DOP-C02 Security and Compliance Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. A DevOps engineer attaches the IAM policy to an IAM user. The user reports being unable to download objects from the S3 bucket. What is the likely cause?

Accepted Answer

The policy does not allow s3:ListBucket, which is required for the AWS CLI to list objects. The IAM policy attached to the user likely allows s3:GetObject but does not include s3:ListBucket. The AWS CLI's `aws s3 cp` or `aws s3 sync` commands often require s3:ListBucket to list the objects in the bucket before downloading, so the user cannot download objects. The policy must include both s3:ListBucket on the bucket ARN and s3:GetObject on the object ARN.

Answer

The bucket policy denies access to the user

Answer

The policy is malformed because the Resource element is incorrect

Answer

The user's access key is expired

Question 2

Refer to the exhibit. The command is run to investigate a potential security incident. The output shows no events. Which of the following is the MOST likely reason?

Accepted Answer

The CloudTrail trail is configured to log only data events. The AWS CLI command `aws cloudtrail lookup-events` queries CloudTrail for management events. If the trail is configured to log only data events (e.g., S3 object-level operations), then management events like ConsoleLogin are not recorded, resulting in no output. The most likely reason for no events is that the trail is not capturing management events.

Answer

CloudTrail is not enabled to log management events in us-east-1

Answer

The event name is misspelled; it should be "Console Login"

Answer

The IAM user running the command does not have cloudtrail:LookupEvents permission

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to centrally enforce that S3 buckets in all accounts block public access. Which policy should be attached to the root organizational unit to achieve this?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit.. Service control policies (SCPs) are a feature of AWS Organizations that allow you to centrally enforce permissions across all accounts in an organization. Attaching an SCP to the root organizational unit that denies the `s3:PutBucketPublicAccessBlock` or similar actions can prevent public access to S3 buckets.

Answer

Configure a bucket policy on each S3 bucket to deny public access.

Answer

Create an AWS Config rule to mark noncompliant buckets.

Answer

Attach an IAM policy to the root user of each account.

Question 4

A developer needs to give a Lambda function read-only access to a DynamoDB table. What is the BEST practice to grant this permission?

Accepted Answer

Create an IAM role with a policy that allows DynamoDB read actions, and attach the role to the Lambda function.. Storing AWS access keys in environment variables is an anti-pattern because those are long-term static credentials that can be leaked via console output, logs, or accidental commit to source control, and they never rotate automatically. Even if encrypted, they still require manual credential lifecycle management and violate the recommendation to use temporary credentials for Lambda invocations. The Lambda execution role obviates the need for static access keys entirely: the Lambda service itself injects short-lived, automatically-rotated credentials into the function's execution environment (via reserved environment variables consumed by the AWS SDK's default credential provider chain), not through the EC2 Instance Metadata Service, which is a separate mechanism specific to EC2 instances.

Answer

Attach the policy directly to the Lambda function's configuration.

Answer

Store the AWS access keys in environment variables of the Lambda function.

Answer

Use a DynamoDB resource-based policy that grants access to the Lambda function's ARN.

Question 5

A company is using AWS CodePipeline with an S3 source action. The pipeline must be triggered only when a new object is uploaded to a specific prefix, and the pipeline should not have access to objects outside that prefix. Which configuration meets these requirements?

Accepted Answer

Configure the S3 source action with a CloudWatch event that has a prefix filter, and attach an IAM policy to the pipeline role that allows only the specific prefix.. The S3 source action in CodePipeline supports EventBridge (CloudWatch Events) filtering with prefix/suffix conditions, which lets the pipeline trigger only on objects matching the specified prefix. Attaching an IAM policy scoped to that prefix on the pipeline's execution role enforces least privilege so the pipeline cannot read objects outside the prefix. Together these meet both the trigger and access-scoping requirements natively within CodePipeline.

Answer

Use an S3 event notification to trigger a Lambda function that starts the pipeline.

Answer

Configure the S3 source action with a specific object key and use a bucket policy to allow only that key.

Answer

Use a separate S3 bucket for the pipeline's source artifacts.

Question 6

An IAM policy is attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' even though they are connecting from within the 10.0.0.0/16 IP range. What is the MOST likely reason?

Accepted Answer

The user is accessing S3 through a VPC endpoint, but the condition only works for public IP addresses.. IAM policy conditions that use aws:SourceIp evaluate the source IP address as seen by AWS. When traffic reaches S3 through a VPC endpoint, the source IP is the private IP of the VPC endpoint (or the instance's private IP), not the public IP of the 10.0.0.0/16 range. If the policy condition only allows 10.0.0.0/16 as a public CIDR, the request will be denied because the evaluated source IP does not match. The correct fix is to use aws:SourceVpce or aws:SourceVpc conditions instead of aws:SourceIp for endpoint traffic.

Answer

The policy needs an additional condition for VPC endpoint.

Answer

The policy does not allow the s3:ListBucket action.

Answer

The resource ARN is missing the bucket-level permission.

Question 7

A key policy for a KMS customer managed key includes the above statement. An IAM role 'AdminRole' in account 123456789012 is allowed to decrypt. However, when the role attempts to decrypt data, it receives an access denied error. What is the MOST likely cause?

Accepted Answer

The condition 'kms:GrantIsForAWSResource' is preventing direct API calls.. The condition 'kms:GrantIsForAWSResource' restricts the permission to requests that come from AWS services that integrate with KMS (e.g., S3, Lambda) rather than direct API calls from the role. As a result, when the IAM role 'AdminRole' attempts to call kms:Decrypt directly, it receives an access denied error. Option C is correct. Option A is incorrect because 'kms:Decrypt' is the correct action; wildcards are not needed. Option B is incorrect because the resource can be '*' in a key policy since the policy is attached to the key itself, scoping it automatically. Option D is incorrect because the principal ARN is correctly specified as the IAM role in the account.

Answer

The action should be 'kms:Decrypt*'.

Answer

The resource should be the key ARN, not '*'.

Answer

The principal ARN is incorrect.

Question 8

A security engineer runs the above CLI command to investigate IAM user 'Bob'. The output shows Bob logged in and then created a new IAM user. Which additional information should the engineer look for to determine if this was a security incident?

Accepted Answer

The source IP address from the CloudTrail event details.. The event name is present in the CloudTrail event output (EventName: 'CreateUser'), but simply noting it doesn't help determine whether Bob's actions were legitimate or malicious -- it only confirms what action occurred, not who really performed it or from where. Note that the exhibited command filtered on AttributeKey=Username,AttributeValue=Bob, not EventName=CreateUser as this option's explanation incorrectly stated; regardless, the investigation still needs the sourceIPAddress and other request context (not visible in this truncated CLI output) to assess whether the request came from a legitimate or anomalous origin.

Answer

The event name for the user creation.

Answer

The time the new user was last modified.

Answer

The IAM group memberships of the new user.

Question 9

A company uses AWS Secrets Manager to rotate database credentials automatically. The rotation function is failing with a permission error. Which IAM policy should be attached to the Lambda execution role to allow Secrets Manager to invoke the rotation function?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"lambda:InvokeFunction","Resource":"*"}]}. None of the provided IAM policies enable Secrets Manager to invoke the Lambda function. Instead, a resource-based policy on the Lambda function must grant the `lambda:InvokeFunction` permission to the Secrets Manager service principal (secretsmanager.amazonaws.com).

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"lambda:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"secretsmanager:*","Resource":"*"}]}

Question 10

A DevOps engineer needs to temporarily grant an external auditor read-only access to a specific S3 bucket for 24 hours. What is the most secure way to grant this access?

Accepted Answer

Generate a pre-signed URL for the objects and share the URL with the auditor.. A pre-signed URL grants temporary, time-limited access to a specific S3 object without creating any IAM identity or modifying bucket policies. The URL inherits the permissions of the signer, expires at a defined time (up to 7 days for SigV4), and can be scoped to a single object — making it the least-privilege, most auditable option for a 24-hour external access need.

Answer

Create an IAM user with a policy granting read-only access to the bucket.

Answer

Add a bucket policy that grants read-only access to the auditor's AWS account.

Answer

Share the access keys of an existing IAM user with the auditor.

Question 11

The IAM policy above is attached to a user. The user tries to stop an EC2 instance. What will happen?

Accepted Answer

The user can stop the instance.. The user can stop the instance because the IAM policy contains an explicit Allow for the ec2:StopInstances action on the specific instance resource, and the Deny statement does not apply to that action. In AWS IAM, an explicit Deny always overrides an Allow, but here the Deny is for a different action or resource, so it does not block the stop operation. Since there is no explicit Deny for ec2:StopInstances on that instance, the Allow takes effect and the user is permitted to stop the instance.

Answer

The user is denied due to an implicit deny.

Answer

The user cannot stop the instance because there is no explicit allow for all instances.

Answer

The user cannot stop the instance because the Deny statement overrides the Allow.

Question 12

A DevOps engineer runs the command above and gets the output shown. The engineer then tries to delete a versioned object from the bucket without using MFA. What will happen?

Accepted Answer

The delete request will fail with an AccessDenied error.. The scenario implies an S3 bucket policy or bucket configuration that requires MFA for delete operations (e.g., MFA Delete enabled). When MFA Delete is enabled on a versioned bucket, any request to permanently delete an object version or change versioning state must include a valid MFA token; without it, the request is denied with AccessDenied. This protects against accidental or malicious permanent deletion.

Answer

The object will be permanently deleted.

Answer

The object will be deleted but can be recovered from the 'Delete Markers' list.

Answer

The object will be deleted and a new version will be created.

Question 13

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the target account is 222222222222. Which combination of a bucket policy and an IAM policy correctly grants the target account access?

Accepted Answer

Bucket policy: { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::222222222222:root" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" }. Cross-account S3 access requires both a bucket policy that explicitly grants the external account (or its principals) access and an IAM policy in the target account that allows the IAM user/role to perform the action. The bucket policy uses the correct Principal format: an AWS account ARN (arn:aws:iam::222222222222:root) which delegates permission to the account, allowing its administrators to grant access to specific principals via IAM policies. The IAM policy in the target account then grants the actual permission to the user or role making the request. Without both, the request is denied: the bucket policy alone is insufficient because IAM policies in the source account also apply, and the IAM policy alone is insufficient because S3 bucket policies are required for cross-account access.

Answer

Bucket policy: { "Effect": "Allow", "Principal": "222222222222", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: same as A

Answer

Only bucket policy as in A

Answer

Only IAM policy as in A

Question 14

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can make changes to Amazon CloudWatch Logs configurations. Which approach should be used?

Accepted Answer

Create an SCP that denies cloudwatch:Put* and cloudwatch:Delete* actions and attach it to the root OU. Service Control Policies (SCPs) in AWS Organizations centrally control the maximum available permissions for all accounts within an organizational unit (OU). Attaching an SCP to the root OU that denies logs:Put* and logs:Delete* actions (the IAM action prefix for Amazon CloudWatch Logs, e.g. logs:PutLogGroup, logs:PutRetentionPolicy, logs:DeleteLogGroup) ensures that no IAM user or role in any account can modify or delete CloudWatch Logs configurations, regardless of any IAM policies attached directly to users or roles. Note: CloudWatch Logs actions use the 'logs:' prefix, not 'cloudwatch:' (which covers CloudWatch metrics/alarms/dashboards, a separate namespace).

Answer

Use AWS Config rules to automatically revert changes to CloudWatch Logs

Answer

Create an IAM policy that denies changes to CloudWatch Logs and apply it to all IAM users

Answer

Use AWS CloudTrail to monitor and alert on changes to CloudWatch Logs

Question 15

Given the above IAM policy, which action is permitted?

Accepted Answer

Invoke the Lambda function MyFunction in us-east-1 account 123456789012. The IAM policy shown in the exhibit (not fully reproduced here) grants permission for the lambda:InvokeFunction action on the specified Lambda function ARN. Since the policy explicitly allows this action, invoking MyFunction in us-east-1 account 123456789012 is permitted. The other actions are not included in the policy's allowed actions.

Answer

Read objects from an S3 bucket

Answer

Create a Lambda function

Answer

Start an EC2 instance