DOP-C02 Security and Compliance Practice Test 19 — 15 Questions

Question 1

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an S3 bucket. The Security team requires that the application never uses long-term credentials and that access is scoped to the specific ECS task. Which approach should be used?

Accepted Answer

Create an IAM role for the ECS task and reference it in the task definition. Option D is correct because ECS tasks using the Fargate launch type can assume an IAM role that is specified in the task definition. This IAM role provides temporary credentials via the ECS task metadata endpoint, ensuring that the application never uses long-term credentials and that permissions are scoped precisely to that task. The Security team's requirements are fully met by this approach.

Answer

Embed the IAM user credentials in the container image

Answer

Store AWS access keys in AWS Secrets Manager and retrieve them at runtime

Answer

Use an IAM role for the EC2 instance if using EC2 launch type

Question 2

A company wants to monitor and detect suspicious API activity across all AWS accounts in an organization. Which TWO services should be used together?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can centrally aggregate and store API activity logs from all AWS accounts in an organization. When combined with AWS CloudTrail, which records API calls, CloudWatch Logs enables real-time monitoring and alerting on suspicious API patterns using metric filters and alarms.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 3

A company needs to enforce that all IAM users must use multi-factor authentication (MFA) to perform any AWS Console actions. Which TWO steps should be taken to enforce this?

Accepted Answer

Attach the policy to all IAM users or a group containing all users. To enforce MFA, you need an IAM policy that denies actions if MFA is not present, and you must attach that policy to all users or a group. Creating an SCP can enforce across accounts but is not needed for single account. CloudTrail does not enforce. Account alias is unrelated.

Answer

Create an SCP in AWS Organizations

Answer

Set an account alias for the root user

Answer

Enable CloudTrail to log MFA usage

Question 4

A company uses AWS CodeBuild to build and test code. The build jobs need to access a private S3 bucket to download dependencies. Which THREE steps are required to securely grant access?

Accepted Answer

Configure the S3 bucket policy to allow access from the CodeBuild service principal. To grant CodeBuild access to an S3 bucket, you need an IAM role that allows the required actions, attach it to the CodeBuild project, and also ensure the bucket policy allows the role. KMS key is not required if SSE-S3 is used. VPC endpoint is optional.

Answer

Set up a VPC endpoint for S3

Answer

Create a KMS key and grant CodeBuild access to it

Question 5

A company's Security team wants to detect and alert on the creation of IAM users with console access. Which THREE services should be used?

Accepted Answer

AWS CloudTrail. CloudTrail logs the CreateUser and CreateLoginProfile API calls. CloudWatch Logs can receive CloudTrail logs and create metric filters. CloudWatch Alarms can trigger on the metric. Config can track resource changes but not as efficient for alerting on API calls. GuardDuty does not specifically focus on IAM user creation.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 6

A company uses AWS Organizations with 20 accounts. The Security team has configured AWS CloudTrail to deliver logs from all accounts to a central S3 bucket (central-bucket). The bucket policy allows CloudTrail to write objects and uses SSE-S3 encryption. Recently, auditors found that some log files were missing for a few hours. The CloudTrail console shows that trails are enabled in all accounts. The central-bucket has default encryption enabled. What is the MOST likely cause of the missing logs?

Accepted Answer

The S3 bucket policy denies access unless the PutObject request includes the x-amz-server-side-encryption header with value AES256. If the bucket's default encryption is SSE-S3, CloudTrail can write without issue. However, if the bucket policy denies writes that do not include encryption headers, but CloudTrail does not include them by default, then logs will be denied. The missing logs suggest a policy conflict. Option A is the most direct cause; CloudTrail may not include the required encryption headers if the bucket policy requires them.

Answer

The CloudTrail trail is not configured to deliver to the central bucket from all regions

Answer

The S3 bucket policy contains a deny condition that requires aws:SecureTransport to be true, but CloudTrail uses HTTP

Answer

The IAM role used by CloudTrail does not have s3:PutObject permission

Question 7

A company runs a production application on EC2 instances behind an Application Load Balancer (ALB). The application handles sensitive data. The Security team wants to encrypt all traffic between the ALB and the EC2 instances using TLS. They have created a self-signed certificate on each instance. However, the ALB health checks are failing with a 502 error. The instances are healthy when accessed directly via SSH. What is the MOST likely cause?

Accepted Answer

The target group health check is configured to use HTTPS, but the self-signed certificate is not trusted by the ALB. ALB health checks use HTTPS with a certificate that must be trusted by the target group. Self-signed certificates are not trusted by default. Option C directly addresses this. Option A would cause connection issues but not specifically health checks. Option B could cause failures if mismatched, but self-signed certs generally don't cause that. Option D is about instance security groups, not TLS.

Answer

The EC2 instances are not configured with a certificate that matches the ALB's domain name

Answer

The ALB is configured to use a different TLS protocol version than the instances

Answer

The security groups on the EC2 instances do not allow inbound traffic from the ALB

Question 8

A company uses AWS Secrets Manager to store database credentials for a legacy application running on an on-premises server. The application retrieves the secret via the AWS SDK. Recently, the database password was rotated in Secrets Manager, but the application continued to use the old password and failed to connect. The application code is correct and uses the latest SDK. The IAM role attached to the server has the secretsmanager:GetSecretValue permission. What is the MOST likely cause?

Accepted Answer

The application is caching the secret and not refreshing it after rotation. If the secret is rotated, the application may still have the old version cached. By default, Secrets Manager caches credentials for a certain period. Option A is the most likely. Option B would cause immediate failure. Option C is unrelated to rotation. Option D would also cause immediate failure.

Answer

The IAM role does not have permission to list secrets

Answer

The application is using the wrong secret ID

Answer

The secret rotation Lambda function is failing

Question 9

A company uses AWS Organizations with SCPs to enforce security policies. The security team needs to ensure that no IAM user or role can disable AWS CloudTrail or delete CloudTrail logs. Which TWO approaches should be combined to achieve this? (Choose TWO.)

Accepted Answer

Apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail for all accounts.. Option A (SCP) prevents root user and all accounts in the organization from performing the actions. Option E (CloudTrail log file validation) ensures integrity but does not prevent deletion. Option B (service control policy) is the same as A, but SCP is the correct term. Option C (IAM policy) is less effective as it can be overridden by account admins. Option D (S3 MFA Delete) adds extra protection but is not the primary method.

Answer

Use a service control policy to deny s3:DeleteObject on the CloudTrail S3 bucket.

Answer

Enable MFA Delete on the CloudTrail S3 bucket.

Answer

Attach an IAM policy to all users denying cloudtrail:StopLogging.

Question 10

A company is designing a secure CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy. The pipeline must deploy to an EC2 Auto Scaling group across multiple AWS accounts. The security requirements include: (1) no hardcoded credentials, (2) least privilege for cross-account access, (3) encrypted artifacts. Which THREE steps should the DevOps engineer implement? (Choose THREE.)

Accepted Answer

Use a customer-managed KMS key with a cross-account key policy to encrypt artifacts.. Option A uses cross-account roles (correct). Option B uses KMS cross-account key (correct). Option D integrates CodeBuild with Secrets Manager (correct). Option C (SSM parameter) is possible but Secrets Manager is more appropriate for credentials. Option E (CodeCommit) is not required.

Answer

Store database credentials in AWS Systems Manager Parameter Store and retrieve them in CodeBuild.

Answer

Use AWS CodeCommit as the source repository with pull request approval rules.

Question 11

A company uses AWS Organizations with multiple accounts. The security team has implemented an SCP that denies the creation of IAM users. However, a developer in the 'development' account was able to create an IAM user. The DevOps engineer is asked to investigate. The SCP is attached to the root organizational unit (OU) and also to the 'development' OU. The 'development' account is a member of the 'development' OU. The SCP effect is 'Deny' on the 'iam:CreateUser' action. The developer's IAM permissions are managed by an IAM policy that allows 'iam:*'. The engineer checks CloudTrail and sees that the CreateUser API call succeeded. What is the most likely reason?

Accepted Answer

The 'development' account is the management account of the organization, so SCPs do not apply to it.. SCPs do not affect the management account of AWS Organizations. The 'development' account might be the management account. If it is, SCPs do not apply. Option A is incorrect because SCPs are not evaluated by IAM policies. Option B is incorrect because SCPs are not resource-based policies. Option C is plausible but the management account is the most likely.

Answer

The SCP is attached at the root OU but not inherited by the 'development' OU due to an explicit deny on inheritance.

Answer

The SCP is not effective because the developer's IAM policy explicitly allows iam:CreateUser and SCPs cannot override explicit allows.

Answer

The SCP is not applied because the account has a resource-based policy that overrides the SCP.

Question 12

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic to the ALB must be encrypted (HTTPS) and that the ALB must only accept traffic from CloudFront. The DevOps engineer has configured CloudFront with an origin pointing to the ALB, and the ALB has a listener on port 443 with a valid SSL certificate. The engineer also added a security group rule to the ALB that allows HTTPS traffic only from CloudFront's IP ranges. However, users are reporting intermittent 503 errors. The engineer checks CloudFront logs and sees that some requests are failing with 'Origin Connect Error'. What is the most likely cause?

Accepted Answer

The security group rule is using an outdated list of CloudFront IP ranges, and CloudFront has added new IP ranges that are being blocked.. CloudFront uses a large set of IP addresses that change over time. Using a security group with a static list of CloudFront IPs is not recommended because the IPs change. Instead, the ALB should use a custom header that CloudFront adds. Option A is correct: the security group blocks new CloudFront IPs not in the list. Option B (SSL mismatch) would cause a different error. Option C (timeout) would be more consistent. Option D (WAF) would return 403, not 503.

Answer

The ALB has a Web Application Firewall (WAF) that is blocking requests from CloudFront.

Answer

The SSL certificate on the ALB is not trusted by CloudFront, causing handshake failures.

Answer

The ALB idle timeout is set too low, causing CloudFront to close connections prematurely.

Question 13

A company is migrating to AWS and has a requirement to encrypt all data at rest and in transit. They are using AWS KMS with Customer Master Keys (CMKs) for encryption. The DevOps engineer has set up an S3 bucket with default encryption using SSE-KMS. The bucket policy allows access only to a specific IAM role. The engineer also enabled S3 bucket versioning and MFA Delete. However, when the engineer tries to download an object using the AWS CLI with the IAM role, the command fails with 'AccessDenied'. The IAM role has the following permissions: s3:GetObject, s3:ListBucket, kms:Decrypt, kms:DescribeKey. What is the most likely missing permission?

Accepted Answer

The KMS key policy does not grant the IAM role permission to decrypt using the key.. To download an object encrypted with SSE-KMS, the IAM role must have kms:GenerateDataKey (if uploading) and kms:Decrypt (if downloading). However, for GetObject, KMS requires kms:Decrypt. But there is also a need for kms:Encrypt? Actually, reading encrypted data requires only kms:Decrypt. However, the error might be due to the IAM role not having kms:GenerateDataKey? No, that is for writing. The bucket policy might require kms:Encrypt? Wait. The common missing permission is kms:ReEncrypt? No. Actually, for downloading, KMS permission needed is kms:Decrypt. But the error persists. Could be kms:DescribeKey is not needed. But the most likely is that the KMS key policy does not grant the IAM role permissions. The key policy must allow the IAM role to use the key. The question says the IAM role has kms:Decrypt, but the key policy might not grant it. Option A is correct. Option B is for writing. Option C is not needed. Option D is for management.

Answer

The IAM role is missing kms:GenerateDataKey permission.

Answer

The IAM role is missing kms:Encrypt permission.

Answer

The IAM role is missing kms:CreateGrant permission.

Question 14

A company uses AWS CloudTrail to log all API calls across multiple accounts. The logs are stored in an S3 bucket in the management account. The security team wants to ensure that the logs are not tampered with and that any unauthorized modification is detected. The DevOps engineer has enabled CloudTrail log file integrity validation. The engineer also sets up an S3 lifecycle policy to transition logs to Glacier after 90 days. Additionally, the engineer enables S3 server access logging and sends the logs to a different bucket. A few months later, the security team suspects that some logs have been deleted. The engineer checks the CloudTrail digest files and finds that the latest digest file is missing. What is the most likely cause?

Accepted Answer

The S3 lifecycle policy is set to expire objects after 90 days, which deleted the digest file.. CloudTrail log file integrity validation uses digest files to verify logs. If a digest file is missing, it could be due to lifecycle policy deleting it prematurely. Glacier transition does not delete the original file; it transitions to Glacier storage class. But if the lifecycle policy includes expiration, it could delete the object. Option A is correct. Option B is about encryption, not deletion. Option C is about server access logs, which are separate. Option D is about S3 Object Lock, which would prevent deletion.

Answer

The S3 bucket has default encryption enabled, causing the digest files to be unreadable.

Answer

The server access logging is writing access logs to the same bucket, causing overwrites.

Answer

The S3 bucket has Object Lock enabled, which prevents deletion of any objects.

Question 15

A company is using AWS CodeBuild to build and test a Java application. The build process requires access to a private Maven repository hosted on an internal HTTPS server. The DevOps engineer has configured CodeBuild to use a VPC and placed the build environment in a private subnet. The security group for the build environment allows outbound HTTPS to the Maven repository's security group. The Maven repository server is in the same VPC but in a different private subnet. The build fails with a 'Connection refused' error when trying to download dependencies. The engineer checks the security group rules and confirms they are correct. What is the most likely cause?

Accepted Answer

The security group on the Maven repository server does not allow inbound HTTPS from the CodeBuild security group.. The Maven repository server likely has a security group that does not allow inbound HTTPS from the CodeBuild security group. The engineer only checked outbound rule on CodeBuild side, but need inbound rule on the server side. Option A is correct. Option B is about Route53, not relevant. Option C is about NACL, which is stateless, but security group is stateful, so outbound rule alone is not enough. Option D is about the buildspec being incorrect, but the error is connection refused, which suggests network issue.

Answer

The private DNS resolution is failing because the VPC does not have Route53 Resolver enabled.

Answer

The CodeBuild buildspec is using the wrong URL for the Maven repository.

Answer

The network ACL on the private subnets is blocking outbound ephemeral ports.