DOP-C02 Security and Compliance Practice Test 17 — 15 Questions

Question 1

A DevOps engineer is designing a secure CI/CD pipeline. Which TWO of the following are best practices for securing secrets in the pipeline?

Accepted Answer

Use encrypted environment variables in CodeBuild.. Options A and E are correct. Option A: CodeBuild allows environment variables to be encrypted using AWS KMS, which is a secure way to handle secrets in the pipeline. Option E: AWS Secrets Manager is a dedicated service for securely storing and retrieving secrets, and integrating it with the pipeline ensures secrets are not exposed. Option B is incorrect because storing secrets in a parameter file in the source repository exposes them to anyone with repository access, violating security best practices. Option C is incorrect because hardcoding secrets in CloudFormation template parameters can lead to exposure in logs or template outputs, and is not secure. Option D is incorrect because while S3 bucket policies can restrict access, they do not encrypt the secrets themselves, and S3 is not designed for managing secrets; AWS Secrets Manager or Parameter Store are better choices.

Answer

Store secrets in a parameter file in the source repository.

Answer

Hardcode secrets in CloudFormation template parameters.

Answer

Use S3 bucket policies to restrict access to secret files.

Question 2

A company wants to monitor and detect anomalous API calls in their AWS account. Which THREE AWS services should they use together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API calls made in the AWS account, providing the raw data needed to detect anomalous activity. By enabling CloudTrail on all regions and logging to a centralized S3 bucket, you capture the identity, source IP, and request parameters for every API call, which is essential for anomaly detection.

Answer

Amazon Inspector

Answer

AWS Config

Question 3

A DevOps engineer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. Which TWO methods can achieve this?

Accepted Answer

Enable encryption when creating the DB instance using a customer-managed KMS key.. Option A is correct because when you create an RDS for MySQL DB instance you can enable storage encryption and choose a customer-managed AWS KMS key, which RDS uses to encrypt the underlying EBS storage, snapshots, and read replicas. Option B is also correct because RDS supports selecting the AWS managed KMS key (aws/rds) at creation time to encrypt the DB instance's storage, so encryption at rest is achieved without managing a custom key. Option C is wrong because RDS encryption always uses AWS KMS keys; there is no 'default RDS encryption with a customer-managed key without KMS.' Option D is wrong because you cannot enable encryption on an existing unencrypted RDS instance by modifying it; you must encrypt a snapshot and restore it to a new encrypted instance. Option E is wrong because client-side encryption with the RDS SDK is not a supported RDS at-rest encryption method for the database storage; RDS at-rest encryption is handled by KMS-backed storage encryption.

Answer

Use the default RDS encryption with a customer-managed key without KMS.

Answer

Enable encryption on an existing unencrypted DB instance by modifying the instance.

Answer

Use client-side encryption with the RDS SDK.

Question 4

The AWS Config rule 's3-bucket-ssl-requests-only' returns NON_COMPLIANT for the bucket 'my-bucket'. What does this mean?

Accepted Answer

The bucket's policy does not deny requests that are not using SSL.. The AWS Config rule 's3-bucket-ssl-requests-only' checks whether the bucket policy denies requests that are not using SSL (i.e., HTTP). If it returns NON_COMPLIANT, it means the bucket policy does not have a statement that denies non-SSL requests, so the bucket is not enforcing SSL-only access.

Answer

The bucket is publicly accessible.

Answer

The bucket does not have server access logging enabled.

Answer

The bucket does not have default encryption enabled.

Question 5

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service should be used to implement this rotation?

Accepted Answer

AWS Lambda with custom rotation logic. AWS Lambda with custom rotation logic is the correct service to automate IAM user access key rotation because AWS does not provide a native service that automatically rotates IAM access keys. AWS Secrets Manager can rotate secrets for databases and other services, but it does not support rotating IAM user access keys. Therefore, the recommended approach is to implement a custom Lambda function that generates new keys, updates the user, and manages the rotation lifecycle. Option B (AWS Config) only monitors compliance, not credentials. Option D (Systems Manager Parameter Store) stores secrets but lacks rotation capabilities for IAM keys.

Answer

AWS Config

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 6

A company needs to audit all changes to security groups in a multi-account environment. The logs must be centrally stored and immutable. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Enable AWS CloudTrail in all accounts, deliver logs to a central S3 bucket with S3 Object Lock enabled. AWS CloudTrail records all API activity, including `AuthorizeSecurityGroupIngress`, `RevokeSecurityGroupIngress`, and related security group modifications, across every account. Delivering these logs to a central S3 bucket with S3 Object Lock (WORM) enabled satisfies both the audit requirement and the immutability requirement, and CloudTrail organization trails can be enabled once at the Organizations level for minimal operational overhead.

Answer

Enable VPC Flow Logs in each VPC and aggregate them in Amazon CloudWatch Logs

Answer

Enable Amazon GuardDuty and send findings to a central S3 bucket

Answer

Enable AWS Config rules to detect security group changes and store results in a central S3 bucket

Question 7

Given the above AWS CLI command output, which actions are allowed for the specified policy?

Accepted Answer

ec2:DescribeInstances and s3:GetObject are allowed; s3:ListBucket is denied. The simulate-custom-policy command tests the specified policy against the given actions and resources. For ec2:DescribeInstances, the action is allowed because the policy includes ec2:Describe*. For s3:GetObject, the action is allowed because the policy explicitly allows s3:GetObject. For s3:ListBucket, the action is not allowed because the policy only allows s3:GetObject, not s3:ListBucket. Therefore, ec2:DescribeInstances and s3:GetObject are allowed, while s3:ListBucket is denied. Option B is correct.

Answer

Only s3:GetObject is allowed

Answer

Only ec2:DescribeInstances is allowed

Answer

All three actions are allowed

Question 8

A company has an Amazon RDS for MySQL database that stores sensitive data. The security team requires encryption at rest and in transit. Which combination of options meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and enforce SSL connections. Enabling encryption at rest on the RDS instance (via KMS) and enforcing SSL/TLS connections satisfies both requirements: encryption at rest protects data on disk, and SSL enforcement encrypts data in transit between the client and the database. RDS supports encryption at rest through KMS keys and SSL enforcement via parameter group settings (e.g., require_secure_transport for MySQL).

Answer

Use AWS Certificate Manager to issue a certificate for the RDS instance

Answer

Place the RDS instance in a private subnet and use VPC peering

Answer

Use AWS KMS to encrypt the database before inserting data and decrypt on read

Question 9

An S3 bucket has the above bucket policy. What is the effect of this policy?

Accepted Answer

It denies access to the bucket if the request is not sent over HTTPS. The bucket policy denies access to the bucket if the request is not sent over HTTPS. This is a common security measure to enforce encryption in transit. The policy likely includes a condition that checks 'aws:SecureTransport' and denies if it is false, meaning any non-HTTPS request is blocked.

Answer

It allows anonymous access to the bucket over HTTPS

Answer

It denies all access to the bucket regardless of protocol

Answer

It allows access only from specific IP addresses

Question 10

A DevOps engineer needs to securely store and automatically rotate database credentials for a web application running on Amazon ECS. Which solution should be used?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure rotation. Grant the ECS task IAM role permission to retrieve the secret.. AWS Secrets Manager can store database credentials and automatically rotate them on a schedule. The ECS task can retrieve the credentials using the Secrets Manager secret. Option C is correct. Option A (AWS KMS) is for encryption keys, not credential rotation. Option B (SSM Parameter Store) can store secrets but does not support automatic rotation. Option D (AWS Certificate Manager) is for SSL/TLS certificates.

Answer

Use AWS KMS to generate and rotate a data key for encrypting the credentials in a file on ECS.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString. Use a Lambda function to rotate them.

Answer

Use AWS Certificate Manager to store the credentials as a certificate.

Question 11

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

Accepted Answer

Create an IAM user with administrator access and use that instead. Best practices for root user include enabling MFA, using a strong password, and not using root for daily tasks. Deleting the root user is not possible. Access keys should not be created for root user.

Answer

Use the root user for daily administrative tasks

Answer

Create access keys for the root user to use with CLI

Answer

Delete the root user after creating an IAM admin user

Question 12

Which THREE AWS services can be used to centrally manage and enforce security policies across multiple accounts in AWS Organizations? (Select THREE.)

Accepted Answer

AWS Config Conformance Packs. AWS Config Conformance Packs enable you to deploy and enforce a collection of AWS Config rules and remediation actions across multiple accounts and Regions in an AWS Organization. They provide a centralized way to ensure that resources comply with internal policies by using a YAML template that defines the rules and parameters, which are then applied to all member accounts via AWS Config aggregators and StackSets.

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 13

Which TWO measures can be taken to protect data at rest in Amazon S3? (Select TWO.)

Accepted Answer

Enable S3 Server-Side Encryption (SSE-S3 or SSE-KMS). S3 Server-Side Encryption (SSE) and S3 Bucket Policies to deny unencrypted PUT requests are measures to protect data at rest. MFA Delete protects against accidental deletion, not encryption. Cross-region replication is for disaster recovery. S3 Transfer Acceleration speeds up uploads.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the bucket

Answer

Use S3 Transfer Acceleration

Question 14

An S3 bucket has the above bucket policy. What is the net effect on GetObject requests?

Accepted Answer

Only requests from IP range 192.0.2.0/24 are allowed. The bucket policy grants s3:GetObject to everyone (Principal "*") but wraps it in a Condition restricting the source to the 192.0.2.0/24 CIDR via aws:SourceIp. Because the Allow statement is conditional, only requests originating from that IP range satisfy the policy and are permitted; all other requests are implicitly denied since S3 is deny-by-default. The net effect is that GetObject succeeds only for callers inside 192.0.2.0/24.

Answer

All anonymous users can read objects

Answer

All requests are denied

Answer

Only authenticated users can read objects

Question 15

A company needs to enforce that all EC2 instances launched in an AWS account use a specific Amazon Machine Image (AMI) that is approved by the security team. Which combination of services should be used?

Accepted Answer

AWS Config rule to check AMI ID and AWS Systems Manager Automation to remediate non-compliant instances. AWS Config can evaluate whether EC2 instances use the approved AMI ID by creating a custom rule or using a managed rule, and AWS Systems Manager Automation can automatically remediate non-compliant instances (e.g., stop, terminate, or notify). This combination enforces the policy and provides automated remediation, which is the most effective way to ensure compliance.

Answer

AWS Organizations SCP and AWS CloudTrail

Answer

AWS Lambda and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Events