DOP-C02 Security and Compliance Practice Test 4 — 15 Questions

Question 1

Which THREE services can be used to protect a VPC from malicious traffic? (Choose 3.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are stateless, subnet-level firewalls that filter traffic based on rules evaluating source/destination IP, protocol, and port. They provide an additional layer of defense by explicitly allowing or denying inbound and outbound traffic at the subnet boundary, making them a correct choice for protecting a VPC from malicious traffic.

Answer

AWS Shield

Answer

Amazon Route 53 Resolver

Question 2

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple accounts? (Choose 2.)

Accepted Answer

AWS Organizations. AWS Organizations allows you to centrally manage and enforce security policies across multiple accounts by using Service Control Policies (SCPs). SCPs define the maximum permissions for accounts in an organization, enabling you to restrict access to services or actions without requiring per-account configuration. AWS Control Tower provides a managed service that automates the setup of a multi-account environment with pre-built guardrails, which are implemented using SCPs and AWS Config rules to enforce security and compliance policies consistently.

Answer

Amazon S3

Answer

Amazon CloudWatch

Answer

AWS Lambda

Question 3

Refer to the exhibit. An S3 bucket policy is configured as shown. A user from IP 192.0.2.10 is unable to download an object from the bucket. What is the most likely cause?

Accepted Answer

The IP address is not in the allowed range.. The bucket policy likely contains an IP address condition (e.g., IpAddress or NotIpAddress). Since the user's IP is 192.0.2.10 and is outside the allowed range, the s3:GetObject request is denied. To download an object, the user only needs s3:GetObject permission, not s3:ListBucket (which is for listing objects).

Answer

The bucket policy requires HTTPS, but the user is using HTTP.

Answer

The policy does not allow s3:ListBucket, so the user cannot list objects.

Answer

The bucket policy does not allow s3:GetObjectVersion.

Question 4

Refer to the exhibit. A CloudTrail trail named ManagementTrail is configured as shown. Which events will be logged?

Accepted Answer

All management events for the account.. The CloudTrail trail named ManagementTrail is configured to log management events, and by default, when you create a trail in the CloudTrail console, it logs both read and write management events unless you specifically choose to log only one type. The exhibit shows no filtering for read-only or write-only events, so all management events (both read and write) for the account will be logged. This is the standard behavior for a trail that does not have an event selector restricting the event type.

Answer

Only read management events.

Answer

Only write management events.

Answer

Only S3 data events.

Question 5

Refer to the exhibit. A KMS key policy is configured as shown. What does this policy allow?

Accepted Answer

The role to decrypt data encrypted by S3 in us-east-1.. The KMS key policy includes a condition that restricts the kms:Decrypt permission to requests that originate from S3 in the us-east-1 region. Therefore, the specified role (CrossAccountRole) can only decrypt data that was encrypted by S3 in us-east-1. Option C correctly describes this behavior.

Answer

The role to decrypt any KMS key.

Answer

The role to decrypt via any AWS service.

Answer

Any IAM role to decrypt using this key.

Question 6

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with AWS Key Management Service (SSE-KMS) and enforce that all new objects are encrypted. Which bucket policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}. Option C uses the valid condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` to deny `s3:PutObject` if the request does not include the specified KMS key ID. This enforces that all new objects are encrypted with that specific KMS key. Option A is incorrect because `s3:ServerSideEncryption` is not a valid condition key for S3. Option B is incorrect because it uses `StringEquals` instead of `StringNotEquals`, causing it to deny requests that include the specified KMS key, which prevents the use of SSE-KMS. Option D is incorrect because it uses `s3:x-amz-server-side-encryption` with value `AES256`, which enforces SSE-S3, not SSE-KMS.

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:ServerSideEncryption":"awskms"}}}

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 7

A DevOps engineer needs to allow an EC2 instance to write logs to CloudWatch Logs. The instance is configured with an instance profile that has the following IAM role attached. Which additional policy is required?

Accepted Answer

CloudWatchLogsFullAccess. The instance profile's IAM role must include permissions to create log groups, log streams, and put log events. The `CloudWatchLogsFullAccess` managed policy grants all necessary actions (e.g., `logs:CreateLogGroup`, `logs:CreateLogStream`, `logs:PutLogEvents`) for writing logs from an EC2 instance to CloudWatch Logs. Without this policy, the instance will receive an access denied error when the CloudWatch agent or SDK attempts to send log data.

Answer

AmazonSQSFullAccess

Answer

AmazonDynamoDBFullAccess

Answer

AmazonS3FullAccess

Question 8

A company is using AWS CodePipeline to deploy applications. The pipeline source is an S3 bucket that receives artifacts from a third-party vendor. The DevOps team needs to ensure that only artifacts signed by the vendor's KMS key are deployed. Which approach meets this requirement?

Accepted Answer

Use an IAM policy to restrict s3:GetObject to objects encrypted with the vendor's KMS key.. To ensure only artifacts from the vendor are deployed, you can use an IAM policy with a condition on s3:ExistingObjectEncryptionKey to allow s3:GetObject only when the object is encrypted with the vendor's KMS key. Alternatively, configure a bucket policy to allow only objects encrypted with that key. Option B is incorrect because CodePipeline does not have a built-in artifact signing feature. Option C is incorrect because pre-signed URLs only grant temporary access and do not verify origin. Note: the term 'signed' is used loosely; KMS encryption (not signing) is the mechanism.

Answer

Use CodePipeline's built-in artifact signing feature.

Answer

Use S3 pre-signed URLs to download artifacts.

Question 9

An organization needs to audit all AWS API calls made in their account for compliance purposes. Which AWS service should they enable?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity for auditing and compliance. Option A (Amazon CloudWatch Logs) is incorrect as it is a log management service but does not record API calls. Option B (AWS Config) is incorrect because it tracks resource configuration changes, not API calls. Option D (Amazon GuardDuty) is incorrect because it is a threat detection service, not a comprehensive API audit trail.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 10

A company has an S3 bucket containing sensitive data. They need to ensure that all access to the bucket is logged and that any unauthorized access attempts are immediately notified. Which combination of services should be used?

Accepted Answer

Amazon S3 server access logs and Amazon Macie. Amazon S3 server access logs provide detailed logging of all requests made to the S3 bucket, including object-level operations. Amazon Macie can automatically discover and classify sensitive data, and send alerts for unauthorized access or policy violations, fulfilling both the logging and immediate notification requirements. Option A is incorrect because CloudWatch Logs does not directly capture S3 access logs; S3 server access logs must be delivered to a target bucket and then can be analyzed, but this combination lacks the sensitive data discovery capability. Option B is incorrect: VPC Flow Logs capture network traffic metadata, not S3 access logs, and GuardDuty focuses on threat detection but does not log S3 access at the same granularity. Option C is incorrect: CloudTrail logs API calls, which can include S3 object-level operations if enabled, but it does not capture all data-level access (e.g., direct reads via AWS SDK). CloudWatch Alarms can trigger notifications, but the logging is less comprehensive than S3 server access logs, and Macie provides immediate alerts for sensitive data exposure, which is not covered by CloudTrail alone.

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

VPC Flow Logs and Amazon GuardDuty

Answer

AWS CloudTrail and Amazon CloudWatch Alarms

Question 11

A DevOps engineer is designing a CI/CD pipeline that builds a Docker image and pushes it to Amazon ECR. The pipeline must scan the image for vulnerabilities before deployment. Which service should be integrated?

Accepted Answer

Amazon ECR image scanning. Amazon ECR image scanning is the correct service because it is a native feature of Amazon ECR that automatically scans Docker images for software vulnerabilities (CVEs) when they are pushed to the repository. This scanning uses the Common Vulnerabilities and Exposures (CVE) database from the open-source Clair project and can be configured to trigger on push, making it the ideal choice for integrating vulnerability scanning directly into a CI/CD pipeline before deployment.

Answer

AWS Security Hub

Answer

Amazon Inspector

Answer

AWS Config

Question 12

A company wants to centrally manage and apply policies across multiple AWS accounts in an AWS Organization. Which service should be used to define and enforce compliance rules?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are the correct choice because they centrally manage permissions across all accounts in an AWS Organization by defining maximum allowable permissions. SCPs act as a guardrail, restricting what member accounts can do, even if IAM policies within those accounts grant broader access. This makes SCPs the ideal service for enforcing compliance rules at the organization level.

Answer

AWS Config rules

Answer

AWS CloudTrail

Answer

IAM policies

Question 13

A DevOps team is deploying a web application on EC2 behind an Application Load Balancer. They need to encrypt traffic between the ALB and the EC2 instances. Which action should they take?

Accepted Answer

Configure the ALB to use HTTPS with a certificate and the target group to use HTTPS.. To encrypt traffic between the Application Load Balancer and EC2 instances, you must configure both the ALB listener and the target group to use HTTPS. The ALB terminates the client HTTPS connection and then re-encrypts traffic to the instances using HTTPS. This ensures end-to-end encryption. Option A is correct. Option B is incorrect because allowing only HTTPS in the security group does not force the ALB to encrypt traffic to instances; it only controls inbound traffic. Option C is incorrect because using HTTP on the target group would not encrypt traffic between ALB and instances. Option D is incorrect because 'encryption in transit' is not a direct ALB setting; encryption is achieved by using HTTPS on both ends.

Answer

Configure security group to allow only HTTPS.

Answer

Install a certificate on the ALB and use HTTP.

Answer

Enable encryption in transit on the ALB.

Question 14

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. Which configuration change is MOST likely to resolve the issue?

Accepted Answer

Increase the Lambda function timeout.. The Lambda function is timing out during the secret rotation process, which involves connecting to the RDS database, generating a new password, and updating the secret. Increasing the Lambda function timeout directly addresses the symptom by allowing more time for the rotation to complete, especially if the database response is slow or the network latency is high. This is the most direct fix for a timeout error, as the default Lambda timeout (3 seconds) is often insufficient for database operations.

Answer

Increase the Lambda function memory.

Answer

Place the Lambda function in the same VPC as the RDS instance.

Answer

Configure the Lambda function to retry on failure.

Question 15

Which TWO actions can be taken to secure an Amazon S3 bucket that contains confidential data? (Choose TWO.)

Accepted Answer

Enable S3 Default Encryption.. Correct options: A and E. Option A: S3 Default Encryption ensures data is encrypted at rest automatically, a key security measure. Option E: S3 Block Public Access prevents public exposure of the bucket and its objects, a key security measure. Option B (Transfer Acceleration) is for speed, not security. Option C (Cross-Region Replication) is for disaster recovery, not security. Option D (Versioning) helps with recovery from accidental deletions/overwrites, but does not directly secure data from unauthorized access.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Cross-Region Replication.

Answer

Enable S3 Versioning.