DOP-C02 Security and Compliance Practice Test 19 — 15 Questions

Question 1

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team requires that all artifacts be encrypted at rest and in transit. Which configuration ensures encryption for all stages?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable default encryption on the S3 artifact bucket and ensure all connections use HTTPS.. Enabling default encryption on the S3 artifact bucket ensures that all artifacts stored in the bucket are encrypted at rest. Additionally, ensuring all connections use HTTPS provides encryption in transit for all communications between pipeline stages (e.g., CodeBuild downloading from S3, CodeDeploy pulling artifacts). Option A is incorrect because enabling KMS encryption on the artifact bucket is not automatic with CodePipeline; you must configure it. Moreover, SSH is not used for CodeCommit; HTTPS is the primary method. Option B is incorrect because ACM certificates are used for securing custom domain endpoints, not for encrypting pipeline artifacts at rest or in transit by default. Option D is incorrect because CodePipeline does not have a built-in encryption feature; encryption must be configured on the S3 bucket.

Answer

Enable AWS KMS encryption on the CodePipeline artifact bucket and use SSH for CodeCommit.

Answer

Use an AWS Certificate Manager (ACM) certificate for CodeBuild and CodeDeploy endpoints.

Answer

Encrypt the CodePipeline artifact using the pipeline's built-in encryption feature.

Question 2

A security audit reveals that an S3 bucket contains objects that are publicly accessible. The DevOps engineer must prevent any future public access to the bucket and all objects within it. Which THREE actions should the engineer take? (Choose THREE.)

Accepted Answer

Enable Block Public Access settings on the bucket.. Enabling block public access settings on the bucket prevents any future public access, including through ACLs or bucket policies. Option C is correct because removing any bucket policy that grants public read access eliminates one potential vector for public access. Option D is correct because applying an SCP that denies s3:PutBucketPolicy actions that would make objects public ensures that no account in the organization can create a policy that grants public access. Option B is incorrect because disabling object ACLs only removes one method of granting public access; bucket policies can still allow public access. Option E is incorrect because enabling server access logging helps with auditing but does not prevent public access.

Answer

Disable object ACLs on the bucket.

Answer

Enable S3 server access logging.

Question 3

A company wants to centrally manage user access to multiple AWS accounts using federated identity. Which AWS service should be used to create a single sign-on (SSO) solution?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is purpose-built to centrally manage user access and permissions across multiple AWS accounts and applications from a single place. It allows you to create or connect your existing identity source (e.g., Active Directory, Okta, Azure AD) and then define fine-grained permission sets that map users or groups to specific roles in each account, enabling a true single sign-on (SSO) experience without needing to create IAM users in every account.

Answer

AWS Organizations

Answer

AWS Directory Service for Microsoft Active Directory

Answer

Amazon Cognito

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every 365 days. Which type of KMS key should be used?

Accepted Answer

Customer managed key (CMK). AWS managed keys (aws/s3) are automatically rotated every year (365 days). Customer managed keys allow you to set a custom rotation period (any length between 90 days and 10 years) but require enabling rotation. The key is that aws/s3 keys rotate automatically without any configuration. However, the question says 'all encryption keys' and 'every 365 days' - both options can achieve that, but aws/s3 keys are automatically rotated, while customer managed keys need rotation enabled. The best practice is to use the most appropriate. But note: customer managed keys can be rotated automatically if you enable it. The question might be ambiguous, but typical exam scenario: use customer managed keys for more control. However, the security team requires automatic rotation; both can do it. The nuance: customer managed keys have a rotation period that you can set, but the default is 365 days when you enable rotation. So both work. But the question says 'which type' - likely they want customer managed because it allows you to control the policy. However, aws/s3 keys are automatically rotated and cannot be customized. Since the requirement is 'every 365 days', which is the default for both, but aws/s3 keys are already rotated on that schedule. I think the answer is 'Customer managed key' because it's a key you own and have control over the rotation policy. Actually, aws/s3 keys are rotated annually, but you cannot view or manage them. For compliance, you might need to control the key. So I'll go with customer managed key.

Answer

AWS owned key

Answer

Custom key store backed by CloudHSM

Answer

AWS managed key (aws/s3)

Question 5

Refer to the exhibit. This S3 bucket policy allows the root user of account 111122223333 to perform which actions?

Accepted Answer

Read and write objects in the bucket. The policy grants s3:GetObject and s3:PutObject to the root user of the specified account. It does not grant other actions. The resource is objects under my-bucket. The principal is the root user of the other account.

Answer

Change the bucket policy

Answer

Delete objects from the bucket

Answer

List objects in the bucket

Question 6

A DevOps engineer is designing a CI/CD pipeline that deploys code to an EC2 instance. The engineer needs to securely store and retrieve database credentials used by the application. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. WS Secrets Manager (Option C) because it is specifically designed for securely storing, managing, and automatically rotating database credentials and other secrets. Amazon S3 with server-side encryption (Option A) is an object storage service and not intended for secret management; it lacks automatic rotation and fine-grained access control for secrets. AWS Systems Manager Parameter Store (Option B) can store secrets but does not natively support automatic rotation, which is a key requirement for database credentials. AWS Key Management Service (Option D) manages encryption keys, not secrets themselves, and is used for encryption, not secret storage.

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Question 7

A company wants to centralize IAM user management across multiple AWS accounts. The company currently uses individual IAM users in each account. What is the BEST practice for centralized access control?

Accepted Answer

Use AWS Organizations and AWS IAM Identity Center (AWS SSO) to manage users centrally.. AWS Organizations with IAM Identity Center (AWS SSO) enables centralized user management and single sign-on across multiple AWS accounts, eliminating the need to manage individual IAM users in each account. Option B is incorrect because creating the same IAM users in each account leads to duplication and inconsistent permissions. Option C is incorrect because cross-account roles still require local IAM users or federated identities to assume those roles, and do not provide centralized user management. Option D is incorrect because IAM federation with an external IdP centralizes authentication but does not inherently manage users across accounts unless combined with AWS Organizations and IAM Identity Center.

Answer

Create the same IAM users in each account with identical permissions.

Answer

Create IAM roles in each account and allow cross-account access from a central account.

Answer

Use IAM federation with an external identity provider and assign permissions based on SAML attributes.

Question 8

A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?

Accepted Answer

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.. An ALB can be configured with an HTTPS listener and a redirect rule that sends HTTP traffic to HTTPS, enforcing encrypted transit at the load balancer level. Option A is incorrect because configuring the web server to only respond to HTTPS does not prevent HTTP traffic from reaching the ALB; the ALB would still accept HTTP. Option C is incorrect because security groups filter traffic based on ports and IP addresses but cannot redirect HTTP to HTTPS; they only allow or deny traffic. Option D is incorrect because while CloudFront can redirect HTTP to HTTPS, the question asks for a configuration on the ALB itself, not an additional service.

Answer

Configure the web server on the EC2 instances to only respond to HTTPS requests.

Answer

Configure the security group of the ALB to only allow inbound HTTPS traffic.

Answer

Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.

Question 9

A security team wants to automatically detect and remediate S3 buckets that are publicly accessible across multiple AWS accounts. Which solution is MOST efficient and scalable? (Choose THREE.)

Accepted Answer

Apply a service control policy (SCP) to deny s3:PutBucketAcl that makes buckets public.. Options B, D, and E are correct. An SCP can centrally deny s3:PutBucketAcl actions that make buckets public, preventing public access across all accounts (B). AWS Config with the managed rule 's3-bucket-public-read-prohibited' can detect publicly accessible buckets across accounts when using an aggregator (D). CloudWatch Events (now Amazon EventBridge) can trigger a Lambda function to automatically remediate non-compliant buckets, such as applying a bucket policy or ACL change (E). Option A (Trusted Advisor) is per-account and only alerts, not remediates; Option C (manual review) is not scalable for multiple accounts.

Answer

Use AWS Trusted Advisor to check for open S3 buckets and send alerts.

Answer

Manually review each account's S3 bucket permissions weekly.

Question 10

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. What should be done? (Choose TWO.)

Accepted Answer

Modify the KMS key policy to include a condition that requires the kms:ViaService to be from the VPC endpoint.. Options B and E are correct. To restrict KMS key usage to within the VPC, you first create a VPC endpoint for AWS KMS (Option E) to allow private connectivity. Then, you modify the KMS key policy to include a condition that requires the request to originate from that VPC endpoint, using the kms:ViaService condition key (Option B). Option A is wrong because security groups do not apply to KMS keys; they are used for EC2 instances and network interfaces. Option C is wrong because S3 bucket policies cannot restrict which KMS key is used for encryption; they can only restrict S3 actions. Option D is wrong because service control policies (SCPs) apply at the organizational level and cannot restrict KMS key usage to a specific VPC; key policies are the correct mechanism.

Answer

Attach a security group to the KMS key.

Answer

Configure the S3 bucket policy to allow only requests from the VPC.

Answer

Create a service control policy (SCP) that denies KMS operations from outside the VPC.

Question 11

A DevOps team is deploying a web application on EC2 instances behind an ALB. The application must authenticate users using an external identity provider (IdP) that supports SAML 2.0. Which solution provides the simplest integration with the ALB?

Accepted Answer

Configure the ALB to use an SAML identity provider for authentication. The Application Load Balancer (ALB) natively supports SAML 2.0 identity provider (IdP) authentication. This allows the ALB to offload user authentication at the edge, validating SAML assertions directly and forwarding authenticated requests to the target EC2 instances without any application-level changes. This is the simplest integration as it requires no additional infrastructure or code on the EC2 instances.

Answer

Use Amazon Cognito user pools with SAML federation and integrate with ALB

Answer

Use AWS CloudFront with Lambda@Edge to validate SAML tokens

Answer

Install a SAML service provider library on each EC2 instance

Question 12

A company's security policy requires that all EC2 instances must be launched with an IAM role that provides least privilege access. A DevOps engineer needs to enforce this across the organization. Which approach is MOST effective?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance is launched with the required IAM role, and attach it to all users. Attaching an IAM policy to all users that denies ec2:RunInstances unless the instance is launched with the required IAM role directly enforces the requirement. Option A (SCP denying if not the approved role) is incorrect because SCPs cannot check for a specific role attachment at launch time; they only control permissions at the account level. Option B (SCP denying unless instance profile attached) only requires any instance profile, not specifically the approved one. Option C (AWS Config + Lambda) is reactive and can have delays, so it is less effective than a preventive IAM policy.

Answer

Create an SCP that denies ec2:RunInstances if the specified IAM role is not the approved role

Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action unless an instance profile is attached

Answer

Use AWS Config to detect instances without the required role and terminate them via Lambda

Question 13

A DevOps team is designing a solution to encrypt data at rest for an Amazon RDS for MySQL database. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use AWS KMS to create a customer managed key and assign it to the RDS instance. To encrypt data at rest for Amazon RDS for MySQL, encryption must be enabled when creating the DB instance (Option D) and a customer managed key from AWS KMS can be used (Option C). Option A is incorrect because you cannot enable encryption on an existing unencrypted RDS instance; it must be done at creation time. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest. Option E is incorrect because storing database files in an encrypted S3 bucket does not encrypt the RDS instance; RDS encryption is managed by AWS KMS and is enabled at the instance level.

Answer

Enable encryption after creating the RDS instance by modifying the instance

Answer

Enable SSL/TLS for the RDS instance

Answer

Store the database files in an encrypted S3 bucket

Question 14

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Accepted Answer

Launch the RDS instance in a private subnet.. (launch RDS in a private subnet) and Option D (enable encryption at rest using AWS KMS) are correct best practices for securing an Amazon RDS database. Launching in a private subnet ensures the database is not directly accessible from the internet, enhancing security. Encryption at rest protects data stored on disk. Option A is incorrect because enabling public accessibility increases exposure to attacks. Option B is incorrect because using a single Availability Zone does not enhance security and may reduce availability. Option E is incorrect because direct IAM user access to the database is not a standard practice; RDS uses database authentication, though IAM database authentication can be used, it's not a direct IAM user access and is not a best practice for all scenarios.

Answer

Enable public accessibility for easy management.

Answer

Use a single Availability Zone to reduce complexity.

Answer

Grant direct IAM user access to the database.

Question 15

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline must scan container images for vulnerabilities before deploying to Amazon ECS. Which service should the engineer use to perform the vulnerability scan?

Accepted Answer

Amazon ECR image scanning. Amazon ECR can scan images for vulnerabilities. Option A is wrong because AWS WAF is a web application firewall. Option C is wrong because AWS Config is for compliance and resource inventory. Option D is wrong because Amazon GuardDuty is a threat detection service for workloads.

Answer

AWS WAF

Answer

AWS Config

Answer

Amazon GuardDuty