DOP-C02 Security and Compliance Practice Test 4 — 15 Questions

Question 1

A company has a Lambda function that processes sensitive data and needs to access an RDS database. The security team requires that the database credentials are automatically rotated every 30 days. Which service should be used to store and rotate the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like RDS. It supports native, built-in rotation for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) without requiring custom Lambda functions. The automatic rotation can be scheduled at a desired interval (e.g., every 30 days) using a rotation schedule defined in the secret's configuration, and it integrates directly with RDS to update the credentials on both the secret and the database.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS IAM roles

Question 2

A company is using AWS CloudTrail to log API events. The security team wants to ensure that log files are tamper-proof and available for incident investigation. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation.. Options A and D are correct. Enabling log file validation allows CloudTrail to create a digest file for integrity verification. Enabling S3 Object Lock prevents logs from being deleted or overwritten. Option B: SSE-S3 provides encryption but not tamper-proofing. Option C: CloudWatch Logs does not provide file integrity. Option E: KMS encryption is for encryption, not integrity.

Answer

Store logs in Amazon CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3).

Answer

Use AWS KMS to encrypt the logs.

Question 3

A company has an IAM policy that allows users to manage their own passwords and MFA devices. The policy includes a condition that requires MFA for all API operations except for changing passwords and MFA. Which THREE statements are true about this policy? (Choose THREE.)

Accepted Answer

The policy uses NotAction to exclude password and MFA actions.. Options A, C, and E are correct. The condition with Bool: aws:MultiFactorAuthPresent ensures that if MFA is not present (except for allowed actions), access is denied. The policy uses NotAction to allow password and MFA changes without MFA. The policy must be attached to users or groups to take effect. Option B: The policy does not apply to the root user. Option D: The policy does not create an IAM role; it is an identity-based policy.

Answer

The policy creates an IAM role for MFA enforcement.

Answer

The policy applies to the AWS account root user.

Question 4

A company wants to audit all changes to IAM policies in their AWS account. Which THREE services can be used to capture and alert on IAM policy changes? (Choose THREE.)

Accepted Answer

AWS Config. Options A, B, and D are correct. AWS CloudTrail logs all IAM API calls. AWS Config can track resource changes and trigger rules. Amazon EventBridge can create rules to detect specific CloudTrail events and trigger notifications. Option C: AWS Trusted Advisor provides best practice checks, not change auditing. Option E: Amazon Inspector is for security vulnerabilities.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 5

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. Which AWS service can automatically manage the encryption keys with minimal configuration?

Accepted Answer

SSE-S3. SSE-S3 (Server-Side Encryption with S3-Managed Keys) is the correct answer because it requires minimal configuration: you simply enable it on the bucket or object, and AWS fully manages the encryption keys, including rotation and protection, without any additional setup or key management overhead.

Answer

SSE-C

Answer

SSE-KMS

Answer

Client-side encryption

Question 6

A DevOps engineer needs to ensure that EC2 instances can access an S3 bucket without storing AWS credentials on the instances. Which solution meets this requirement?

Accepted Answer

Attach an IAM role to the EC2 instance with an S3 access policy.. Option D is correct because attaching an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS STS service via the instance metadata service (IMDS). The EC2 instance can then use these credentials to access the S3 bucket without any long-term AWS credentials being stored on the instance. This is the AWS-recommended best practice for granting permissions to AWS services running on EC2.

Answer

Use an S3 bucket policy that grants access to the EC2 instance's public IP.

Answer

Store access keys in the EC2 user data script.

Answer

Create an IAM user and embed credentials in the application code.

Question 7

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting attacks. Which AWS service should be integrated with the ALB?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS traffic. It uses managed rule groups to block common attack patterns like SQL injection (e.g., detecting malicious SQL keywords in query strings) and cross-site scripting (e.g., identifying script tags in user input). This makes it the correct choice for protecting web applications at Layer 7.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Question 8

A company's security team requires that all API calls to AWS are logged for audit purposes. Which service should be enabled to capture and store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services. CloudTrail captures the identity of the caller, the time of the call, the source IP address, the request parameters, and the response elements, storing this information in a log file that can be delivered to an Amazon S3 bucket for long-term audit storage. This directly meets the security team's requirement to capture and store all API calls for audit purposes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 9

A company wants to enforce that S3 buckets are not publicly accessible. Which AWS service can continuously monitor and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config with managed rules can evaluate bucket policies and use automatic remediation via Systems Manager Automation. Option B is correct.

Answer

Amazon Macie

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 10

A DevOps engineer needs to grant cross-account access to an S3 bucket in Account A for a user in Account B. Which combination of policies is required?

Accepted Answer

An S3 bucket policy in Account A and an IAM policy in Account B.. An S3 bucket policy in Account A granting access to Account B's user, and an IAM user policy in Account B allowing access to the bucket. Option C is correct.

Answer

An IAM role in Account A and an IAM policy in Account B.

Answer

Only an IAM policy in Account B.

Answer

Only an S3 bucket policy in Account A.

Question 11

A security audit reveals that an IAM user has long-term access keys that have not been rotated in over 90 days. What is the most secure way to enforce key rotation?

Accepted Answer

Use IAM roles instead of long-term access keys.. Option C is correct because the most secure way to eliminate the risk of long-term access key compromise is to avoid using them altogether. IAM roles provide temporary security credentials via AWS Security Token Service (STS), which automatically expire (default 1 hour, max 12 hours) and are rotated transparently by the AWS SDK or CLI. This removes the need for manual or automated key rotation, aligning with the AWS Well-Architected Framework's principle of using temporary credentials.

Answer

Use an AWS Lambda function to automatically rotate keys.

Answer

Manually rotate keys every 90 days.

Answer

Delete the user and create a new one.

Question 12

A company's security policy requires that all data in transit between on-premises and AWS is encrypted. Which AWS service provides a dedicated network connection with encryption?

Accepted Answer

AWS Direct Connect + VPN. AWS Direct Connect with IPSec VPN provides a dedicated encrypted connection. Option A is correct.

Answer

AWS Transit Gateway

Answer

Amazon VPC peering

Answer

AWS Site-to-Site VPN over the internet

Question 13

A company needs to store audit logs for 7 years to meet compliance requirements. Which S3 storage class is the most cost-effective for long-term archival?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival. Option D is correct.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 Glacier Flexible Retrieval

Question 14

Which TWO actions should a DevOps engineer take to secure an AWS account root user? (Choose 2.)

Accepted Answer

Delete or disable the root user access keys.. Enabling MFA and not creating access keys for the root user are best practices. Options B and D are correct.

Answer

Share the root user password with the team.

Answer

Create an IAM role for the root user.

Answer

Use the root user for daily administrative tasks.

Question 15

Which THREE services can be used to protect a VPC from malicious traffic? (Choose 3.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are stateless, subnet-level firewalls that filter traffic based on rules evaluating source/destination IP, protocol, and port. They provide an additional layer of defense by explicitly allowing or denying inbound and outbound traffic at the subnet boundary, making them a correct choice for protecting a VPC from malicious traffic.

Answer

AWS Shield

Answer

Amazon Route 53 Resolver