DOP-C02 Security and Compliance Practice Test 16 — 15 Questions

Question 1

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can make changes to Amazon CloudWatch Logs configurations. Which approach should be used?

Accepted Answer

Create an SCP that denies cloudwatch:Put* and cloudwatch:Delete* actions and attach it to the root OU. Option B is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By attaching an SCP that denies cloudwatch:Put* and cloudwatch:Delete* actions to the root OU, you ensure that no IAM user or role in any account can modify or delete CloudWatch Logs configurations, regardless of any IAM policies attached directly to users or roles. This approach provides a guardrail that cannot be overridden by account administrators.

Answer

Use AWS Config rules to automatically revert changes to CloudWatch Logs

Answer

Create an IAM policy that denies changes to CloudWatch Logs and apply it to all IAM users

Answer

Use AWS CloudTrail to monitor and alert on changes to CloudWatch Logs

Question 2

A DevOps engineer needs to securely store and automatically rotate database credentials for a web application running on Amazon ECS. Which solution should be used?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure rotation. Grant the ECS task IAM role permission to retrieve the secret.. AWS Secrets Manager can store database credentials and automatically rotate them on a schedule. The ECS task can retrieve the credentials using the Secrets Manager secret. Option A is correct. Option B (SSM Parameter Store) can store secrets but does not support automatic rotation. Option C (AWS KMS) is for encryption keys, not credential rotation. Option D (AWS Certificate Manager) is for SSL/TLS certificates.

Answer

Use AWS KMS to generate and rotate a data key for encrypting the credentials in a file on ECS.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString. Use a Lambda function to rotate them.

Answer

Use AWS Certificate Manager to store the credentials as a certificate.

Question 3

Given the above IAM policy, which action is permitted?

Accepted Answer

Invoke the Lambda function MyFunction in us-east-1 account 123456789012. The policy explicitly allows the lambda:InvokeFunction action on the specified function ARN. Option A is correct. It does not allow other Lambda actions (B), S3 actions (C), or EC2 actions (D).

Answer

Read objects from an S3 bucket

Answer

Create a Lambda function

Answer

Start an EC2 instance

Question 4

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

Accepted Answer

Create an IAM user with administrator access and use that instead. Best practices for root user include enabling MFA, using a strong password, and not using root for daily tasks. Deleting the root user is not possible. Access keys should not be created for root user.

Answer

Use the root user for daily administrative tasks

Answer

Create access keys for the root user to use with CLI

Answer

Delete the root user after creating an IAM admin user

Question 5

Which THREE AWS services can be used to centrally manage and enforce security policies across multiple accounts in AWS Organizations? (Select THREE.)

Accepted Answer

AWS Config Conformance Packs. AWS Config Conformance Packs enable you to deploy and enforce a collection of AWS Config rules and remediation actions across multiple accounts and Regions in an AWS Organization. They provide a centralized way to ensure that resources comply with internal policies by using a YAML template that defines the rules and parameters, which are then applied to all member accounts via AWS Config aggregators and StackSets.

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 6

Which TWO measures can be taken to protect data at rest in Amazon S3? (Select TWO.)

Accepted Answer

Enable S3 Server-Side Encryption (SSE-S3 or SSE-KMS). S3 Server-Side Encryption (SSE) and S3 Bucket Policies to deny unencrypted PUT requests are measures to protect data at rest. MFA Delete protects against accidental deletion, not encryption. Cross-region replication is for disaster recovery. S3 Transfer Acceleration speeds up uploads.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the bucket

Answer

Use S3 Transfer Acceleration

Question 7

An S3 bucket has the above bucket policy. What is the net effect on GetObject requests?

Accepted Answer

Only requests from IP range 192.0.2.0/24 are allowed. The Allow statement grants public read access. The Deny statement denies all S3 actions when the source IP is not in 192.0.2.0/24. Since a Deny overrides an Allow, only requests from within that IP range are allowed. Option C is correct.

Answer

All anonymous users can read objects

Answer

All requests are denied

Answer

Only authenticated users can read objects

Question 8

A company needs to enforce that all EC2 instances launched in an AWS account use a specific Amazon Machine Image (AMI) that is approved by the security team. Which combination of services should be used?

Accepted Answer

AWS Config rule to check AMI ID and AWS Systems Manager Automation to remediate non-compliant instances. AWS Config can detect non-compliant instances and AWS Systems Manager Automation can automatically remediate by stopping or terminating them. Option B is correct. Option A (SCP) cannot enforce AMI IDs. Option C (CloudTrail) only logs. Option D (Lambda) could be used but is not the primary service.

Answer

AWS Organizations SCP and AWS CloudTrail

Answer

AWS Lambda and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Events

Question 9

A company wants to centrally manage and audit access to AWS KMS keys across multiple accounts. Which AWS feature should be used?

Accepted Answer

AWS CloudTrail with organization trail. AWS CloudTrail can log KMS key usage across accounts and be aggregated in a central account. Option B is correct. Option A (IAM) is per-account. Option C (AWS Config) does not audit key usage. Option D (AWS Organizations) does not audit.

Answer

AWS Config aggregated rules

Answer

Cross-account IAM roles

Answer

AWS Organizations tag policies

Question 10

A company wants to ensure that all API calls made within its AWS account are logged for auditing purposes. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, making it the correct choice. Option B is incorrect because CloudWatch Logs is for log storage and monitoring, not for recording API calls. Option C is incorrect because AWS Config tracks resource configuration changes, not API calls. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 11

A DevOps engineer needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The company requires that the encryption key be managed by AWS and rotated automatically. Which encryption option should be used?

Accepted Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3). SSE-S3 uses AWS-managed keys and automatically rotates them, meeting the requirement. Option A (SSE-C) requires customer-managed keys and no automatic rotation. Option B (SSE-KMS with customer-managed key) does not automatically rotate unless configured. Option D (client-side encryption) does not use AWS-managed keys.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer-managed key

Answer

Client-side encryption with an AWS KMS managed key

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to restrict the use of specific instance types across all accounts to reduce costs and enforce compliance. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit to deny the instance types. SCPs in AWS Organizations allow central control over permissions across all accounts, including restricting instance types. Option A is wrong because IAM policies within accounts can be overridden by administrators. Option B is wrong because Config rules only detect non-compliance, not prevent. Option D is wrong because CloudFormation is not an enforcement mechanism across all accounts.

Answer

Use AWS Config rules to detect non-compliant instance types

Answer

Create IAM policies in each account to deny the use of the instance types

Answer

Use AWS CloudFormation templates to enforce instance type selection

Question 13

A company is using Amazon RDS for MySQL and needs to encrypt the database at rest. Which action should be taken to enable encryption?

Accepted Answer

Enable encryption when creating the DB instance. Encryption at rest for RDS can only be enabled at creation time. Option B is wrong because encryption cannot be added later. Option C is wrong because enabling encryption on an existing instance is not supported. Option D is wrong because client-side encryption is not native and requires application changes.

Answer

Create a read replica with encryption enabled

Answer

Use AWS Secrets Manager to encrypt the data

Answer

Modify the existing DB instance and enable encryption

Question 14

A DevOps engineer receives an alert that an EC2 instance has been compromised. The instance is part of an Auto Scaling group. What is the first step the engineer should take to isolate the instance?

Accepted Answer

Detach the instance from the Auto Scaling group and remove it from the load balancer. Detaching the instance from the Auto Scaling group and removing it from the load balancer stops traffic, then security groups can be applied to block all traffic. Option A is wrong because termination may destroy evidence. Option B is wrong because snapshotting does not isolate. Option C is wrong because AMI creation is not immediate isolation.

Answer

Create a snapshot of the instance's root volume

Answer

Create an AMI of the instance for analysis

Answer

Terminate the instance immediately

Question 15

A company requires that all secrets (e.g., database passwords) used by Lambda functions be rotated automatically every 30 days. Which combination of services should be used?

Accepted Answer

AWS Secrets Manager and AWS Lambda. AWS Secrets Manager is the correct choice because it natively supports automatic secret rotation on a configurable schedule (e.g., every 30 days) using a Lambda function as the rotation handler. Secrets Manager directly integrates with Lambda to invoke the rotation logic, updating the secret value and propagating the change to the target database or service without custom infrastructure. CloudHSM, Parameter Store, and KMS do not provide built-in, scheduled rotation of secrets with automatic Lambda invocation.

Answer

AWS CloudHSM and AWS Lambda

Answer

AWS Systems Manager Parameter Store and AWS Lambda

Answer

AWS KMS and AWS Lambda