DOP-C02 Security and Compliance Practice Test 3 — 15 Questions

Question 1

A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that EBS snapshots are shared with another account without exposing the underlying data. What is the correct approach?

Accepted Answer

Share the encrypted snapshot and update the KMS key policy to allow the target account to use the key.. Sharing an encrypted EBS snapshot requires the KMS key policy to grant the target account permission to use the key (via kms:Decrypt and kms:CreateGrant). Without this, the target account cannot decrypt the snapshot to create volumes or copies. AWS KMS enforces that the key policy explicitly allows cross-account access, and the target account must have the corresponding IAM permissions.

Answer

Share the encrypted snapshot without modifying the KMS key policy.

Answer

Create an unencrypted copy of the snapshot and share it.

Answer

Share the encrypted snapshot and also share the KMS key with the target account.

Question 2

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices an increase in false positives blocking legitimate traffic. Which action should be taken to reduce false positives while maintaining security?

Accepted Answer

Adjust the rate-based rule threshold to a higher value.. Adjusting the rate-based rule threshold to a higher value allows more legitimate traffic while still blocking excessive requests. Option A: Removing the rule would weaken security. Option B: AWS Shield Advanced is a DDoS protection service, not a replacement for fine-tuning WAF rules. Option D: Changing action to 'Count' logs requests but does not block them, reducing security.

Answer

Remove the rate-based rule that is causing false positives.

Answer

Replace AWS WAF with AWS Shield Advanced.

Answer

Change the rule action from 'Block' to 'Count'.

Question 3

A company needs to store sensitive data in Amazon S3 with encryption at rest. Which option provides the MOST control over the encryption keys?

Accepted Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C). SSE-C (Server-Side Encryption with Customer-Provided Keys) gives you full control over the encryption keys because you provide and manage the key material yourself. Amazon S3 performs the encryption and decryption operations, but it never stores your keys; you must supply the key with each request. This is the only option where the customer retains complete ownership and lifecycle management of the encryption keys, including rotation and deletion.

Answer

Client-Side Encryption

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)

Question 4

A company has a Lambda function that processes sensitive data and needs to access an RDS database. The security team requires that the database credentials are automatically rotated every 30 days. Which service should be used to store and rotate the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like RDS. It supports native, built-in rotation for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) without requiring custom Lambda functions. The automatic rotation can be scheduled at a desired interval (e.g., every 30 days) using a rotation schedule defined in the secret's configuration, and it integrates directly with RDS to update the credentials on both the secret and the database.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS IAM roles

Question 5

A company is using AWS CloudTrail to log API events. The security team wants to ensure that log files are tamper-proof and available for incident investigation. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation.. The correct actions are enabling CloudTrail log file validation (Option C) and enabling S3 Object Lock on the S3 bucket storing the logs (Option D). Log file validation creates digest files that allow you to verify that log files have not been tampered with. S3 Object Lock prevents logs from being deleted or overwritten, ensuring availability for investigation. Option A (CloudWatch Logs) stores logs but does not provide tamper-proofing or integrity verification. Option B (SSE-S3) only encrypts data at rest, not protect integrity. Option E (KMS encryption) also only provides encryption, not integrity or deletion protection.

Answer

Store logs in Amazon CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3).

Answer

Use AWS KMS to encrypt the logs.

Question 6

A company wants to audit all changes to IAM policies in their AWS account. Which THREE services can be used to capture and alert on IAM policy changes? (Choose THREE.)

Accepted Answer

AWS Config. Options A, B, and D are correct. AWS CloudTrail logs all IAM API calls. AWS Config can track resource changes and trigger rules. Amazon EventBridge can create rules to detect specific CloudTrail events and trigger notifications. Option C: AWS Trusted Advisor provides best practice checks, not change auditing. Option E: Amazon Inspector is for security vulnerabilities.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 7

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. Which AWS service can automatically manage the encryption keys with minimal configuration?

Accepted Answer

SSE-S3. SSE-S3 (Server-Side Encryption with S3-Managed Keys) is the correct answer because it requires minimal configuration: you simply enable it on the bucket or object, and AWS fully manages the encryption keys, including rotation and protection, without any additional setup or key management overhead.

Answer

SSE-C

Answer

SSE-KMS

Answer

Client-side encryption

Question 8

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting attacks. Which AWS service should be integrated with the ALB?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS traffic. It uses managed rule groups to block common attack patterns like SQL injection (e.g., detecting malicious SQL keywords in query strings) and cross-site scripting (e.g., identifying script tags in user input). This makes it the correct choice for protecting web applications at Layer 7.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Question 9

A company's security team requires that all API calls to AWS are logged for audit purposes. Which service should be enabled to capture and store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services. CloudTrail captures the identity of the caller, the time of the call, the source IP address, the request parameters, and the response elements, storing this information in a log file that can be delivered to an Amazon S3 bucket for long-term audit storage. This directly meets the security team's requirement to capture and store all API calls for audit purposes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 10

A company wants to enforce that S3 buckets are not publicly accessible. Which AWS service can continuously monitor and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config can evaluate S3 bucket policies against managed rules like 's3-bucket-public-read-prohibited' and 's3-bucket-public-write-prohibited'. It can automatically remediate non-compliant buckets using AWS Systems Manager Automation or custom remediation actions. Option A is correct. Amazon Macie is for sensitive data discovery, not for continuous monitoring of public access. AWS Security Hub aggregates security findings but does not automatically remediate. AWS Trusted Advisor provides checks but requires manual remediation.

Answer

Amazon Macie

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 11

A DevOps engineer needs to grant cross-account access to an S3 bucket in Account A for a user in Account B. Which combination of policies is required?

Accepted Answer

An S3 bucket policy in Account A and an IAM policy in Account B.. Cross-account access to an S3 bucket requires both a resource-based policy (the S3 bucket policy in Account A) that grants the necessary permissions to the principal from Account B, and an identity-based policy (an IAM policy in Account B) attached to the user that allows the S3 actions. The bucket policy explicitly authorizes the external user (by ARN), while the IAM policy ensures the user has the required permissions to initiate the request. Without both, the request will fail due to the lack of either resource-side authorization or identity-side authorization.

Answer

An IAM role in Account A and an IAM policy in Account B.

Answer

Only an IAM policy in Account B.

Answer

Only an S3 bucket policy in Account A.

Question 12

A security audit reveals that an IAM user has long-term access keys that have not been rotated in over 90 days. What is the most secure way to enforce key rotation?

Accepted Answer

Use IAM roles instead of long-term access keys.. The most secure way to eliminate the risk of long-term access key compromise is to avoid using them altogether. IAM roles provide temporary security credentials via AWS Security Token Service (STS), which automatically expire (default 1 hour, max 12 hours) and are rotated transparently by the AWS SDK or CLI. This removes the need for manual or automated key rotation, aligning with the AWS Well-Architected Framework's principle of using temporary credentials.

Answer

Use an AWS Lambda function to automatically rotate keys.

Answer

Manually rotate keys every 90 days.

Answer

Delete the user and create a new one.

Question 13

A company's security policy requires that all data in transit between on-premises and AWS is encrypted. Which AWS service provides a dedicated network connection with encryption?

Accepted Answer

AWS Direct Connect + VPN. AWS Direct Connect provides a dedicated network connection, and when combined with an IPSec VPN, it ensures encryption for data in transit. Therefore, Option B (AWS Direct Connect + VPN) is correct. Option A (AWS Transit Gateway) is a network transit hub, not a dedicated encrypted connection. Option C (VPC peering) does not provide encryption by default. Option D (Site-to-Site VPN over internet) uses encryption but lacks a dedicated connection.

Answer

AWS Transit Gateway

Answer

Amazon VPC peering

Answer

AWS Site-to-Site VPN over the internet

Question 14

A company needs to store audit logs for 7 years to meet compliance requirements. Which S3 storage class is the most cost-effective for long-term archival?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class designed for long-term archival of data that is accessed rarely (once or twice per year) and can tolerate retrieval times of 12-48 hours. For a 7-year compliance retention requirement, it provides the most cost-effective storage compared to S3 Glacier Flexible Retrieval, S3 Intelligent-Tiering, or S3 Standard.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 Glacier Flexible Retrieval

Question 15

Which TWO actions should a DevOps engineer take to secure an AWS account root user? (Choose 2.)

Accepted Answer

Delete or disable the root user access keys.. To secure the AWS account root user, best practices include deleting or disabling any existing access keys for the root user (option C) and enabling multi-factor authentication (MFA) for the root user (option E). Sharing the root password, creating an IAM role for the root user, or using the root user for daily tasks are not recommended. Therefore, options C and E are correct.

Answer

Share the root user password with the team.

Answer

Create an IAM role for the root user.

Answer

Use the root user for daily administrative tasks.