DOP-C02 Security and Compliance Practice Test 17 — 15 Questions

Question 1

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an S3 bucket. The Security team requires that the application never uses long-term credentials and that access is scoped to the specific ECS task. Which approach should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role for the ECS task and reference it in the task definition. ECS tasks using the Fargate launch type can assume an IAM role that is specified in the task definition. This IAM role provides temporary credentials via the ECS task metadata endpoint, ensuring that the application never uses long-term credentials and that permissions are scoped precisely to that task. The Security team's requirements are fully met by this approach.

Answer

Embed the IAM user credentials in the container image

Answer

Store AWS access keys in AWS Secrets Manager and retrieve them at runtime

Answer

Use an IAM role for the EC2 instance if using EC2 launch type

Question 2

A company wants to monitor and detect suspicious API activity across all AWS accounts in an organization. Which TWO services should be used together?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can centrally aggregate and store API activity logs from all AWS accounts in an organization. When combined with AWS CloudTrail, which records API calls, CloudWatch Logs enables real-time monitoring and alerting on suspicious API patterns using metric filters and alarms.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 3

A company needs to enforce that all IAM users must use multi-factor authentication (MFA) to perform any AWS Console actions. Which TWO steps should be taken to enforce this?

Accepted Answer

Attach the policy to all IAM users or a group containing all users. To enforce MFA, you need an IAM policy that denies actions if MFA is not present, and you must attach that policy to all users or a group. Creating an SCP can enforce across accounts but is not needed for single account. CloudTrail does not enforce. Account alias is unrelated.

Answer

Create an SCP in AWS Organizations

Answer

Set an account alias for the root user

Answer

Enable CloudTrail to log MFA usage

Question 4

A company's Security team wants to detect and alert on the creation of IAM users with console access. Which THREE services should be used?

Accepted Answer

AWS CloudTrail. CloudTrail logs the CreateUser and CreateLoginProfile API calls. CloudWatch Logs can receive CloudTrail logs and create metric filters. CloudWatch Alarms can trigger on the metric. Config can track resource changes but not as efficient for alerting on API calls. GuardDuty does not specifically focus on IAM user creation.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 5

A company uses AWS Organizations with 20 accounts. The Security team has configured AWS CloudTrail to deliver logs from all accounts to a central S3 bucket (central-bucket). The bucket policy allows CloudTrail to write objects and uses SSE-S3 encryption. Recently, auditors found that some log files were missing for a few hours. The CloudTrail console shows that trails are enabled in all accounts. The central-bucket has default encryption enabled. What is the MOST likely cause of the missing logs?

Accepted Answer

The S3 bucket policy denies access unless the PutObject request includes the x-amz-server-side-encryption header with value AES256. The bucket policy denies PutObject requests that do not include the `x-amz-server-side-encryption` header with value `AES256`. CloudTrail does not include this header by default when delivering logs, so the requests are denied, causing missing logs. The bucket's default encryption (SSE-S3) does not override the bucket policy requirement. Option D is correct because it directly addresses the policy condition that blocks CloudTrail writes. Options A, B, and C are incorrect: A refers to multi-region trails, but the issue is about encryption headers; B is wrong because CloudTrail uses HTTPS, not HTTP; C is wrong because the IAM role permissions are not the issue—the bucket policy is the cause.

Answer

The CloudTrail trail is not configured to deliver to the central bucket from all regions

Answer

The S3 bucket policy contains a deny condition that requires aws:SecureTransport to be true, but CloudTrail uses HTTP

Answer

The IAM role used by CloudTrail does not have s3:PutObject permission

Question 6

A company runs a production application on EC2 instances behind an Application Load Balancer (ALB). The application handles sensitive data. The Security team wants to encrypt all traffic between the ALB and the EC2 instances using TLS. They have created a self-signed certificate on each instance. However, the ALB health checks are failing with a 502 error. The instances are healthy when accessed directly via SSH. What is the MOST likely cause?

Accepted Answer

The target group health check is configured to use HTTPS, but the self-signed certificate is not trusted by the ALB. The ALB health check is configured to use HTTPS, requiring a trusted TLS certificate on the target instance. Self-signed certificates are not trusted by default, so the ALB cannot establish a TLS connection, resulting in a 502 error. The instances are healthy when accessed via SSH because SSH does not use TLS. Option A correctly identifies this issue.

Answer

The EC2 instances are not configured with a certificate that matches the ALB's domain name

Answer

The ALB is configured to use a different TLS protocol version than the instances

Answer

The security groups on the EC2 instances do not allow inbound traffic from the ALB

Question 7

A company uses AWS Secrets Manager to store database credentials for a legacy application running on an on-premises server. The application retrieves the secret via the AWS SDK. Recently, the database password was rotated in Secrets Manager, but the application continued to use the old password and failed to connect. The application code is correct and uses the latest SDK. The IAM role attached to the server has the secretsmanager:GetSecretValue permission. What is the MOST likely cause?

Accepted Answer

The application is caching the secret and not refreshing it after rotation. The most likely cause is that the application is caching the secret and not refreshing it after rotation. By default, the AWS SDK for Secrets Manager caches secrets in memory for a configurable TTL (default 1 hour). Even though the secret is rotated in Secrets Manager, the application will continue to use the cached old secret until the cache expires or is explicitly refreshed. Option A is incorrect because the IAM role has the required permission (secretsmanager:GetSecretValue) and listing secrets is not necessary for retrieval. Option B is unlikely because the application would fail immediately if using the wrong secret ID, not only after rotation. Option C is about the rotation Lambda function, but the application's failure to connect after rotation does not indicate the Lambda function itself is failing; rotation may have succeeded but the application is not fetching the new version.

Answer

The IAM role does not have permission to list secrets

Answer

The application is using the wrong secret ID

Answer

The secret rotation Lambda function is failing

Question 8

A company uses AWS Organizations with SCPs to enforce security policies. The security team needs to ensure that no IAM user or role can disable AWS CloudTrail or delete CloudTrail logs. Which TWO approaches should be combined to achieve this? (Choose TWO.)

Accepted Answer

Use a service control policy to deny s3:DeleteObject on the CloudTrail S3 bucket.. To prevent IAM users and roles from disabling CloudTrail or deleting logs, a combination of two preventive controls is needed. Option A applies a service control policy (SCP) that denies s3:DeleteObject on the CloudTrail S3 bucket, preventing log deletion at the organizational level. Option C applies an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail, preventing disabling of CloudTrail itself. Both SCPs cannot be overridden by account administrators. Option D (log file validation) is a detective control—it detects tampering or deletion after it occurs, but does not prevent the action. Options B (MFA Delete) and E (IAM policy) are weaker or can be overridden, making them less reliable for this requirement.

Answer

Enable MFA Delete on the CloudTrail S3 bucket.

Answer

Enable CloudTrail log file validation.

Answer

Attach an IAM policy to all users denying cloudtrail:StopLogging.

Question 9

A company is designing a secure CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy. The pipeline must deploy to an EC2 Auto Scaling group across multiple AWS accounts. The security requirements include: (1) no hardcoded credentials, (2) least privilege for cross-account access, (3) encrypted artifacts. Which THREE steps should the DevOps engineer implement? (Choose THREE.)

Accepted Answer

Use a customer-managed KMS key with a cross-account key policy to encrypt artifacts.. Using a customer-managed KMS key with a cross-account key policy allows encrypting artifacts in CodePipeline's artifact store, ensuring that only authorized accounts can decrypt them, meeting the requirement for encrypted artifacts and least privilege. Option B is correct because storing database credentials in AWS Secrets Manager and retrieving them in CodeBuild using the secrets manager action avoids hardcoded credentials and provides secure, rotating credentials. Option E is correct because configuring CodePipeline to assume an IAM role in the target account using a trust policy enables cross-account deployment with least privilege, as the pipeline assumes a role with only necessary permissions. Option C is incorrect because while SSM Parameter Store can store credentials, Secrets Manager is specifically designed for secrets management with automatic rotation and is more appropriate for database credentials. Option D is incorrect because CodeCommit with pull request approval rules is a source control practice, not directly addressing the security requirements of no hardcoded credentials, least privilege cross-account access, or encrypted artifacts.

Answer

Store database credentials in AWS Systems Manager Parameter Store and retrieve them in CodeBuild.

Answer

Use AWS CodeCommit as the source repository with pull request approval rules.

Question 10

A company uses AWS Organizations with multiple accounts. The security team has implemented an SCP that denies the creation of IAM users. However, a developer in the 'development' account was able to create an IAM user. The DevOps engineer is asked to investigate. The SCP is attached to the root organizational unit (OU) and also to the 'development' OU. The 'development' account is a member of the 'development' OU. The SCP effect is 'Deny' on the 'iam:CreateUser' action. The developer's IAM permissions are managed by an IAM policy that allows 'iam:*'. The engineer checks CloudTrail and sees that the CreateUser API call succeeded. What is the most likely reason?

Accepted Answer

The 'development' account is the management account of the organization, so SCPs do not apply to it.. SCPs do not affect the management account of AWS Organizations. The 'development' account allowed the iam:CreateUser API call despite the SCP denying it, indicating that the account is the management account, which is exempt from SCPs. Option A is correct because the management account is not subject to SCPs. Options B, C, and D are incorrect: SCPs are inherited by default and do not require explicit inheritance (B); SCPs override IAM permissions, not the other way around (C); resource-based policies do not override SCPs (D).

Answer

The SCP is attached at the root OU but not inherited by the 'development' OU due to an explicit deny on inheritance.

Answer

The SCP is not effective because the developer's IAM policy explicitly allows iam:CreateUser and SCPs cannot override explicit allows.

Answer

The SCP is not applied because the account has a resource-based policy that overrides the SCP.

Question 11

A company is migrating to AWS and has a requirement to encrypt all data at rest and in transit. They are using AWS KMS with Customer Master Keys (CMKs) for encryption. The DevOps engineer has set up an S3 bucket with default encryption using SSE-KMS. The bucket policy allows access only to a specific IAM role. The engineer also enabled S3 bucket versioning and MFA Delete. However, when the engineer tries to download an object using the AWS CLI with the IAM role, the command fails with 'AccessDenied'. The IAM role has the following permissions: s3:GetObject, s3:ListBucket, kms:Decrypt, kms:DescribeKey. What is the most likely missing permission?

Accepted Answer

The KMS key policy does not grant the IAM role permission to decrypt using the key.. The error 'AccessDenied' when downloading an object encrypted with SSE-KMS indicates that the IAM role lacks permission to use the KMS key for decryption. Even though the IAM role has kms:Decrypt, the KMS key policy must explicitly grant the role permission to decrypt using that key. Without this key policy grant, the role's IAM permissions are insufficient. Option D is correct because the key policy is the missing piece. Option A is incorrect because kms:GenerateDataKey is needed for uploading, not downloading. Option B is incorrect as kms:Encrypt is also for writing. Option C is incorrect because kms:CreateGrant is not required for this operation.

Answer

The IAM role is missing kms:GenerateDataKey permission.

Answer

The IAM role is missing kms:Encrypt permission.

Answer

The IAM role is missing kms:CreateGrant permission.

Question 12

A company uses AWS CloudTrail to log all API calls across multiple accounts. The logs are stored in an S3 bucket in the management account. The security team wants to ensure that the logs are not tampered with and that any unauthorized modification is detected. The DevOps engineer has enabled CloudTrail log file integrity validation. The engineer also sets up an S3 lifecycle policy to transition logs to Glacier after 90 days. Additionally, the engineer enables S3 server access logging and sends the logs to a different bucket. A few months later, the security team suspects that some logs have been deleted. The engineer checks the CloudTrail digest files and finds that the latest digest file is missing. What is the most likely cause?

Accepted Answer

The S3 lifecycle policy transitions objects to Glacier after 90 days, causing the digest file to appear missing when listing the bucket without filtering by storage class.. CloudTrail log file integrity validation stores digest files in the same S3 bucket as the logs. The lifecycle policy transitions all objects, including digest files, to Glacier after 90 days. When objects are transitioned to Glacier, they remain in the bucket but are not readily accessible via standard S3 list operations unless you specifically request the Glacier storage class. As a result, the latest digest file may appear missing, leading to the assumption that logs were deleted.

Answer

The S3 bucket has default encryption enabled, causing the digest files to be unreadable.

Answer

The server access logging is writing access logs to the same bucket, causing overwrites.

Answer

The S3 bucket has Object Lock enabled, which prevents deletion of any objects.

Question 13

A company is using AWS CodeBuild to build and test a Java application. The build process requires access to a private Maven repository hosted on an internal HTTPS server. The DevOps engineer has configured CodeBuild to use a VPC and placed the build environment in a private subnet. The security group for the build environment allows outbound HTTPS to the Maven repository's security group. The Maven repository server is in the same VPC but in a different private subnet. The build fails with a 'Connection refused' error when trying to download dependencies. The engineer checks the security group rules and confirms they are correct. What is the most likely cause?

Accepted Answer

The security group on the Maven repository server does not allow inbound HTTPS from the CodeBuild security group.. The most likely cause is that the security group attached to the Maven repository server does not have an inbound rule allowing HTTPS traffic from the CodeBuild security group. The engineer only verified the outbound rule on the CodeBuild side, but security groups are stateful, so outbound rules alone are not sufficient when the destination security group blocks inbound traffic. Option C is correct. Option A (Route53) is not relevant because the hosts are in the same VPC and DNS resolution is not the issue. Option B (wrong URL) would likely cause a different error (e.g., 404 Not Found). Option D (NACL blocking ephemeral ports) is possible but less likely because the error 'Connection refused' specifically indicates the target actively refused the connection, which strongly suggests a missing inbound rule on the server's security group. Note that network ACLs are stateless and would need both inbound and outbound rules, but the security group for the server is the more immediate check.

Answer

The private DNS resolution is failing because the VPC does not have Route53 Resolver enabled.

Answer

The CodeBuild buildspec is using the wrong URL for the Maven repository.

Answer

The network ACL on the private subnets is blocking outbound ephemeral ports.

Question 14

A company runs a critical application on AWS Lambda that processes sensitive data. The security team mandates that all data must be encrypted at rest and in transit. The Lambda function uses an environment variable to store a database password. The DevOps engineer has enabled encryption of environment variables using a KMS CMK. The Lambda function also needs to decrypt the password at runtime. The engineer attaches an IAM role to the Lambda function with permissions to decrypt using the KMS key. However, when the function executes, it fails with an error 'AccessDeniedException' when trying to decrypt the environment variable. The engineer checks the IAM role and confirms that it has kms:Decrypt permission. The KMS key policy allows the root user full access. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the Lambda execution role permission to use the key.. The AccessDeniedException when decrypting environment variables indicates that the Lambda execution role does not have permission to use the KMS key. Even though the key policy grants root user full access, IAM roles are not automatically included unless explicitly allowed. Option A is correct. Option B would cause a different error (InvalidCiphertextException). Option C would cause a KMSInvalidStateException. Option D is unlikely because the key policy allows root user full access and no VPC endpoint restrictions are mentioned.

Answer

The Lambda function code is trying to decrypt the wrong ciphertext.

Answer

The KMS key has been disabled or scheduled for deletion.

Answer

The Lambda function is not in a VPC, and the KMS key is restricted to VPC endpoints.

Question 15

A company uses AWS Secrets Manager to rotate database credentials automatically. The rotation is configured to occur every 30 days. The DevOps engineer notices that the latest secret version is not being used by the application after rotation. The application is an EC2 instance that retrieves the secret using the AWS SDK. The engineer checks the secret and sees that the rotation succeeded and the new version is marked as 'AWSCURRENT'. The EC2 instance role has permissions to retrieve the secret. What is the most likely reason the application is still using the old secret?

Accepted Answer

The application caches the secret value and does not refresh it until the cache expires or the application is restarted.. The application might be caching the secret and not refreshing it after rotation. Option A is correct. Option B is about rotation function, but rotation succeeded. Option C is about the secret being in different region, but the application uses same region. Option D is about the application's IAM role missing permission, but it has permissions.

Answer

The secret is in a different AWS Region than the application.

Answer

The EC2 instance does not have permission to call secretsmanager:GetSecretValue.

Answer

The rotation Lambda function is not updating the secret version label to AWSCURRENT.