DOP-C02 Security and Compliance Practice Test 19 — 15 Questions

Question 1

A company is using AWS CodePipeline to deploy a web application across multiple AWS accounts using CloudFormation stack sets. The pipeline is in the tools account, and it deploys to production account. The security team requires that all CloudFormation changes to production account be reviewed and approved by a senior engineer. Which approach meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a manual approval step in the CodePipeline before the CloudFormation deployment stage.. Adding a manual approval step in CodePipeline before the CloudFormation deployment stage allows a senior engineer to review and approve changes, meeting the security requirement. Option A is incorrect because CloudTrail only logs actions after they occur and does not provide a review mechanism. Option B is incorrect because denying CloudFormation actions to all but a specific role would prevent the pipeline from deploying unless it uses that role, but it does not enforce a manual review process. Option D is incorrect because SCPs are preventive controls that block actions, not a mechanism for manual approval.

Answer

Use AWS CloudTrail to monitor deployments and send notifications for review.

Answer

Configure an IAM policy that denies CloudFormation actions in the production account except for a specific role used by the senior engineer.

Answer

Use a service control policy (SCP) to prevent CloudFormation changes from the tools account.

Question 2

A company needs to ensure that all API calls made to AWS are encrypted in transit. Which of the following is the correct way to enforce this?

Accepted Answer

Use an IAM policy with a condition that denies access unless the request uses HTTPS.. All AWS API endpoints support HTTPS (TLS) by default. To enforce that all API calls are encrypted in transit, you can use an IAM policy with a condition that denies access unless the request uses HTTPS. Specifically, you can use the `aws:SecureTransport` condition key to require encrypted connections. Option A is correct. Option B is incorrect because security groups control network traffic at the instance level but do not enforce encryption for API calls. Option C is incorrect because AWS KMS is used for managing encryption keys, not for enforcing HTTPS. Option D is incorrect because AWS CloudTrail logs API activity but does not enforce encryption.

Answer

Configure security groups to allow only HTTPS traffic.

Answer

Use AWS Key Management Service (KMS) to create a key and require encryption.

Answer

Enable AWS CloudTrail to log all API calls.

Question 3

A company uses a centralized AWS KMS customer master key (CMK) in the security account to encrypt data in S3 buckets across multiple accounts. The S3 buckets are accessed by EC2 instances in the same accounts. The security team wants to ensure that the CMK can only be used by authorized IAM roles in the member accounts. Which policy configuration should be used?

Accepted Answer

Add a statement to the KMS key policy that grants the IAM roles in the member accounts permission to use the key.. A KMS key policy is the primary resource-based policy that controls who can use a customer managed key, and it must explicitly grant the member-account IAM roles permission to use the key for cross-account access. Because the CMK lives in the security account and the roles live in member accounts, the key policy must include a statement allowing those external principals to call kms:Decrypt and related actions. Without this key policy statement, IAM policies in the member accounts alone cannot grant access to the cross-account key.

Answer

Attach an IAM policy to the IAM roles in the member accounts that allows kms:Decrypt on the CMK.

Answer

Create a service control policy (SCP) that allows kms:Decrypt for the CMK.

Answer

Use a VPC endpoint policy for KMS to allow access from the member accounts' VPCs.

Question 4

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service can be used to achieve this?

Accepted Answer

Use AWS Config with a custom Lambda function to rotate keys when they are older than 90 days.. AWS IAM does not have a built-in automatic rotation feature for access keys. AWS Secrets Manager can store secrets and rotate them, but it does not natively rotate IAM access keys; it supports rotation for RDS, Redshift, and DocumentDB, but not IAM. AWS CloudTrail is a logging service and cannot rotate keys. However, AWS Config can be used with a custom AWS Lambda function to create a rule that triggers rotation when access keys are older than 90 days. Therefore, option D is the correct answer.

Answer

Store the access keys in AWS Secrets Manager and enable automatic rotation.

Answer

Use AWS CloudTrail to detect old keys and send notifications to administrators.

Answer

Use IAM's built-in access key rotation feature.

Question 5

Which TWO actions should a DevOps engineer take to secure a web application running on EC2 instances behind an Application Load Balancer? (Choose two.)

Accepted Answer

Enable AWS WAF on the ALB to filter malicious requests.. Correct answers are D and E. Option D: AWS WAF on the ALB helps filter out common web exploits. Option E: Configuring the EC2 security group to allow inbound traffic only from the ALB's security group ensures that direct access to instances is blocked, forcing traffic through the ALB. Option A is incorrect because allowing all inbound traffic (0.0.0.0/0) on port 443 exposes instances directly to the internet, bypassing the ALB. Option B is incorrect: network ACLs are stateless and less granular than security groups; using a NACL to allow traffic from the ALB's subnet is not a recommended practice for instance-level security. Option C is incorrect: placing EC2 instances behind CloudFront is a content delivery optimization, not a security measure to protect the application layer; it does not replace the need for WAF or security group restrictions.

Answer

Configure the EC2 instance security group to allow inbound traffic from 0.0.0.0/0 on port 443.

Answer

Use a network ACL to allow inbound HTTP/S traffic only from the ALB's subnet.

Answer

Place the EC2 instances behind an Amazon CloudFront distribution.

Question 6

Which TWO AWS services can be used to monitor and detect unauthorized access to AWS resources? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing VPC Flow Logs, DNS logs, and AWS CloudTrail management and data events. It uses machine learning and integrated threat intelligence to detect anomalies such as unusual API calls, crypto-mining activity, or compromised credentials, making it a correct choice for detecting unauthorized access.

Answer

AWS Shield

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A company has a multi-account AWS environment using AWS Organizations. The security team has implemented a service control policy (SCP) that denies the creation of IAM users and roles with full admin access. The SCP is attached to all accounts. However, a DevOps engineer in a member account reports that they are able to create an IAM role with an administrator access policy attached. The engineer uses the AWS Management Console to create the role. The SCP is confirmed to be in place. What is the most likely reason the SCP is not preventing the role creation?

Accepted Answer

The SCP only denies iam:CreateUser, but the engineer is creating a role (iam:CreateRole).. The SCP in question denies only the iam:CreateUser action, but the engineer is creating an IAM role, which requires the iam:CreateRole action. SCPs provide an explicit deny for actions they list; they do not block actions they do not list. Since the SCP does not deny iam:CreateRole, the engineer's IAM policy (which allows iam:CreateRole) is effective. SCPs are inherited by member accounts and, when correctly attached, cannot be overridden by IAM policies; however, they only apply to the actions they explicitly specify.

Answer

SCPs are not inherited by member accounts from the root.

Answer

The SCP is not attached to the member account's root organizational unit.

Answer

The engineer's IAM policy allows iam:CreateRole and overrides the SCP.

Question 8

A DevOps team is deploying a multi-tier application on AWS. The application must comply with PCI DSS. Which combination of services should be used to encrypt data in transit between the web tier and the application tier?

Accepted Answer

AWS Certificate Manager (ACM) and Application Load Balancer (ALB). AWS Certificate Manager (ACM) provisions and manages the TLS certificates, and an Application Load Balancer (ALB) terminates TLS and re-encrypts traffic to backend targets, providing encryption in transit between the web tier and the application tier. This combination is the standard AWS pattern for PCI DSS-compliant in-transit encryption on a multi-tier application.

Answer

AWS CloudHSM and Classic Load Balancer

Answer

AWS KMS and VPC Peering

Answer

AWS WAF and Amazon CloudFront

Question 9

A company wants to securely store database credentials used by an application running on Amazon EC2. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to securely store and manage secrets such as database credentials, and it provides built-in automatic rotation every 90 days (or custom intervals) using Lambda functions. It integrates natively with Amazon RDS, Redshift, and DocumentDB for rotation. IAM and KMS do not store secrets, and Parameter Store does not offer automatic rotation natively.

Answer

AWS IAM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 10

A DevOps engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role attached with a policy that allows s3:GetObject. The S3 bucket policy explicitly denies access to the instance's role. What is the result?

Accepted Answer

Access is denied because the bucket policy explicitly denies. An explicit deny in any policy overrides any allow. The bucket policy deny takes precedence over the IAM role allow, so access is denied. Evaluation logic is that an explicit deny prevents access.

Answer

Access is denied only if the bucket is encrypted

Answer

Access is allowed only if the instance is in the same region

Answer

Access is allowed because the IAM role allows it

Question 11

A company uses AWS CodePipeline to deploy a web application. The pipeline uses artifacts stored in an S3 bucket. The Security team requires that all artifacts be encrypted in transit and at rest, and that the pipeline only access the bucket using a specific VPC endpoint. Which configuration meets these requirements?

Accepted Answer

Create a VPC endpoint for S3 and attach a bucket policy that denies access unless aws:SourceVpce matches the endpoint and aws:SecureTransport is true, and use S3 default encryption. To enforce encryption in transit and at rest plus restrict access to a specific VPC endpoint, you need an S3 gateway or interface endpoint and a bucket policy that denies requests unless aws:SourceVpce matches the endpoint and aws:SecureTransport is true. S3 default encryption (SSE-S3) satisfies encryption at rest. This combination meets all stated requirements.

Answer

Configure an IAM role for CodePipeline with a policy that allows s3:GetObject and s3:PutObject, and attach a bucket policy that allows only that role

Answer

Use an S3 bucket with a lifecycle policy to expire old artifacts

Answer

Enable S3 block public access and use SSE-S3 encryption on the bucket

Question 12

A company wants to centralize audit logs from multiple AWS accounts into a single S3 bucket. The logs must be encrypted at rest using a KMS key. Which solution is the MOST secure and scalable?

Accepted Answer

Configure each account's CloudTrail to send logs to a central S3 bucket with a bucket policy that grants cross-account permissions. Configuring each account's CloudTrail to deliver logs directly to a central S3 bucket with a bucket policy granting cross-account permissions is the most secure and scalable solution. It uses native AWS service integration, avoids custom code, and supports KMS encryption at rest. The bucket policy enforces least privilege and can require SSE-KMS with a specific key.

Answer

Create an IAM role in each account and manually copy logs to a central bucket

Answer

Use Amazon Kinesis Data Firehose to stream logs to S3

Answer

Use AWS Config rules to aggregate logs into a central bucket

Question 13

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an S3 bucket. The Security team requires that the application never uses long-term credentials and that access is scoped to the specific ECS task. Which approach should be used?

Accepted Answer

Create an IAM role for the ECS task and reference it in the task definition. ECS tasks using the Fargate launch type can assume an IAM role that is specified in the task definition. This IAM role provides temporary credentials via the ECS task metadata endpoint, ensuring that the application never uses long-term credentials and that permissions are scoped precisely to that task. The Security team's requirements are fully met by this approach.

Answer

Embed the IAM user credentials in the container image

Answer

Store AWS access keys in AWS Secrets Manager and retrieve them at runtime

Answer

Use an IAM role for the EC2 instance if using EC2 launch type

Question 14

A company needs to enforce that all IAM users must use multi-factor authentication (MFA) to perform any AWS Console actions. Which TWO steps should be taken to enforce this?

Accepted Answer

Attach the policy to all IAM users or a group containing all users. Option C is correct because an IAM policy that uses the aws:MultiFactorAuthPresent condition key with a Deny effect when the value is false is the standard mechanism to block console (and API) actions for users who have not authenticated with MFA. Option A is correct because such a policy only takes effect once it is attached to the relevant principals — attaching it to all IAM users or to a group that contains all users ensures every user is covered. Option B is not appropriate here because SCPs apply at the AWS Organizations OU/account level and cannot enforce per-IAM-user MFA for console sign-in within a single account. Option D is irrelevant since an account alias only changes the sign-in URL and has no bearing on MFA enforcement. Option E is incorrect because CloudTrail only records API activity for auditing; it does not enforce MFA.

Answer

Create an SCP in AWS Organizations

Answer

Set an account alias for the root user

Answer

Enable CloudTrail to log MFA usage

Question 15

A company's Security team wants to detect and alert on the creation of IAM users with console access. Which THREE services should be used?

Accepted Answer

AWS CloudTrail. CloudTrail logs the CreateUser and CreateLoginProfile API calls. CloudWatch Logs can receive CloudTrail logs and create metric filters. CloudWatch Alarms can trigger on the metric. Config can track resource changes but not as efficient for alerting on API calls. GuardDuty does not specifically focus on IAM user creation.

Answer

AWS Config

Answer

Amazon GuardDuty