DOP-C02 Security and Compliance Practice Test 18 — 15 Questions

Question 1

A company wants to centrally manage and audit access to AWS KMS keys across multiple accounts. Which AWS feature should be used?

Accepted Answer

AWS CloudTrail with organization trail. AWS CloudTrail with an organization trail can log all API calls, including KMS key usage, across multiple accounts in an AWS Organization. This provides centralized audit logging for KMS key access. Option A (AWS Config aggregated rules) can evaluate resource compliance but does not audit key usage. Option B (Cross-account IAM roles) allows access but not centralized auditing. Option D (AWS Organizations tag policies) manage tags, not auditing. Therefore, option C is correct.

Answer

AWS Config aggregated rules

Answer

Cross-account IAM roles

Answer

AWS Organizations tag policies

Question 2

A company wants to ensure that all API calls made within its AWS account are logged for auditing purposes. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, making it the correct choice. Option A is incorrect because AWS Config tracks resource configuration changes, not API calls. Option C is incorrect because CloudWatch Logs is for log storage and monitoring, not for recording API calls. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to restrict the use of specific instance types across all accounts to reduce costs and enforce compliance. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit to deny the instance types. Service Control Policies (SCPs) in AWS Organizations set permission guardrails at the OU or account level and apply to all IAM principals within, including the root user. Attaching an SCP to the root OU that denies specific EC2 instance types enforces the restriction across every account in the organization in one place. This is the centralized, preventive control the scenario requires.

Answer

Use AWS Config rules to detect non-compliant instance types

Answer

Create IAM policies in each account to deny the use of the instance types

Answer

Use AWS CloudFormation templates to enforce instance type selection

Question 4

A company is using Amazon RDS for MySQL and needs to encrypt the database at rest. Which action should be taken to enable encryption?

Accepted Answer

Enable encryption when creating the DB instance. Amazon RDS encryption at rest can only be enabled at the time the DB instance is created — you cannot enable it on an existing unencrypted instance. The correct action is therefore to enable encryption during creation (via the console, CLI, or API using the 'StorageEncrypted' parameter). Once enabled, RDS uses AWS KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots.

Answer

Create a read replica with encryption enabled

Answer

Use AWS Secrets Manager to encrypt the data

Answer

Modify the existing DB instance and enable encryption

Question 5

A DevOps engineer receives an alert that an EC2 instance has been compromised. The instance is part of an Auto Scaling group. What is the first step the engineer should take to isolate the instance?

Accepted Answer

Detach the instance from the Auto Scaling group and remove it from the load balancer. The first step to isolate a compromised EC2 instance in an Auto Scaling group is to detach it from the Auto Scaling group and remove it from the load balancer. This stops all incoming traffic to the instance, preventing further damage or data exfiltration while preserving the instance for forensic analysis. Option A (snapshot) is useful for preserving evidence but does not isolate the instance. Option C (AMI) similarly does not provide immediate isolation. Option D (terminate) may destroy evidence and should only be done after investigation.

Answer

Create a snapshot of the instance's root volume

Answer

Create an AMI of the instance for analysis

Answer

Terminate the instance immediately

Question 6

A company requires that all secrets (e.g., database passwords) used by Lambda functions be rotated automatically every 30 days. Which combination of services should be used?

Accepted Answer

AWS Secrets Manager and AWS Lambda. AWS Secrets Manager is the correct choice because it natively supports automatic secret rotation on a configurable schedule (e.g., every 30 days) using a Lambda function as the rotation handler. Secrets Manager directly integrates with Lambda to invoke the rotation logic, updating the secret value and propagating the change to the target database or service without custom infrastructure. CloudHSM, Parameter Store, and KMS do not provide built-in, scheduled rotation of secrets with automatic Lambda invocation.

Answer

AWS CloudHSM and AWS Lambda

Answer

AWS Systems Manager Parameter Store and AWS Lambda

Answer

AWS KMS and AWS Lambda

Question 7

An organization wants to grant cross-account access to an S3 bucket in Account A to a user in Account B. Which policy configuration is required?

Accepted Answer

A bucket policy in Account A and an IAM user policy in Account B. Cross-account access to an S3 bucket requires both a resource-based policy (bucket policy) on the bucket in Account A granting access to the user in Account B, and an identity-based policy (IAM user policy) in Account B allowing the user to access the bucket. Option A correctly includes both policies. Option B is incorrect because S3 bucket ACLs are legacy and not recommended for cross-account access. Option C is missing the bucket policy in Account A, so it is insufficient. Option D is missing the IAM user policy in Account B, so it is insufficient.

Answer

An S3 bucket ACL granting access to the user in Account B

Answer

An IAM user policy in Account B allowing access to the bucket

Answer

A bucket policy in Account A granting access to the user in Account B

Question 8

A security audit reveals that an S3 bucket contains objects that are not encrypted. The bucket is configured with default encryption using SSE-S3. What is the most likely reason that objects are unencrypted?

Accepted Answer

The objects were uploaded before default encryption was enabled. S3 default encryption (SSE-S3) applies only to objects uploaded after the setting is enabled; it does not retroactively encrypt existing objects. Therefore, objects that appear unencrypted were most likely uploaded before default encryption was turned on. This is a common audit finding in buckets with historical data.

Answer

The objects were uploaded with server-side encryption using AWS KMS

Answer

The bucket policy denies SSE-S3 encryption

Answer

The objects were uploaded with SSE-C

Question 9

A company has a requirement to store audit logs for 7 years. The logs are currently stored in Amazon S3 and are accessed infrequently. Which storage class provides the lowest cost while meeting the retention requirement?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class designed for long-term retention of data that is accessed rarely, with a minimum storage duration of 180 days. It meets the 7-year audit log retention requirement at the lowest cost among the options. It provides retrieval times of 12 hours, which is acceptable for infrequently accessed audit logs.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 One Zone-Infrequent Access

Question 10

A company is designing a secure CI/CD pipeline. Which TWO actions should be taken to protect secrets (e.g., API keys) used in the pipeline? (Choose TWO.)

Accepted Answer

Store secrets in AWS Secrets Manager. Option B is correct because AWS Secrets Manager is purpose-built to store, encrypt (using KMS), and rotate sensitive values such as API keys, so the pipeline retrieves them at runtime rather than embedding them in code or config. Option C is correct because granting the CI/CD service an IAM role with least-privilege permissions to read specific secrets enables secure, credential-free access via temporary STS credentials instead of long-lived static keys. Option A is wrong because even KMS-encrypted secrets committed to source code expose the ciphertext to anyone with repo access and risk decryption-key misuse. Option D is wrong because plaintext secrets in a buildspec file are directly readable in the repository and build logs. Option E is wrong because environment variables can leak through logs, process listings, and child processes, and are not a secure secret-management mechanism on their own.

Answer

Encrypt secrets with AWS KMS and store the encrypted value in the source code

Answer

Store secrets in plaintext in the buildspec file

Answer

Pass secrets as environment variables in the build

Question 11

A DevOps team needs to enforce that all S3 buckets in an AWS account are encrypted at rest. Which THREE steps should be taken to achieve this? (Choose THREE.)

Accepted Answer

Configure AWS Config rules to detect buckets without encryption. Option A is correct because AWS Config managed rules such as s3-bucket-server-side-encryption-enabled continuously evaluate buckets and flag any that lack default encryption, giving the team the detection and compliance visibility needed to enforce encryption at rest. Option B is correct because an S3 bucket policy with a Deny effect on s3:PutObject when the request lacks the s3:x-amz-server-side-encryption condition (or aws:SecureTransport-style encryption conditions) blocks unencrypted uploads, actively enforcing encryption for objects written to the bucket. Option D is correct because enabling default encryption (SSE-S3/AES-256 or SSE-KMS) on each bucket ensures all objects are encrypted at rest automatically, even if clients do not specify encryption headers. Option C is not correct because S3 server access logging only records request details for auditing; it does not detect or enforce encryption. Option E is not correct because S3 Transfer Acceleration only speeds up uploads over long distances using edge locations and has no bearing on encryption at rest.

Answer

Enable S3 server access logging

Answer

Enable S3 Transfer Acceleration

Question 12

A company is using AWS KMS to encrypt data. Which TWO statements about AWS KMS key rotation are correct? (Choose TWO.)

Accepted Answer

Customer managed keys can be configured for automatic rotation. Option A is correct because AWS KMS allows you to enable automatic rotation on customer managed keys, rotating the backing key material every year (365 days) while keeping the same key ID and ARN. Option E is correct because AWS managed keys are automatically rotated every year by AWS, with no configuration required or possible on the customer's part. Option B is incorrect because imported key material (keys with origin EXTERNAL) cannot be automatically rotated by KMS; you must manually rotate by re-importing new material. Option C is incorrect because automatic rotation is opt-in for customer managed keys and is not enabled by default. Option D is incorrect because you cannot enable or disable rotation for AWS managed keys; AWS controls their rotation lifecycle entirely.

Answer

Keys imported into KMS support automatic rotation

Answer

Automatic rotation is enabled by default for customer managed keys

Answer

Automatic rotation can be disabled for AWS managed keys

Question 13

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most likely security concern?

Accepted Answer

The bucket is now publicly accessible. The CloudTrail log entry shows a PutBucketPolicy action that sets a bucket policy with principal '*', granting public read access to all objects in the bucket. This is a security concern because the bucket becomes publicly accessible, allowing anyone on the internet to read objects. Option A is correct because the bucket policy makes the bucket publicly accessible. Option B is incorrect because the bucket policy does not grant the root user full access; it grants public access. Option C is incorrect because the action is performed by an IAM user (the user field shows 'arn:aws:iam::123456789012:user/admin'), not the root user. Option D is incorrect because the policy allows all principals (public) to read objects, not just authenticated users.

Answer

The bucket policy grants the root user full access

Answer

The root user performed an action that should have been done by an IAM user

Answer

The bucket policy allows only authenticated users to read objects

Question 14

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores sensitive user data in an S3 bucket. A Security Engineer needs to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. Which solution meets these requirements?

Accepted Answer

Create an IAM role with a policy that grants s3:PutObject and s3:GetObject access to the specific bucket, and attach the role to the EC2 instances as an instance profile.. Creating an IAM role with a policy that grants s3:PutObject and s3:GetObject access only to the specific S3 bucket, and attaching that role to the EC2 instances as an instance profile, ensures that the instances can only access that bucket. This method uses AWS Identity and Access Management (IAM) to restrict permissions per resource. Option A is incorrect because an S3 bucket policy restricting access to the ALB's security group cannot control what the instances themselves do; the instances can still access S3 directly if they have credentials. Option C is incorrect because a VPC endpoint for S3 provides private connectivity but does not restrict which resources the instances can access; it only ensures traffic stays within the AWS network. Option D is incorrect because security groups cannot filter traffic based on S3 bucket names or policies; they only filter IP addresses and ports, and S3 uses HTTPS which is not restrictable by security group to a specific bucket.

Answer

Attach a bucket policy to the S3 bucket that allows access only from the ALB's security group.

Answer

Configure a VPC endpoint for S3 and modify the route table to route S3 traffic through the endpoint.

Answer

Create a security group that allows outbound HTTPS traffic only to the S3 bucket's IP address range.

Question 15

A DevOps engineer needs to securely store and automatically rotate database credentials for a MySQL RDS instance. The credentials should be accessible to a Lambda function without hardcoding them. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it allows you to store secrets, automatically rotate them for supported RDS databases, and retrieve them programmatically via the Lambda runtime using the Secrets Manager API. AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for RDS. AWS KMS is used for managing encryption keys, not storing secrets. IAM roles for EC2 provide permissions to EC2 instances but cannot store credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

IAM roles for EC2