DOP-C02 Security and Compliance Practice Test 4 — 15 Questions

Question 1

A company is using AWS CloudTrail to log API activity. The security team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and alerted. What is the MOST secure and efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the UpdateTrail API call and triggers an SNS notification.. Amazon EventBridge (CloudWatch Events) is the correct mechanism: create a rule with source 'aws.cloudtrail' and an event pattern matching detail.eventName in ['StopLogging', 'DeleteTrail'] (the API calls that actually disable or remove a trail), and target an SNS topic. UpdateTrail modifies trail settings but does not stop logging, so a rule that only matches UpdateTrail would miss the actual 'disable logging' actions the security team wants to be alerted on.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration and email the security team.

Answer

Enable Amazon GuardDuty and configure a custom threat list to monitor CloudTrail API calls.

Answer

Create an AWS Config rule to detect changes to CloudTrail configuration and send an SNS notification.

Question 2

A company has an S3 bucket with sensitive data. The security team requires that all data uploaded to the bucket be automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). How can this be enforced?

Accepted Answer

Use an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.. A bucket policy that explicitly denies PutObject requests lacking the x-amz-server-side-encryption header (or with a value other than aws:kms) provides a hard enforcement mechanism. Unlike default encryption, which only applies when the request does not specify an encryption header, this policy rejects any upload that does not affirmatively request SSE-KMS. This ensures that all objects are encrypted with AWS KMS managed keys as required by the security team.

Answer

Enable default encryption on the S3 bucket with SSE-KMS.

Answer

Enable AWS CloudTrail to monitor uploads and alert on unencrypted objects.

Answer

Create an IAM policy that requires all S3 operations to use SSE-KMS.

Question 3

A DevOps team uses AWS CodePipeline to deploy a web application. The application stores user session data in an ElastiCache Redis cluster. The security team mandates that all data in transit between the application and Redis must be encrypted. What should the team do?

Accepted Answer

Enable encryption in transit on the ElastiCache Redis cluster and configure the application to use TLS.. ElastiCache Redis supports encryption in transit using TLS, which must be enabled at cluster creation. Option A is wrong because NACLs do not encrypt traffic. Option B is wrong because the application must use TLS, but the cluster must also be configured to support it. Option C is wrong because VPC peering does not encrypt traffic.

Answer

Use a network ACL to allow only encrypted traffic on the Redis port.

Answer

Modify the application to use TLS when connecting to Redis.

Answer

Place the application and Redis cluster in the same VPC and use VPC peering.

Question 4

A security engineer needs to audit who accessed a specific S3 object and from which IP address over the past 30 days. Which AWS service should be used?

Accepted Answer

Amazon S3 server access logs. S3 server access logs record every request made to a bucket, including the requester's IP address, request time, operation, and the specific object key accessed. This makes them the only option that captures per-object access detail with source IP for audit purposes. CloudTrail records S3 data events too, but the question specifically asks about object-level access with IP, which server access logs natively provide in a single log line.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 5

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all unused IAM users are automatically identified and removed after 90 days of inactivity. What is the MOST effective solution?

Accepted Answer

Use IAM Access Analyzer to generate findings for unused access and automate user removal with a Lambda function.. IAM Access Analyzer's unused access findings continuously analyze IAM roles, users, permissions, and credentials to identify unused permissions and services based on CloudTrail activity over a configurable lookback window (up to 365 days). Findings can be exported to EventBridge, which triggers a Lambda function to automatically remove or disable inactive IAM users after 90 days. This is the only option that combines native detection of unused access with automated remediation.

Answer

Use the IAM credential report to review last activity dates and manually delete users.

Answer

Enable CloudTrail Insights to detect inactive users and send alerts.

Answer

Use an AWS Config rule to detect IAM users and trigger a Lambda function to delete them after 90 days.

Question 6

A company uses AWS KMS to encrypt data at rest in S3. The security team wants to ensure that KMS keys are rotated automatically every year. Which THREE steps should be taken?

Accepted Answer

Create a CloudWatch Events rule to notify the security team before the rotation date.. Option C (enable automatic key rotation) is the correct mechanism for satisfying 'rotated automatically every year' -- it requires no additional manual re-creation step. Option E describes a manual, alternative rotation strategy that is inconsistent with 'automatic' rotation and should not be marked correct alongside C. This question needs either a genuine third correct option (e.g., verifying the key is a customer-managed symmetric key, since automatic rotation is unsupported for AWS-managed and asymmetric keys) or should be changed to a 'choose two' question with only A and C correct.

Answer

Configure an S3 bucket policy to enforce key rotation.

Answer

Ensure the key policy allows the kms:RotateKeyOnDemand action.

Question 7

A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?

Accepted Answer

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.. To enforce HTTPS-only access for an application behind an Application Load Balancer (ALB), you should create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS. This ensures that all incoming HTTP traffic is redirected to HTTPS, and the ALB only serves content over encrypted connections.

Answer

Configure the web server on the EC2 instances to only respond to HTTPS requests.

Answer

Configure the security group of the ALB to only allow inbound HTTPS traffic.

Answer

Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.

Question 8

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS. Which approach should be used to ensure compliance?

Accepted Answer

Attach a service control policy (SCP) to all accounts that denies s3:PutBucketEncryption or s3:PutObject without encryption.. A service control policy (SCP) attached to all accounts in AWS Organizations is the correct approach because SCPs enforce guardrails across every account, denying s3:PutBucketEncryption or s3:PutObject requests that lack encryption. SCPs are evaluated before IAM policies and apply organization-wide, ensuring no account can bypass the encryption requirement.

Answer

Apply an S3 bucket policy on each account's buckets to deny unencrypted object uploads.

Answer

Create an IAM policy in the master account that denies S3:PutObject without encryption.

Answer

Use AWS Config rules to evaluate S3 bucket encryption and trigger a remediation action via AWS Systems Manager Automation.

Question 9

A company is using AWS KMS to encrypt sensitive data stored in Amazon S3. The security team wants to ensure that the KMS keys cannot be deleted accidentally. What should be done?

Accepted Answer

Enable deletion protection on the KMS key.. To prevent accidental deletion of a KMS key, you should enable deletion protection on the key. This setting prevents the key from being deleted until the protection is removed. Disabling the key (option B) does not prevent deletion; it only prevents use. Enabling automatic key rotation (option C) manages cryptographic material but does not affect deletion. Backing up key material in AWS Secrets Manager (option D) does not prevent deletion of the key itself. Therefore, option A is correct.

Answer

Set the key state to disabled.

Answer

Enable automatic key rotation.

Answer

Create a backup of the key material in AWS Secrets Manager.

Question 10

A company is using AWS CloudTrail to log API activity. The security team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and alerted. What is the MOST secure and efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudTrail log file validation.. Option C is correct because CloudTrail log file validation generates a digitally signed digest file for each log, allowing you to verify that logs have not been modified or deleted after delivery, which directly addresses tamper detection for forensic analysis. Option E is correct because enabling SSE-KMS on the S3 bucket encrypts CloudTrail logs at rest with AWS KMS keys, protecting confidentiality and supporting integrity controls required for forensic evidence. Option A is not selected because blocking public access prevents exposure but does not itself detect or prevent tampering of already-stored logs. Option B is not selected because MFA delete protects against accidental or unauthorized deletion of objects but does not validate log integrity or provide tamper evidence. Option D is not selected because AWS Backup creates copies of the bucket but does not verify log integrity or prevent tampering of the original CloudTrail logs.

Answer

Disable public access to the S3 bucket using block public access settings.

Answer

Enable MFA delete on the S3 bucket.

Answer

Use AWS Backup to create backups of the CloudTrail S3 bucket.

Question 11

A security team wants to automatically detect and remediate S3 buckets that are publicly accessible across multiple AWS accounts. Which solution is MOST efficient and scalable? (Choose THREE.)

Accepted Answer

Apply a service control policy (SCP) to deny s3:PutBucketAcl that makes buckets public.. Option B is correct because an AWS Organizations service control policy (SCP) applied at the OU or account level centrally enforces a guardrail that denies s3:PutBucketAcl (and related public-access calls) across all member accounts, preventing buckets from being made public in the first place without per-account effort. Option D is correct because AWS Config's managed rule s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited continuously evaluate buckets in every account and region, giving scalable, multi-account detection of publicly accessible buckets. Option E is correct because Amazon CloudWatch Events (EventBridge) can react to AWS Config compliance-change events or API calls and trigger a Lambda function that automatically remediates non-compliant buckets, providing the automated response the scenario requires. Option A is not correct because Trusted Advisor's S3 bucket checks are limited in scope and do not provide the automated, scalable detection-and-remediation workflow across many accounts. Option C is not correct because manual weekly reviews are neither efficient nor scalable and cannot keep pace with changes across multiple AWS accounts.

Answer

Use AWS Trusted Advisor to check for open S3 buckets and send alerts.

Answer

Manually review each account's S3 bucket permissions weekly.

Question 12

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. What should be done? (Choose TWO.)

Accepted Answer

Modify the KMS key policy to include a condition that requires the kms:ViaService to be from the VPC endpoint.. Option B is correct because the KMS key policy can include a condition using the aws:SourceVpce or kms:ViaService condition keys to restrict key usage to requests that come through a specific VPC endpoint, ensuring the key is only usable from within the company's VPC. Option E is correct because AWS KMS supports VPC interface endpoints (powered by AWS PrivateLink), and creating a VPC endpoint for KMS allows private connectivity from the VPC to KMS, which is a prerequisite for enforcing VPC-only access via key policy conditions. Option A is incorrect because security groups are attached to network interfaces and resources like EC2 instances, not to KMS keys, and KMS keys have no security group association. Option C is incorrect because an S3 bucket policy controls access to the S3 bucket, not to the KMS key, so it cannot restrict where the KMS key itself can be used from. Option D is incorrect because an SCP applies to AWS accounts in an organization and controls which services/actions are allowed, but it cannot enforce a condition that KMS operations originate only from within a specific VPC.

Answer

Attach a security group to the KMS key.

Answer

Configure the S3 bucket policy to allow only requests from the VPC.

Answer

Create a service control policy (SCP) that denies KMS operations from outside the VPC.

Question 13

Refer to the exhibit. An EC2 instance with the IAM role MyAppRole is running. An application on the instance tries to delete an object from the S3 bucket 'example-bucket'. What will happen?

Accepted Answer

The request is denied because the IAM role does not have the s3:DeleteObject permission.. The IAM role MyAppRole attached to the EC2 instance lacks the s3:DeleteObject permission, so the request is denied. In AWS, an IAM role's policy must explicitly allow an action for it to be permitted, unless another policy (like a bucket policy) grants it. Since the role only has s3:GetObject (as implied by the exhibit and option D), the delete operation is not allowed. The bucket policy might allow it, but the question states the role does not have the permission, and no bucket policy is mentioned to override that.

Answer

The request is allowed because the instance has full access to the bucket.

Answer

The request is denied because the bucket policy overrides the IAM role.

Answer

The request is allowed because the role has s3:GetObject permission, which includes delete.

Question 14

A company's security policy requires that all EC2 instances must be launched with an IAM role that provides least privilege access. A DevOps engineer needs to enforce this across the organization. Which approach is MOST effective?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance is launched with the required IAM role, and attach it to all users. Attaching an IAM policy to all users that denies ec2:RunInstances unless the instance is launched with the required IAM role directly enforces the requirement. Option A (SCP denying if not the approved role) is incorrect because SCPs cannot check for a specific role attachment at launch time; they only control permissions at the account level. Option B (SCP denying unless instance profile attached) only requires any instance profile, not specifically the approved one. Option C (AWS Config + Lambda) is reactive and can have delays, so it is less effective than a preventive IAM policy.

Answer

Create an SCP that denies ec2:RunInstances if the specified IAM role is not the approved role

Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action unless an instance profile is attached

Answer

Use AWS Config to detect instances without the required role and terminate them via Lambda

Question 15

A company is subject to regulatory compliance that requires all access to S3 buckets to be logged and monitored. The company has thousands of buckets. Which solution is MOST scalable and cost-effective?

Accepted Answer

Enable AWS CloudTrail with data events for S3 and send logs to CloudWatch Logs. Enabling AWS CloudTrail with data events for S3 and sending logs to CloudWatch Logs is the most scalable and cost-effective solution for logging and monitoring access to thousands of S3 buckets. CloudTrail data events capture object-level API operations (e.g., GetObject, PutObject) and can be aggregated across all buckets. CloudWatch Logs allows for centralized monitoring and alerting.

Answer

Enable S3 server access logging on each bucket and aggregate logs into a central bucket

Answer

Use VPC Flow Logs to capture traffic to S3

Answer

Use AWS Config rules to track bucket access and publish to SNS