DOP-C02 Security and Compliance Practice Test 18 — 15 Questions

Question 1

A company is using AWS CodeCommit for source control. A developer accidentally committed a file containing AWS access keys. The keys have been removed from the file, but the commit history still contains them. What is the most secure way to remove the keys from the repository?

Accepted Answer

Use git filter-branch to remove the file from all commits and force push the changes.. Git filter-branch can rewrite history to remove the file from all commits. However, AWS recommends using the AWS CLI's git-secrets or the AWS CodeCommit console's 'delete repository' option. But the most secure and straightforward approach is to use git filter-branch to purge the file and then force push. Option A is wrong because simply reverting the commit leaves the keys in history. Option B is wrong because deleting the file and committing does not remove history. Option D is wrong because AWS does not provide a built-in command to remove a file from history.

Answer

Delete the file from the repository and commit the deletion.

Answer

Use the AWS CLI command 'aws codecommit delete-file' with the --keep-history flag.

Answer

Revert the commit that added the keys.

Question 2

A company uses a centralized AWS KMS customer master key (CMK) in the security account to encrypt data in S3 buckets across multiple accounts. The S3 buckets are accessed by EC2 instances in the same accounts. The security team wants to ensure that the CMK can only be used by authorized IAM roles in the member accounts. Which policy configuration should be used?

Accepted Answer

Add a statement to the KMS key policy that grants the IAM roles in the member accounts permission to use the key.. To allow cross-account use of a KMS CMK, you must add a key policy that grants the necessary permissions to the IAM roles in the member accounts. The key policy should include a statement that allows the root user of the member accounts to delegate permissions, and then the member accounts must create IAM policies that grant their roles access. Option A is wrong because the key policy must explicitly allow the member accounts. Option B is wrong because IAM policies in the member account alone are not sufficient without a key policy allowing the account. Option C is wrong because SCPs cannot grant permissions; they only deny.

Answer

Attach an IAM policy to the IAM roles in the member accounts that allows kms:Decrypt on the CMK.

Answer

Create a service control policy (SCP) that allows kms:Decrypt for the CMK.

Answer

Use a VPC endpoint policy for KMS to allow access from the member accounts' VPCs.

Question 3

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service can be used to achieve this?

Accepted Answer

Use AWS Config with a custom Lambda function to rotate keys when they are older than 90 days.. AWS IAM does not have a built-in automatic rotation for access keys. However, AWS Config can be used with a custom Lambda function to rotate keys based on a rule. Alternatively, you could use AWS Secrets Manager to manage the keys, but it does not natively rotate IAM access keys. The most straightforward way is to use AWS Config with a custom rule that triggers a Lambda function to rotate keys. Option A is wrong because IAM does not have automatic rotation. Option B is wrong because Secrets Manager does not natively support IAM access key rotation. Option D is wrong because CloudTrail is for logging, not rotation.

Answer

Store the access keys in AWS Secrets Manager and enable automatic rotation.

Answer

Use AWS CloudTrail to detect old keys and send notifications to administrators.

Answer

Use IAM's built-in access key rotation feature.

Question 4

Which TWO actions should a DevOps engineer take to secure a web application running on EC2 instances behind an Application Load Balancer? (Choose two.)

Accepted Answer

Enable AWS WAF on the ALB to filter malicious requests.. Using AWS WAF on the ALB protects against common web exploits. Ensuring the EC2 security groups only allow traffic from the ALB security group prevents direct access to EC2. Option A is wrong because allowing all traffic to EC2 is insecure. Option C is wrong because a network ACL is stateless and less granular; security groups are better for this. Option E is wrong because CloudFront is a CDN, not a security feature for the ALB.

Answer

Configure the EC2 instance security group to allow inbound traffic from 0.0.0.0/0 on port 443.

Answer

Use a network ACL to allow inbound HTTP/S traffic only from the ALB's subnet.

Answer

Place the EC2 instances behind an Amazon CloudFront distribution.

Question 5

Which THREE measures can be taken to protect sensitive data stored in an Amazon S3 bucket? (Choose three.)

Accepted Answer

Enable default encryption on the bucket (SSE-S3 or SSE-KMS).. Enabling default encryption, blocking public access, and enabling versioning are key security measures. Option A is wrong because bucket policies are used for access control, not for encryption. Option D is wrong because server access logs are for auditing, not protection. Option E is wrong because cross-region replication is for disaster recovery, not security.

Answer

Enable server access logging for the bucket.

Answer

Enable cross-region replication.

Answer

Configure a bucket policy that denies all access.

Question 6

Which TWO AWS services can be used to monitor and detect unauthorized access to AWS resources? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing VPC Flow Logs, DNS logs, and AWS CloudTrail management and data events. It uses machine learning and integrated threat intelligence to detect anomalies such as unusual API calls, crypto-mining activity, or compromised credentials, making it a correct choice for detecting unauthorized access.

Answer

AWS Shield

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A company has a multi-account AWS environment using AWS Organizations. The security team has implemented a service control policy (SCP) that denies the creation of IAM users and roles with full admin access. The SCP is attached to all accounts. However, a DevOps engineer in a member account reports that they are able to create an IAM role with an administrator access policy attached. The engineer uses the AWS Management Console to create the role. The SCP is confirmed to be in place. What is the most likely reason the SCP is not preventing the role creation?

Accepted Answer

The SCP only denies iam:CreateUser, but the engineer is creating a role (iam:CreateRole).. SCPs do not affect the management account. If the member account is the management account or if the SCP was not applied correctly, it might not work. However, the most common reason is that SCPs only deny actions if the SCP explicitly denies them. If the SCP denies the creation of IAM roles with full admin access, but the engineer is creating the role in the AWS Management Console, the SCP should block it. However, SCPs are evaluated before IAM policies, so if the SCP denies the action, it should be blocked. The likely issue is that the SCP is not applied to the specific account or the SCP statement is incorrect. But among the options, the most plausible is that the SCP does not apply to the management account, and the engineer might be using the management account. However, the question says member account. Another possibility is that the SCP does not deny the iam:CreateRole action with the administrator policy; it might deny only the iam:AttachRolePolicy action. Option A suggests the SCP only denies iam:CreateUser, not iam:CreateRole. Option B suggests the SCP is not attached to the account. Option C suggests the SCP is applied to the root but not inherited. Option D suggests the engineer has an IAM policy that overrides the SCP, which is false because SCPs cannot be overridden by IAM policies. The correct answer is A: the SCP only denies iam:CreateUser, not iam:CreateRole.

Answer

SCPs are not inherited by member accounts from the root.

Answer

The SCP is not attached to the member account's root organizational unit.

Answer

The engineer's IAM policy allows iam:CreateRole and overrides the SCP.

Question 8

A company runs a critical application on EC2 instances that need to access an S3 bucket with sensitive data. The security team has enabled S3 bucket policies that require TLS for all requests (aws:SecureTransport). The application is failing to access the S3 bucket, and logs show errors like 'Access Denied'. The application uses the AWS SDK to make requests. What is the most likely cause of the failure?

Accepted Answer

The application is using HTTP instead of HTTPS to connect to S3.. The bucket policy requires TLS, meaning all requests must be made over HTTPS. If the application is using HTTP instead of HTTPS, the request will be denied. The AWS SDK by default uses HTTPS for S3 endpoints, but if the endpoint URL is explicitly set to HTTP or if the SDK configuration is changed, it could cause the issue. Option A is wrong because the bucket policy does not require specific cipher suites. Option B is wrong because IAM roles can access S3 if they have the right permissions. Option C is wrong because VPC endpoints do not affect the TLS requirement. Option D is correct: if the application is using HTTP, it violates the bucket policy condition.

Answer

The S3 bucket is accessed through a VPC endpoint that does not support TLS.

Answer

The application's IAM role does not have s3:GetObject permission.

Answer

The bucket policy requires a specific TLS version that the application does not support.

Question 9

A company is using AWS KMS to encrypt data at rest in Amazon S3. The Security team requires that all encryption keys be automatically rotated annually. Which key type should be used to meet this requirement?

Accepted Answer

AWS managed symmetric key. AWS managed KMS keys (AWS managed keys) are automatically rotated every year. Customer managed keys require manual rotation or key rotation configuration. AWS managed keys are used for services like S3, EBS, and RDS.

Answer

Asymmetric KMS key

Answer

Customer managed symmetric key

Answer

Custom key store backed by AWS CloudHSM

Question 10

A DevOps team is deploying a multi-tier application on AWS. The application must comply with PCI DSS. Which combination of services should be used to encrypt data in transit between the web tier and the application tier?

Accepted Answer

AWS Certificate Manager (ACM) and Application Load Balancer (ALB). For encryption in transit, using TLS certificates managed by ACM and enforced by an Application Load Balancer is the standard approach. CloudHSM or KMS are for key storage but not directly for in-transit encryption. VPC Peering does not provide encryption.

Answer

AWS CloudHSM and Classic Load Balancer

Answer

AWS KMS and VPC Peering

Answer

AWS WAF and Amazon CloudFront

Question 11

A company wants to securely store database credentials used by an application running on Amazon EC2. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for securely storing secrets and provides automatic rotation. Systems Manager Parameter Store can store secrets but does not natively support rotation without custom automation. KMS is for encryption keys, not secret rotation.

Answer

AWS IAM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 12

An organization uses AWS Organizations with multiple accounts. The Security team needs to enforce a policy that prohibits the creation of S3 buckets with public access in any account. Which policy type should be used?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) allow you to centrally control permissions across all accounts in an organization. SCPs can deny actions like creating public buckets. IAM policies are account-specific. AWS Config rules can detect but not prevent.

Answer

IAM permissions boundary

Answer

AWS CloudTrail trail

Answer

AWS Config rule

Question 13

A DevOps engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role attached with a policy that allows s3:GetObject. The S3 bucket policy explicitly denies access to the instance's role. What is the result?

Accepted Answer

Access is denied because the bucket policy explicitly denies. An explicit deny in any policy overrides any allow. The bucket policy deny takes precedence over the IAM role allow, so access is denied. Evaluation logic is that an explicit deny prevents access.

Answer

Access is denied only if the bucket is encrypted

Answer

Access is allowed only if the instance is in the same region

Answer

Access is allowed because the IAM role allows it

Question 14

A company uses AWS CodePipeline to deploy a web application. The pipeline uses artifacts stored in an S3 bucket. The Security team requires that all artifacts be encrypted in transit and at rest, and that the pipeline only access the bucket using a specific VPC endpoint. Which configuration meets these requirements?

Accepted Answer

Create a VPC endpoint for S3 and attach a bucket policy that denies access unless aws:SourceVpce matches the endpoint and aws:SecureTransport is true, and use S3 default encryption. To enforce encryption in transit and at rest and restrict to a VPC endpoint, you must configure a bucket policy that denies access unless the request uses HTTPS (for transit) and server-side encryption (for at rest), and aws:SourceVpce condition. IAM roles alone cannot enforce VPC endpoint restriction.

Answer

Configure an IAM role for CodePipeline with a policy that allows s3:GetObject and s3:PutObject, and attach a bucket policy that allows only that role

Answer

Use an S3 bucket with a lifecycle policy to expire old artifacts

Answer

Enable S3 block public access and use SSE-S3 encryption on the bucket

Question 15

A company wants to centralize audit logs from multiple AWS accounts into a single S3 bucket. The logs must be encrypted at rest using a KMS key. Which solution is the MOST secure and scalable?

Accepted Answer

Configure each account's CloudTrail to send logs to a central S3 bucket with a bucket policy that grants cross-account permissions. Using AWS CloudTrail with an organization trail to deliver logs to a central S3 bucket is the recommended approach for multi-account logging. KMS encryption can be enabled on the bucket. Cross-account IAM roles can be complex and less centralized.

Answer

Create an IAM role in each account and manually copy logs to a central bucket

Answer

Use Amazon Kinesis Data Firehose to stream logs to S3

Answer

Use AWS Config rules to aggregate logs into a central bucket