DOP-C02 Security and Compliance Practice Test 3 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a web application. The deployment includes an EC2 instance running behind an Application Load Balancer. The security team requires that all data in transit to the application be encrypted. Which configuration best meets this requirement without breaking the deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an HTTPS listener on the ALB with a certificate from AWS Certificate Manager and redirect HTTP to HTTPS.. Creating an HTTPS listener on the ALB with an ACM certificate and redirecting HTTP to HTTPS ensures all data in transit to the application is encrypted. This configuration terminates SSL at the ALB, so traffic between the ALB and EC2 instances can be re-encrypted or left as is, but the requirement is for data in transit to the application, which is satisfied from client to ALB. It does not break the deployment because CodePipeline can still deploy to the EC2 instances behind the ALB.

Answer

Configure CodePipeline to use an encrypted artifact bucket.

Answer

Enable AWS WAF on the ALB to enforce HTTPS.

Answer

Place a CloudFront distribution in front of the ALB and configure it to require HTTPS.

Question 2

A DevOps engineer is configuring AWS Config to detect changes to security group rules. The engineer wants to receive near-real-time notifications when a security group rule that allows inbound SSH traffic is created. Which combination of services and configurations should the engineer use? (Choose the best answer.)

Accepted Answer

Create an AWS Config rule to evaluate security groups, and configure an Amazon EventBridge rule to match 'Config Rules Compliance Change' events and trigger an SNS topic.. AWS Config's delivery channel can be configured with an SNS topic directly, so Config does natively support sending notifications to SNS without EventBridge as an intermediary. However, that native delivery channel feed includes all configuration-item and compliance-change notifications for the entire account/region, requiring the subscriber to parse and filter for the specific rule and NON_COMPLIANT transition of interest. Using an EventBridge rule to match the specific 'Config Rules Compliance Change' event for the restricted-ssh rule (option B) is the cleaner, more precise way to get a targeted near-real-time SNS notification just for this condition.

Answer

Enable Amazon GuardDuty and create a custom threat list for SSH access.

Answer

Use AWS CloudTrail to monitor CreateSecurityGroup API calls and send events to CloudWatch Logs.

Answer

Set up AWS Config to send configuration change notifications directly to an SNS topic.

Question 3

A company uses AWS CodeBuild to build and test code. The security team requires that all build artifacts be encrypted at rest. Which action should the DevOps engineer take to meet this requirement?

Accepted Answer

Create a customer-managed KMS key and specify it in the CodeBuild project's artifacts encryption settings.. To ensure all build artifacts are encrypted at rest, the simplest and most direct approach is to enable default encryption on the S3 bucket used for CodeBuild artifacts. This ensures that any object uploaded to the bucket is automatically encrypted with Amazon S3-managed keys (SSE-S3) or AWS KMS keys. Option A is incorrect because CodeBuild does not have a setting to specify a KMS key for artifact encryption at the project level; encryption is handled by the S3 bucket. Option B is incorrect because while an S3 bucket policy can enforce encryption headers, it is more complex and not necessary if default encryption is enabled. Option D is incorrect because the build environment's EBS volume encryption does not affect the artifacts stored in S3.

Answer

Use an S3 bucket policy to deny write operations unless the request includes the x-amz-server-side-encryption header.

Answer

Enable default encryption on the S3 bucket used for CodeBuild artifacts.

Answer

Configure the CodeBuild project to use an encrypted EBS volume for the build environment.

Question 4

A DevOps engineer needs to grant cross-account access to an S3 bucket in Account A for users in Account B. The users in Account B must be able to list objects and read them. What is the most secure way to configure this access?

Accepted Answer

Create an IAM role in Account A with trust policy allowing Account B to assume it, and attach a policy granting S3 access.. It combines a bucket policy in Account A granting access to Account B's root or specific ARN, and an IAM policy in Account B allowing users to access that bucket. Option A is wrong because a bucket policy alone is insufficient; Account B users also need IAM permissions. Option B is wrong because KMS is for encryption, not access control. Option D is wrong because creating an IAM role in Account A with a trust policy allowing Account B to assume it is a valid pattern, but the question specifies users in Account B; they would need to assume the role, which is less direct than Option C for S3 access.

Answer

Create a bucket policy in Account A that grants access to the IAM user ARNs from Account B.

Answer

Create a KMS key in Account A and share it with Account B to decrypt objects.

Answer

Create a bucket policy in Account A granting access to the root user of Account B, and create an IAM policy in Account B allowing the users to access the bucket.

Question 5

Refer to the exhibit. An IAM policy is attached to an IAM user. Which of the following actions will be allowed by this policy?

Accepted Answer

DescribeInstances on an instance in us-east-1. The Allow statement grants the ec2:DescribeInstances action on all instances. The Deny statement denies all ec2 actions (ec2:*) on instances when the requested region is not us-east-1. Since the request in Option A is for us-east-1, the condition in the Deny statement is false, so the Deny does not apply. Therefore, the Allow stands and DescribeInstances is permitted. Option B (StartInstances) is not explicitly allowed by any statement, and although the Deny does not apply for us-east-1, there is no Allow, so it is implicitly denied. Option C (DescribeInstances in us-west-2) is denied because the region is not us-east-1, triggering the Deny. Option D (StopInstances in us-east-1) is also implicitly denied because no Allow exists for that action.

Answer

StartInstances on an instance in us-east-1

Answer

DescribeInstances on an instance in us-west-2

Answer

StopInstances on an instance in us-east-1

Question 6

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which KMS key type should the company use to meet this requirement without manual intervention?

Accepted Answer

Customer managed key. AWS KMS customer managed keys support automatic annual rotation, which can be enabled with a single setting. This meets the requirement for automatic rotation every year without manual intervention. Customer managed keys give you control over key policies and rotation schedules.

Answer

Imported key material

Answer

Custom key store (CloudHSM)

Answer

AWS managed key

Question 7

A DevOps engineer needs to encrypt data in transit between an Application Load Balancer (ALB) and backend EC2 instances. The application uses HTTPS. What is the simplest way to achieve this encryption?

Accepted Answer

Configure the ALB listener to use HTTPS, and configure the target group to use HTTPS with a self-signed certificate on the instances.. Configuring the ALB listener to use HTTPS and the target group to use HTTPS with a self-signed certificate on the instances is the simplest way to encrypt data in transit between the ALB and backend instances. This establishes TLS from the ALB to the instances without requiring a publicly trusted certificate, which is unnecessary for internal traffic. The self-signed certificate can be generated on the instances and configured in the web server.

Answer

Use an AWS Private Certificate Authority to issue certificates for the instances.

Answer

Use a Network Load Balancer instead with TLS listeners.

Answer

Place both ALB and instances in a VPC with default security groups.

Question 8

Which THREE of the following are best practices for managing IAM roles in AWS Organizations? (Choose three.)

Accepted Answer

Use service control policies (SCPs) to set permission boundaries.. Option A is correct because service control policies (SCPs) in AWS Organizations define the maximum available permissions for member accounts and can be used to enforce permission boundaries, ensuring accounts cannot exceed the organization's approved permission set. Option D is correct because IAM roles with cross-account trust policies are the recommended way to delegate access to users and services across accounts, avoiding the need to create duplicate identities in every account. Option E is correct because creating IAM roles with the principle of least privilege—granting only the permissions required for a task—reduces the blast radius of compromised credentials and is a core AWS security best practice. Option B is not recommended because the root user credentials of the management (master) account should never be shared; the root user should be protected with MFA and its access keys removed. Option C is incorrect because a single IAM user with full permissions across all accounts violates least privilege and creates a single point of failure, whereas AWS recommends federated roles and per-account identities.

Answer

Share the root user credentials of the master account with administrators.

Answer

Use a single IAM user with full permissions across all accounts.

Question 9

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an RDS MySQL database. The security team requires that all traffic between the application and the database be encrypted in transit. Currently, the database security group allows inbound traffic from the ECS tasks' security group on port 3306 (MySQL). The application uses the standard MySQL client connection without SSL. After enabling SSL on the RDS instance, the application starts failing to connect. The error logs show 'SSL connection error: protocol version mismatch'. The application runs on a custom Docker image based on Amazon Linux 2. The DevOps engineer needs to fix the connection issue. Which course of action should the engineer take?

Accepted Answer

Update the Docker image to include the latest MySQL client libraries that support TLS 1.2.. The error 'SSL connection error: protocol version mismatch' indicates the client's TLS stack is too old to negotiate with the RDS instance, which by default enforces TLS 1.2+ (and disables TLS 1.0/1.1 on modern MySQL 8.0 parameter groups). Amazon Linux 2's default MySQL client libraries may be outdated and only offer TLS 1.0/1.1, so the handshake fails. Updating the Docker image to include current MySQL client libraries (e.g., mysql-community-client or mariadb client with OpenSSL 1.1.1+) enables TLS 1.2 negotiation and resolves the mismatch.

Answer

Update the application code to connect using SSL with the --ssl-mode=REQUIRED flag.

Answer

Modify the RDS parameter group to allow TLS 1.0 and 1.1.

Answer

Create a VPC peering connection and route traffic through a VPN.

Question 10

A startup wants to provide temporary, limited-privilege AWS access to external contractors who will assist with a project. The contractors do not have AWS accounts. The company wants to avoid creating IAM users for each contractor. They need a solution that allows contractors to log in to the AWS Management Console for a limited time. Which AWS service should the engineer use?

Accepted Answer

Use AWS SSO with an external identity provider, and grant access to an AWS account with a permission set.. AWS IAM Identity Center (formerly AWS SSO) can federate with an external identity provider so contractors authenticate with their own corporate credentials and receive a permission set scoped to the AWS account for a limited session. This avoids creating IAM users per contractor and supports console login with temporary credentials.

Answer

Create IAM users for each contractor and attach a policy with a condition to expire access after the project.

Answer

Use Amazon Cognito user pools to create temporary user accounts.

Answer

Provide the contractors with the root user credentials of a separate AWS account.

Question 11

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). The application uses HTTPS. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. The instances currently use a self-signed certificate for the backend HTTPS listener. The engineer notices that the ALB health checks are failing, and the error message indicates 'TLS handshake failed'. The health check is configured as HTTPS. What should the engineer do to resolve the health check failure while maintaining encryption?

Accepted Answer

Change the health check to use HTTP on port 80 and allow HTTP traffic from the ALB to the instances.. The ALB health check fails because the self-signed certificate on the instances is not trusted by the ALB. ACM certificates cannot be installed on EC2 instances, so option A is not feasible. The simplest solution is to change the health check protocol to HTTP (option B), which avoids the TLS handshake entirely. This maintains encryption for the actual application traffic (HTTPS between ALB and instances) while allowing health checks to succeed. Option C is not a valid configuration; there is no 'ignore certificate' option for ALB health checks. Option D is not recommended as health checks provide essential monitoring.

Answer

Install a valid certificate from AWS Certificate Manager (ACM) on each EC2 instance and configure the ALB target group to use HTTPS with that certificate.

Answer

Configure the ALB to ignore certificate verification for health checks by setting the health check protocol to HTTPS and enabling 'ignore certificate' option.

Answer

Disable health checks on the ALB and rely on CloudWatch alarms to detect instance failures.

Question 12

A company uses AWS Lambda to process sensitive data stored in Amazon S3. The Lambda function is triggered by S3 object creation events. The security team requires that all data in transit be encrypted using TLS 1.2 or higher. The Lambda function currently uses the AWS SDK to download objects from S3 using HTTP (not HTTPS). The team also needs to ensure that the Lambda function only accesses S3 objects that are encrypted with a specific AWS KMS key. The Lambda execution role already has permissions to decrypt with that KMS key. Which combination of actions should the security team take to meet the requirements?

Accepted Answer

Configure the Lambda function to use HTTPS when calling S3, and add a bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match the specific KMS key.. The Lambda function must explicitly use HTTPS when calling S3 to satisfy TLS 1.2+ in transit, and the bucket policy must enforce that objects are encrypted with the specific KMS key by requiring the x-amz-server-side-encryption-aws-kms-key-id header. Together these meet both the transit encryption and KMS key restriction requirements.

Answer

Configure the Lambda function to use a VPC endpoint for S3, and update the bucket policy to deny requests that do not use TLS 1.2.

Answer

Enable default encryption on the S3 bucket using the specific KMS key, and update the Lambda function to use the AWS SDK's default client, which uses HTTPS.

Answer

Place a CloudFront distribution in front of the S3 bucket, and configure the Lambda function to access S3 through CloudFront using HTTPS.

Question 13

A company uses AWS CloudFormation to manage infrastructure as code. The security team requires that all changes to CloudFormation stacks be reviewed and approved before execution. The team has enabled StackSets to deploy stacks across multiple accounts. A junior developer accidentally runs a stack update that modifies a production security group, opening SSH access to 0.0.0.0/0. The security team wants to prevent this type of incident in the future. They need a solution that enforces a mandatory approval workflow for all stack updates, while still allowing automated deployments from approved CI/CD pipelines. Which solution meets these requirements?

Accepted Answer

Create an IAM policy that denies cloudformation:UpdateStack unless the request is made using a specific service role with a path /ci-cp/, and configure the CI/CD pipeline to assume that role.. Creating an IAM policy that denies cloudformation:UpdateStack unless the request is made using a specific service role with a path /ci-cp/, and configuring the CI/CD pipeline to assume that role, enforces that only the approved CI/CD pipeline can update stacks. This provides a mandatory approval workflow because manual updates by users without that role are denied. The CI/CD pipeline itself can include approval steps as needed.

Answer

Use CloudFormation change sets and require that they be manually executed by a senior engineer.

Answer

Attach a resource-based policy to the stack that denies updates from any principal that does not have a specific tag.

Answer

Enable termination protection on all production stacks and require MFA for stack updates.

Question 14

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts are encrypted with AES-256 (SSE-S3) and that public access is blocked. The team wants to use a preventive control that automatically remediates non-compliant buckets. Which solution should the security team implement?

Accepted Answer

Create a Service Control Policy (SCP) that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the bucket is not configured correctly.. A Service Control Policy (SCP) is a preventive control that can deny actions across all accounts in an AWS Organization. Option A describes creating an SCP that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions if the bucket is not configured correctly. This prevents any non-compliant bucket from being created or modified. Options B and C are detective or not resource-specific, and Option D (AWS Config with Lambda) is detective and reactive, not preventive. Therefore, Option A is the correct solution.

Answer

Enable CloudTrail to log all S3 API calls and set up a CloudWatch Events rule to notify the security team.

Answer

Use AWS Identity and Access Management (IAM) policies to deny access to S3 buckets that do not have encryption enabled.

Answer

Use AWS Config rules to detect non-compliant buckets and trigger a Lambda function to remediate.

Question 15

A company uses Amazon CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed AWS KMS key. The team has enabled encryption on the CloudWatch Logs log group using a KMS key. However, after enabling encryption, the application fails to write logs to the log group. The application uses an IAM role that has the following permissions: logs:CreateLogStream, logs:PutLogEvents, and logs:DescribeLogStreams. Which additional permission does the application need?

Accepted Answer

kms:Encrypt. To write to an encrypted CloudWatch Logs log group, the IAM role needs kms:Encrypt permission on the KMS key to encrypt log data at rest. Option B is incorrect because kms:GenerateDataKey is not required; CloudWatch Logs does not use envelope encryption with data keys. Option C is incorrect because kms:CreateGrant is used to grant temporary access to a KMS key, not for writing logs. Option D is incorrect because kms:Decrypt is used for reading encrypted logs, not writing them.

Answer

kms:GenerateDataKey

Answer

kms:CreateGrant

Answer

kms:Decrypt