DOP-C02 Security and Compliance Practice Test 2 — 15 Questions

Question 1

A security engineer is designing a secure VPC architecture for a web application. The application must be isolated from the internet and only accessible through a load balancer. Which TWO actions should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the EC2 instances in a private subnet with no internet gateway attachment.. Placing EC2 instances in a private subnet without an internet gateway ensures they have no direct path to the internet, meeting the isolation requirement. This forces all traffic to and from the instances to go through the load balancer, which is the only entry point for the application.

Answer

Attach an Internet Gateway to the VPC and route the private subnet to it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic on all ephemeral ports.

Answer

Set up an AWS Direct Connect connection for the instances to access the internet.

Question 2

A company is migrating to AWS and needs to comply with PCI DSS. They must encrypt all data at rest and in transit. Which THREE services or features should they use?

Accepted Answer

Elastic Load Balancing (ELB) with TLS termination.. Elastic Load Balancing (ELB) with TLS termination ensures encryption of data in transit between clients and the load balancer, which is a PCI DSS requirement for protecting cardholder data over public networks. By terminating TLS at the ELB, you can offload the cryptographic overhead while maintaining compliance with the encryption-in-transit mandate.

Answer

AWS CloudTrail to log all API calls.

Answer

AWS WAF to protect web applications.

Question 3

A DevOps engineer needs to restrict access to an S3 bucket so that only users from a specific AWS account can read objects. Which TWO methods can achieve this?

Accepted Answer

Create an IAM role in the source account with read access to the bucket, and allow users in that account to assume the role.. An IAM role in the source account can be granted read access to the S3 bucket via a bucket policy that allows the role's ARN. Users in the source account assume this role, which temporarily provides them with the necessary permissions to read objects. This cross-account access pattern is secure and follows AWS best practices for delegating access across accounts.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Generate pre-signed URLs for each object and distribute them only to users in the target account.

Answer

Set a bucket ACL that grants read access to the target account's canonical ID.

Question 4

A company's security team notices that an IAM user has permissions to terminate EC2 instances but should only be allowed to stop them. The current policy allows ec2:TerminateInstances. What is the most secure way to prevent termination while allowing stop?

Accepted Answer

Add a Deny statement for ec2:TerminateInstances with a condition for the user's ARN.. The most secure because adding a Deny statement for ec2:TerminateInstances with a condition for the user's ARN explicitly blocks the termination action, regardless of any other policies that might allow it. Option A is wrong because an SCP affects the entire account, not just the user, and may be too broad. Option B is wrong because simply modifying the policy to include ec2:StopInstances and remove ec2:TerminateInstances does not prevent termination if the user has other policies that grant ec2:TerminateInstances. Option D is wrong because attaching a separate Deny policy is effective but less direct and more complex than adding a Deny in the same policy.

Answer

Use an SCP to deny ec2:TerminateInstances for the entire account.

Answer

Modify the existing policy to include ec2:StopInstances and remove ec2:TerminateInstances.

Answer

Attach a separate managed policy that denies ec2:TerminateInstances to the user.

Question 5

A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the most appropriate service because it is specifically designed to manage secrets like database passwords, with automatic rotation, encryption, and fine-grained access control. Option A (DynamoDB) is a database, not a secrets manager. Option B (S3) can store encrypted data but lacks built-in secret rotation and management. Option C (Systems Manager Parameter Store SecureString) can store secrets but does not support automatic rotation, making Secrets Manager the better choice.

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store (SecureString)

Question 6

A company uses AWS KMS to encrypt data in S3. The security team requires that the key material be rotated every 90 days. What should be done to meet this requirement?

Accepted Answer

Create a customer managed key and manually rotate it every 90 days.. AWS KMS customer managed keys support manual rotation, which allows you to rotate the key material every 90 days as required. Automatic key rotation for customer managed keys is only available with a minimum rotation period of 365 days (yearly), so it cannot meet a 90-day requirement. Manual rotation creates a new backing key while retaining the old one for decryption of previously encrypted data, ensuring compliance with the 90-day rotation policy.

Answer

Create a customer managed key and enable automatic yearly rotation.

Answer

Use an AWS managed key (SSE-S3) and enable rotation.

Answer

Use a custom key store with imported key material and enable automatic rotation.

Question 7

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet that needs to download patches from the internet. Which solution is MOST secure and scalable?

Accepted Answer

Create a NAT Gateway in a public subnet and update the private route table.. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet and receive responses, without allowing inbound traffic. This is the most secure and scalable solution because it is managed by AWS and scales automatically. Option B (a proxy server) is less scalable and requires ongoing management. Option C (assigning an Elastic IP to the private instance) would expose the instance to inbound internet traffic, violating the security of the private subnet. Option D (using a VPC endpoint) is only for accessing AWS services, not general internet patch repositories.

Answer

Launch a proxy server in a public subnet and route traffic through it.

Answer

Assign an Elastic IP to the instance in the private subnet.

Answer

Use a VPC endpoint to the Amazon Linux repository.

Question 8

A security audit reveals that EC2 instances have security groups with overly permissive inbound rules allowing all traffic (0.0.0.0/0) on SSH port 22. What is the BEST way to remediate this at scale?

Accepted Answer

Use AWS Config with a managed rule to detect and auto-remediate.. AWS Config with the managed rule 'restricted-ssh' can detect and auto-remediate non-compliant security groups. Option B is wrong because service control policies (SCPs) do not control security group rules directly; they apply to IAM actions. Option C is wrong because manually updating each security group is not scalable across many instances. Option D is wrong because while a Lambda function triggered by CloudWatch Events could modify security groups, AWS Config provides a built-in, easier-to-manage remediation solution.

Answer

Apply a service control policy (SCP) to deny opening port 22.

Answer

Manually update each security group to restrict SSH to known IPs.

Answer

Use CloudWatch Events to trigger a Lambda function that modifies security groups.

Question 9

A company wants to centralize logging of all API calls made within their AWS account for auditing. Which service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for auditing. Option A is wrong because Amazon S3 access logs only record HTTP requests to S3 buckets, not all API calls across the account. Option C is wrong because VPC Flow Logs capture network traffic metadata, not API calls. Option D is wrong because Amazon CloudWatch Logs is a service for storing and monitoring log files, but it does not inherently capture API calls.

Answer

Amazon S3 access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 10

A DevOps engineer is designing a CI/CD pipeline that deploys to production. The security team mandates that all code changes must be reviewed and signed off by two senior developers before deployment. How can this be enforced?

Accepted Answer

Set up a pull request approval rule in CodeCommit requiring two approvals.. CodeCommit's pull request approval rules allow you to require a specific number of approvals before a pull request can be merged. By configuring an approval rule template that requires two approvals from senior developers, you enforce the mandatory code review and sign-off before any change is merged into the production branch, which then triggers the CI/CD pipeline.

Answer

Use CloudWatch Events to trigger a manual approval step in CodePipeline.

Answer

Restrict push access to the production branch to only the two senior developers.

Answer

Use AWS Lambda to send a notification when a change is pushed.

Question 11

A company has an AWS Lambda function that processes sensitive data. The function needs to access an RDS database with credentials stored in Secrets Manager. What is the MOST secure way to grant the Lambda function access to the secret?

Accepted Answer

Attach an IAM role to the Lambda function with permissions to read the secret and retrieve it at runtime.. The most secure way to grant a Lambda function access to a secret in AWS Secrets Manager is to attach an IAM role to the Lambda function with permissions to read the secret and retrieve it at runtime (Option B). This follows the principle of least privilege and avoids hardcoding or embedding secrets in the function code. Option A is incorrect because AWS KMS is used for encryption, not for storing or retrieving secrets; Secrets Manager handles secret storage, and KMS can be used to encrypt secrets at rest. Option C is insecure because storing credentials directly in environment variables exposes them in plain text. Option D is also insecure because even with encryption enabled, environment variables can be exposed in logs or through the AWS Management Console, and they are not designed for secret management.

Answer

Use AWS KMS to encrypt the credentials and pass them as parameters.

Answer

Store the credentials directly in the Lambda function's environment variables.

Answer

Use Lambda environment variables with encryption enabled.

Question 12

Which TWO actions can be taken to protect an S3 bucket from being publicly accessible? (Select TWO.)

Accepted Answer

Use an SCP to deny s3:PutBucketPolicy.. An SCP (Service Control Policy) can explicitly deny the s3:PutBucketPolicy action at the AWS Organizations level, which prevents any IAM principal in affected accounts from attaching a public bucket policy. This is a preventive guardrail that overrides any permissive IAM permissions, ensuring the bucket cannot be made publicly accessible via policy statements.

Answer

Enable default encryption on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Use CloudFront to serve the bucket content.

Question 13

Which THREE measures can be taken to ensure that EC2 instances are compliant with a security policy that requires all instances to be in a VPC with specific tags? (Select THREE.)

Accepted Answer

Use AWS Config rules to detect non-compliant instances.. AWS Config rules can evaluate EC2 instances against a desired configuration, such as being in a VPC with specific tags. By using a custom or managed rule (e.g., 'required-tags' or 'ec2-instance-in-vpc'), you can detect non-compliant instances and trigger remediation actions. This provides continuous monitoring and reporting of compliance status without blocking the launch itself.

Answer

Use EC2 Auto Scaling to launch instances only in the correct VPC.

Answer

Use CloudWatch alarms to monitor instance launches.

Question 14

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM user or role can create or modify VPCs, but should allow VPC usage for existing VPCs. Which SCP should be attached to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}. It denies both ec2:CreateVpc and ec2:ModifyVpc, preventing creation or modification of VPCs while still allowing other VPC-related actions (like using existing VPCs). Option A denies only ec2:CreateVpc, so users could still modify existing VPCs, which violates the requirement. Option C denies all ec2 actions, which would block the use of existing VPCs entirely, making it too restrictive. Option D denies ec2:CreateVpc and ec2:DeleteVpc but not ec2:ModifyVpc, so VPCs could still be modified, failing to meet the requirement.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:DeleteVpc"],"Resource":"*"}]}

Question 15

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across accounts are encrypted with AWS KMS. Which combination of controls should be used to enforce this?

Accepted Answer

Use an SCP to deny s3:PutBucketEncryption with encryption disabled, and AWS Config rules to detect non-compliant buckets.. It combines preventive and detective controls. An SCP can deny the s3:PutBucketEncryption action unless the bucket is configured with KMS encryption, which prevents non-compliant buckets from being created or modified. AWS Config rules then detect any existing non-compliant buckets or changes that bypass the SCP, providing continuous compliance monitoring.

Answer

Attach an IAM policy to all users denying s3:PutObject without KMS.

Answer

Use an SCP to deny s3:CreateBucket without encryption, and rely on CloudTrail to alert.

Answer

Use AWS Config rules only, with automatic remediation via Lambda.