DOP-C02 Security and Compliance Practice Test 3 — 15 Questions

Question 1

A security audit reveals that EC2 instances have security groups with overly permissive inbound rules allowing all traffic (0.0.0.0/0) on SSH port 22. What is the BEST way to remediate this at scale?

Accepted Answer

Use AWS Config with a managed rule to detect and auto-remediate.. Option A is correct because AWS Config with a managed rule like 'restricted-ssh' can detect and remediate non-compliant security groups. Option B is wrong because manually updating is not scalable. Option C is wrong because SCPs do not control security group rules directly. Option D is wrong because a Lambda function triggered by CloudWatch Events could work but AWS Config provides built-in remediation.

Answer

Apply a service control policy (SCP) to deny opening port 22.

Answer

Manually update each security group to restrict SSH to known IPs.

Answer

Use CloudWatch Events to trigger a Lambda function that modifies security groups.

Question 2

A company wants to centralize logging of all API calls made within their AWS account for auditing. Which service should they use?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls for auditing. Option A is wrong because CloudWatch Logs is for log storage, not API call recording. Option C is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because S3 is storage, not a logging service.

Answer

Amazon S3 access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 3

A DevOps engineer is designing a CI/CD pipeline that deploys to production. The security team mandates that all code changes must be reviewed and signed off by two senior developers before deployment. How can this be enforced?

Accepted Answer

Set up a pull request approval rule in CodeCommit requiring two approvals.. Option D is correct because CodeCommit's pull request approval rules allow you to require a specific number of approvals before a pull request can be merged. By configuring an approval rule template that requires two approvals from senior developers, you enforce the mandatory code review and sign-off before any change is merged into the production branch, which then triggers the CI/CD pipeline.

Answer

Use CloudWatch Events to trigger a manual approval step in CodePipeline.

Answer

Restrict push access to the production branch to only the two senior developers.

Answer

Use AWS Lambda to send a notification when a change is pushed.

Question 4

A company has an AWS Lambda function that processes sensitive data. The function needs to access an RDS database with credentials stored in Secrets Manager. What is the MOST secure way to grant the Lambda function access to the secret?

Accepted Answer

Attach an IAM role to the Lambda function with permissions to read the secret and retrieve it at runtime.. Option A is correct because using an IAM role with the necessary permissions and retrieving the secret at runtime is standard practice. Option B is wrong because embedding secrets in environment variables is insecure. Option C is wrong because KMS is for encryption, not storing secrets. Option D is wrong because Lambda environment variables can be encrypted but still expose secrets in logs.

Answer

Use AWS KMS to encrypt the credentials and pass them as parameters.

Answer

Store the credentials directly in the Lambda function's environment variables.

Answer

Use Lambda environment variables with encryption enabled.

Question 5

Which TWO actions can be taken to protect an S3 bucket from being publicly accessible? (Select TWO.)

Accepted Answer

Use an SCP to deny s3:PutBucketPolicy.. Option A is correct because an SCP (Service Control Policy) can explicitly deny the s3:PutBucketPolicy action at the AWS Organizations level, which prevents any IAM principal in affected accounts from attaching a public bucket policy. This is a preventive guardrail that overrides any permissive IAM permissions, ensuring the bucket cannot be made publicly accessible via policy statements.

Answer

Enable default encryption on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Use CloudFront to serve the bucket content.

Question 6

Which THREE measures can be taken to ensure that EC2 instances are compliant with a security policy that requires all instances to be in a VPC with specific tags? (Select THREE.)

Accepted Answer

Use AWS Config rules to detect non-compliant instances.. AWS Config rules can evaluate EC2 instances against a desired configuration, such as being in a VPC with specific tags. By using a custom or managed rule (e.g., 'required-tags' or 'ec2-instance-in-vpc'), you can detect non-compliant instances and trigger remediation actions. This provides continuous monitoring and reporting of compliance status without blocking the launch itself.

Answer

Use EC2 Auto Scaling to launch instances only in the correct VPC.

Answer

Use CloudWatch alarms to monitor instance launches.

Question 7

Which TWO AWS services can be used to manage and rotate database credentials automatically? (Select TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. Option A is correct because AWS Secrets Manager provides automatic rotation for supported databases. Option D is correct because AWS Systems Manager Parameter Store (SecureString) can store secrets, but rotation requires custom Lambda. However, Secrets Manager is the primary service for automatic rotation. Option B is wrong because KMS does not rotate secrets. Option C is wrong because IAM does not store database credentials. Option E is wrong because CloudFormation does not manage credential rotation.

Answer

AWS CloudFormation

Answer

AWS KMS

Answer

AWS IAM

Question 8

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM user or role can create or modify VPCs, but should allow VPC usage for existing VPCs. Which SCP should be attached to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}. Option B is correct because the SCP with Deny effect for ec2:CreateVpc and ec2:ModifyVpc attributes, while allowing all other actions, meets the requirement. Option A would block all EC2 actions. Option C denies only CreateVpc but not ModifyVpc. Option D is too permissive.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:DeleteVpc"],"Resource":"*"}]}

Question 9

A DevOps engineer must ensure that all API calls in an AWS account are logged for compliance. The logs should be stored in an S3 bucket with server-side encryption enabled. Which two services should be used together to meet these requirements?

Accepted Answer

AWS CloudTrail and Amazon S3. Option C is correct because AWS CloudTrail logs API calls and can deliver logs to an S3 bucket. S3 server-side encryption can be enabled on the bucket. Option A: Config records resource changes, not API calls. Option B: CloudWatch Logs can store logs but not automatically encrypt; also not the primary service for API logging. Option D: VPC Flow Logs capture network traffic, not API calls.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs and Amazon S3

Answer

AWS Config and AWS CloudTrail

Question 10

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across accounts are encrypted with AWS KMS. Which combination of controls should be used to enforce this?

Accepted Answer

Use an SCP to deny s3:PutBucketEncryption with encryption disabled, and AWS Config rules to detect non-compliant buckets.. Option A is correct because it combines preventive and detective controls. An SCP can deny the s3:PutBucketEncryption action unless the bucket is configured with KMS encryption, which prevents non-compliant buckets from being created or modified. AWS Config rules then detect any existing non-compliant buckets or changes that bypass the SCP, providing continuous compliance monitoring.

Answer

Attach an IAM policy to all users denying s3:PutObject without KMS.

Answer

Use an SCP to deny s3:CreateBucket without encryption, and rely on CloudTrail to alert.

Answer

Use AWS Config rules only, with automatic remediation via Lambda.

Question 11

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. What is the most likely cause?

Accepted Answer

The Lambda function is not configured to access the VPC where the RDS instance resides.. The most likely cause of the timeout error is that the Lambda function is not configured to access the VPC where the RDS instance resides. When Secrets Manager rotates a secret for an RDS database, the rotation Lambda function must connect to the database to update the credentials. If the Lambda function is not attached to the same VPC (or a VPC with proper routing and security group rules), it cannot reach the RDS instance, causing network connection attempts to hang until the function times out.

Answer

The Lambda function's execution role lacks the required IAM permissions.

Answer

The secret rotation schedule is set to less than 24 hours.

Answer

The Lambda function does not have permission to access the S3 bucket.

Question 12

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the destination account is 222222222222. Which policy should be attached to the S3 bucket?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. Option C is correct because it uses a bucket policy to grant cross-account access to the S3 bucket. The policy specifies the destination account (222222222222) as the principal, allowing s3:GetObject on the bucket's objects. This is the standard AWS approach for cross-account S3 access, as bucket policies can grant permissions to principals in other AWS accounts.

Answer

Attach an IAM policy to the user in account 111111111111 allowing s3:GetObject.

Answer

Set the bucket ACL to grant full control to account 222222222222.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 13

A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that EBS snapshots are shared with another account without exposing the underlying data. What is the correct approach?

Accepted Answer

Share the encrypted snapshot and update the KMS key policy to allow the target account to use the key.. Option D is correct because sharing an encrypted EBS snapshot requires the KMS key policy to grant the target account permission to use the key (via kms:Decrypt and kms:CreateGrant). Without this, the target account cannot decrypt the snapshot to create volumes or copies. AWS KMS enforces that the key policy explicitly allows cross-account access, and the target account must have the corresponding IAM permissions.

Answer

Share the encrypted snapshot without modifying the KMS key policy.

Answer

Create an unencrypted copy of the snapshot and share it.

Answer

Share the encrypted snapshot and also share the KMS key with the target account.

Question 14

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices an increase in false positives blocking legitimate traffic. Which action should be taken to reduce false positives while maintaining security?

Accepted Answer

Adjust the rate-based rule threshold to a higher value.. Option B is correct because adjusting the rate-based rule threshold to a higher value will allow more legitimate traffic while still blocking excessive requests. Option A: Removing the rule would weaken security. Option C: Swapping to AWS Shield Advanced does not fine-tune rules. Option D: Count mode logs but does not block; not maintaining security.

Answer

Remove the rate-based rule that is causing false positives.

Answer

Replace AWS WAF with AWS Shield Advanced.

Answer

Change the rule action from 'Block' to 'Count'.

Question 15

A company needs to store sensitive data in Amazon S3 with encryption at rest. Which option provides the MOST control over the encryption keys?

Accepted Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C). SSE-C (Server-Side Encryption with Customer-Provided Keys) gives you full control over the encryption keys because you provide and manage the key material yourself. Amazon S3 performs the encryption and decryption operations, but it never stores your keys; you must supply the key with each request. This is the only option where the customer retains complete ownership and lifecycle management of the encryption keys, including rotation and deletion.

Answer

Client-Side Encryption

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)