DOP-C02 Security and Compliance Practice Test 18 — 15 Questions

Question 1

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in all accounts are encrypted with SSE-S3. They plan to use an SCP to deny the creation of unencrypted buckets. The DevOps engineer writes an SCP with a Deny effect for s3:PutBucketEncryption without a condition. However, when testing, an administrator in a member account is able to create a bucket without encryption. The engineer checks CloudTrail and sees that the bucket was created with a PutBucket call that did not include the x-amz-server-side-encryption header. What is the most likely reason the SCP did not prevent this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SCP denies s3:PutBucketEncryption, but the bucket creation does not call that action; it calls s3:CreateBucket. The SCP should deny s3:CreateBucket with a condition on the encryption parameter.. SCPs can deny the s3:PutBucketEncryption action, but the bucket is created with the s3:CreateBucket action, not s3:PutBucketEncryption. The s3:CreateBucket action does not trigger s3:PutBucketEncryption when encryption is not explicitly set; encryption defaults are applied separately. To enforce encryption at creation, the SCP should deny s3:CreateBucket with a condition that the x-amz-server-side-encryption header is absent or not set to AES256. Option B correctly identifies this issue. Option A is incorrect because s3:PutBucketEncryption is used to change encryption settings on an existing bucket, not during creation. Option C is incorrect because the SCP being attached to the wrong OU would cause a different error. Option D is incorrect because the management account is not the one being tested.

Answer

The SCP should also deny s3:PutBucketDefaultEncryption, which is the correct action for default encryption.

Answer

The SCP is not attached to the organizational unit that contains the member account.

Answer

The member account is the management account of the organization, so SCPs do not apply.

Question 2

A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?

Accepted Answer

Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.. Attaching an IAM role to the EC2 instance and using the instance profile allows the application to obtain temporary credentials from the EC2 instance metadata service (IMDS). These credentials are automatically rotated by AWS before they expire, and they are never stored on disk—they are fetched on-demand from the metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). This satisfies both the requirement for automatic rotation and the prohibition against disk storage.

Answer

Store the credentials in AWS Secrets Manager and retrieve them at application startup.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and retrieve them using the EC2 instance's IAM role.

Answer

Generate an access key and secret key for an IAM user and store them in a configuration file on the EC2 instance.

Question 3

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.. AWS CloudFormation StackSets can deploy a stack containing the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, new accounts automatically receive the stack. This centrally manages the rule with minimal operational overhead. Option B is incorrect because SCPs only deny API actions and cannot deploy a Config rule; they would need a separate mechanism to deploy the rule initially.

Answer

Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.

Answer

Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.

Answer

Use an AWS Config aggregator in the management account to monitor compliance across accounts.

Question 4

A DevOps engineer needs to securely store database credentials for an application running on EC2. The credentials must be rotated automatically every 30 days. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with the RDS rotation Lambda blueprint.. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It provides a built-in RDS rotation Lambda blueprint that can be configured to rotate credentials every 30 days without custom code. This fully managed rotation capability meets the requirement for automatic, scheduled rotation with minimal operational overhead.

Answer

Store credentials in AWS Systems Manager Parameter Store and use a Lambda function to rotate them.

Answer

Store credentials in an S3 bucket encrypted with KMS and use S3 Lifecycle policies to rotate the objects.

Answer

Use IAM roles to grant the EC2 instance access to the database, eliminating the need for credentials.

Question 5

A developer wants to grant an EC2 instance read-only access to a specific S3 bucket. Which AWS mechanism should they use to securely provide credentials to the instance?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.. IAM roles with instance profiles provide temporary, automatically rotated credentials to EC2 instances via the AWS STS service. This eliminates the need to hardcode or store long-term access keys on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the AMI.

Answer

Store AWS access keys in the EC2 user data script.

Answer

Retrieve the credentials from AWS Systems Manager Parameter Store using a custom script.

Question 6

A DevOps engineer needs to ensure that all API calls made to AWS are logged for compliance. The logs must be stored in S3 for at least 7 years. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity, source IP, and timestamp, and can deliver log files to an S3 bucket for long-term retention. The requirement to store logs for at least 7 years aligns with CloudTrail's ability to integrate with S3 lifecycle policies for archival or deletion after a specified period.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 7

A company has a multi-account AWS environment using AWS Organizations. They want to centrally manage user access to all accounts using single sign-on (SSO) and enforce multi-factor authentication (MFA). Which service should they use?

Accepted Answer

Use AWS IAM Identity Center (AWS SSO) to manage access and enforce MFA.. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user access and permissions across all AWS accounts in an AWS Organization. It natively supports enforcing multi-factor authentication (MFA) through an identity source (e.g., the built-in identity store or an external IdP) and integrates directly with AWS Organizations to grant single sign-on access without needing to create IAM users in each account.

Answer

Use AWS Secrets Manager to store and rotate IAM user credentials.

Answer

Create IAM users in each account and share the credentials securely.

Answer

Use Amazon Cognito user pools with an identity broker.

Question 8

A company is using AWS CloudFormation to deploy infrastructure. They need to ensure that all resources created by CloudFormation are tagged with a 'CostCenter' tag. The tag must be applied automatically to all resources in the stack. What should they do?

Accepted Answer

Specify the tag in the CloudFormation stack's Tags parameter, which applies the tag to all resources in the stack.. CloudFormation allows you to specify stack-level tags in the Tags parameter when creating or updating a stack. These tags are automatically propagated to all resources that support tagging within the stack, ensuring consistent cost allocation without additional custom logic or post-creation remediation.

Answer

Use AWS Service Catalog to enforce tagging on all products.

Answer

Create an AWS Config rule to detect untagged resources and trigger auto-remediation.

Answer

Use a custom Lambda function as a CloudFormation hook to tag resources after creation.

Question 9

A company requires that all access to their S3 buckets be encrypted in transit. Which configuration achieves this?

Accepted Answer

Use a bucket policy that denies requests when aws:SecureTransport is false.. Using a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` explicitly enforces encryption in transit for all access to the S3 bucket. This policy ensures that any HTTP (non-TLS) request is denied, while HTTPS requests are allowed, meeting the requirement that all access be encrypted in transit.

Answer

Use CloudFront with the bucket as origin and enforce HTTPS only between viewer and CloudFront.

Answer

Enable default encryption on the bucket.

Answer

Set the bucket policy to require SSE-KMS.

Question 10

Which TWO AWS services can be used to manage and rotate database credentials automatically? (Select TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. Options A and B are correct. AWS Systems Manager Parameter Store can store database credentials as SecureString parameters, and you can implement automatic rotation using a custom AWS Lambda function. AWS Secrets Manager provides built-in automatic rotation for supported databases (e.g., Amazon RDS, Amazon Redshift) without requiring custom code. Option C (AWS CloudFormation) is an infrastructure-as-code service and does not manage or rotate credentials. Option D (AWS KMS) is a key management service that encrypts data but does not handle credential rotation. Option E (AWS IAM) manages access permissions and roles, not database credentials.

Answer

AWS CloudFormation

Answer

AWS KMS

Answer

AWS IAM

Question 11

A DevOps engineer must ensure that all API calls in an AWS account are logged for compliance. The logs should be stored in an S3 bucket with server-side encryption enabled. Which two services should be used together to meet these requirements?

Accepted Answer

AWS CloudTrail and Amazon S3. AWS CloudTrail logs all API calls in the account and can deliver these logs to an S3 bucket, where server-side encryption (SSE) can be enabled for compliance. Option A (AWS CloudTrail and Amazon CloudWatch Logs) can capture API calls, but the requirement is to store logs in an S3 bucket with encryption, not CloudWatch Logs. Option C (Amazon VPC Flow Logs and Amazon S3) captures network traffic, not API calls. Option D (AWS Config and AWS CloudTrail) includes AWS Config, which tracks resource configuration changes, not API calls; CloudTrail alone suffices for API logging, but Config is not needed for this requirement.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs and Amazon S3

Answer

AWS Config and AWS CloudTrail

Question 12

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. What is the most likely cause?

Accepted Answer

The Lambda function is not configured to access the VPC where the RDS instance resides.. The most likely cause of the timeout error is that the Lambda function is not configured to access the VPC where the RDS instance resides. When Secrets Manager rotates a secret for an RDS database, the rotation Lambda function must connect to the database to update the credentials. If the Lambda function is not attached to the same VPC (or a VPC with proper routing and security group rules), it cannot reach the RDS instance, causing network connection attempts to hang until the function times out.

Answer

The Lambda function's execution role lacks the required IAM permissions.

Answer

The secret rotation schedule is set to less than 24 hours.

Answer

The Lambda function does not have permission to access the S3 bucket.

Question 13

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the destination account is 222222222222. Which policy should be attached to the S3 bucket?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. It uses a bucket policy to grant cross-account access to the S3 bucket. The policy specifies the destination account (222222222222) as the principal, allowing s3:GetObject on the bucket's objects. This is the standard AWS approach for cross-account S3 access, as bucket policies can grant permissions to principals in other AWS accounts.

Answer

Attach an IAM policy to the user in account 111111111111 allowing s3:GetObject.

Answer

Set the bucket ACL to grant full control to account 222222222222.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 14

A company has an IAM policy that allows users to manage their own passwords and MFA devices. The policy includes a condition that requires MFA for all API operations except for changing passwords and MFA. Which THREE statements are true about this policy? (Choose THREE.)

Accepted Answer

The policy uses NotAction to exclude password and MFA actions.. Options C, D, and E are correct. The policy uses NotAction to exclude password and MFA actions from the MFA requirement, and uses the aws:MultiFactorAuthPresent condition key to require MFA for all other actions. The policy must be attached to IAM users or groups to take effect. Option A is incorrect because the policy is an identity-based policy, not a role. Option B is incorrect because IAM policies do not apply to the root user.

Answer

The policy creates an IAM role for MFA enforcement.

Answer

The policy applies to the AWS account root user.

Question 15

A DevOps engineer needs to ensure that EC2 instances can access an S3 bucket without storing AWS credentials on the instances. Which solution meets this requirement?

Accepted Answer

Attach an IAM role to the EC2 instance with an S3 access policy.. Attaching an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS STS service via the instance metadata service (IMDS). The EC2 instance can then use these credentials to access the S3 bucket without any long-term AWS credentials being stored on the instance. This is the AWS-recommended best practice for granting permissions to AWS services running on EC2.

Answer

Use an S3 bucket policy that grants access to the EC2 instance's public IP.

Answer

Store access keys in the EC2 user data script.

Answer

Create an IAM user and embed credentials in the application code.