

The SCP only denies iam:CreateUser, but the engineer is creating a role (iam:CreateRole).. The SCP in question denies only the iam:CreateUser action, but the engineer is creating an IAM role, which requires the iam:CreateRole action. SCPs provide an explicit deny for actions they list; they do not block actions they do not list. Since the SCP does not deny iam:CreateRole, the engineer's IAM policy (which allows iam:CreateRole) is effective. SCPs are inherited by member accounts and, when correctly attached, cannot be overridden by IAM policies; however, they only apply to the actions they explicitly specify.

Answer

SCPs are not inherited by member accounts from the root.

Answer

The SCP is not attached to the member account's root organizational unit.

Answer

The engineer's IAM policy allows iam:CreateRole and overrides the SCP.

Question 8

A company runs a critical application on EC2 instances that need to access an S3 bucket with sensitive data. The security team has enabled S3 bucket policies that require TLS for all requests (aws:SecureTransport). The application is failing to access the S3 bucket, and logs show errors like 'Access Denied'. The application uses the AWS SDK to make requests. What is the most likely cause of the failure?

Accepted Answer

The application is using HTTP instead of HTTPS to connect to S3.. The bucket policy requires TLS, meaning all requests must be made over HTTPS. If the application is using HTTP instead of HTTPS, the request will be denied. The AWS SDK by default uses HTTPS for S3 endpoints, but if the endpoint URL is explicitly set to HTTP or if the SDK configuration is changed, it could cause the issue. Option A is wrong because the bucket policy does not require specific cipher suites. Option B is wrong because IAM roles can access S3 if they have the right permissions. Option C is wrong because VPC endpoints do not affect the TLS requirement. Option D is correct: if the application is using HTTP, it violates the bucket policy condition.

Answer

The S3 bucket is accessed through a VPC endpoint that does not support TLS.

Answer

The application's IAM role does not have s3:GetObject permission.

Answer

The bucket policy requires a specific TLS version that the application does not support.

Question 9

A company is using AWS KMS to encrypt data at rest in Amazon S3. The Security team requires that all encryption keys be automatically rotated annually. Which key type should be used to meet this requirement?

Accepted Answer

AWS managed symmetric key. AWS managed KMS keys (AWS managed keys) are automatically rotated every year. Customer managed keys require manual rotation or key rotation configuration. AWS managed keys are used for services like S3, EBS, and RDS.

Answer

Asymmetric KMS key

Answer

Customer managed symmetric key

Answer

Custom key store backed by AWS CloudHSM

Question 10

A DevOps team is deploying a multi-tier application on AWS. The application must comply with PCI DSS. Which combination of services should be used to encrypt data in transit between the web tier and the application tier?

Accepted Answer

AWS Certificate Manager (ACM) and Application Load Balancer (ALB). For encryption in transit, using TLS certificates managed by ACM and enforced by an Application Load Balancer is the standard approach. CloudHSM or KMS are for key storage but not directly for in-transit encryption. VPC Peering does not provide encryption.

Answer

AWS CloudHSM and Classic Load Balancer

Answer

AWS KMS and VPC Peering

Answer

AWS WAF and Amazon CloudFront

Question 11

A company wants to securely store database credentials used by an application running on Amazon EC2. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for securely storing secrets and provides automatic rotation. Systems Manager Parameter Store can store secrets but does not natively support rotation without custom automation. KMS is for encryption keys, not secret rotation.

Answer

AWS IAM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 12

An organization uses AWS Organizations with multiple accounts. The Security team needs to enforce a policy that prohibits the creation of S3 buckets with public access in any account. Which policy type should be used?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) allow you to centrally control permissions across all accounts in an organization. SCPs can deny actions like creating public buckets. IAM policies are account-specific. AWS Config rules can detect but not prevent.

Answer

IAM permissions boundary

Answer

AWS CloudTrail trail

Answer

AWS Config rule

Question 13

A DevOps engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role attached with a policy that allows s3:GetObject. The S3 bucket policy explicitly denies access to the instance's role. What is the result?

Accepted Answer

Access is denied because the bucket policy explicitly denies. An explicit deny in any policy overrides any allow. The bucket policy deny takes precedence over the IAM role allow, so access is denied. Evaluation logic is that an explicit deny prevents access.

Answer

Access is denied only if the bucket is encrypted

Answer

Access is allowed only if the instance is in the same region

Answer

Access is allowed because the IAM role allows it

Question 14

A company uses AWS CodePipeline to deploy a web application. The pipeline uses artifacts stored in an S3 bucket. The Security team requires that all artifacts be encrypted in transit and at rest, and that the pipeline only access the bucket using a specific VPC endpoint. Which configuration meets these requirements?

Accepted Answer

Create a VPC endpoint for S3 and attach a bucket policy that denies access unless aws:SourceVpce matches the endpoint and aws:SecureTransport is true, and use S3 default encryption. To enforce encryption in transit and at rest and restrict to a VPC endpoint, you must configure a bucket policy that denies access unless the request uses HTTPS (for transit) and server-side encryption (for at rest), and aws:SourceVpce condition. IAM roles alone cannot enforce VPC endpoint restriction.

Answer

Configure an IAM role for CodePipeline with a policy that allows s3:GetObject and s3:PutObject, and attach a bucket policy that allows only that role

Answer

Use an S3 bucket with a lifecycle policy to expire old artifacts

Answer

Enable S3 block public access and use SSE-S3 encryption on the bucket

Question 15

A company wants to centralize audit logs from multiple AWS accounts into a single S3 bucket. The logs must be encrypted at rest using a KMS key. Which solution is the MOST secure and scalable?

Accepted Answer

Configure each account's CloudTrail to send logs to a central S3 bucket with a bucket policy that grants cross-account permissions. Using AWS CloudTrail with an organization trail to deliver logs to a central S3 bucket is the recommended approach for multi-account logging. KMS encryption can be enabled on the bucket. Cross-account IAM roles can be complex and less centralized.

Answer

Create an IAM role in each account and manually copy logs to a central bucket

Answer

Use Amazon Kinesis Data Firehose to stream logs to S3

Answer

Use AWS Config rules to aggregate logs into a central bucket