DOP-C02 Security and Compliance Practice Test 5 — 15 Questions

Question 1

Which THREE components are necessary to implement a secure VPC with a public subnet and a private subnet that hosts a database? (Choose THREE.)

Accepted Answer

Internet Gateway attached to the VPC.. To implement a secure VPC with a public subnet and a private subnet hosting a database, three components are necessary. First, an Internet Gateway attached to the VPC (B) enables the public subnet to communicate with the internet. Second, a NAT Gateway in the public subnet (C) allows instances in the private subnet to initiate outbound traffic to the internet (e.g., for updates) while keeping them private. Third, a security group for the database (E) must be configured to allow inbound traffic only from the application tier's security group, providing a firewall that restricts access to the database. A Site-to-Site VPN connection (A) is not required because there is no on-premises connection needed. VPC Peering (D) is unnecessary as there is no need to connect to another VPC. Therefore, options B, C, and E are correct.

Answer

AWS Site-to-Site VPN connection.

Answer

VPC Peering connection to a central VPC.

Question 2

Which TWO AWS services can be used to manage secrets and database credentials securely? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for securely storing, rotating, and managing secrets such as database credentials, API keys, and other sensitive data. It provides built-in integration with Amazon RDS, Redshift, and DocumentDB to automatically rotate credentials on a schedule, eliminating the need for manual updates. This makes it a correct choice for the question's requirement to manage secrets and database credentials securely.

Answer

AWS CloudFormation

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Question 3

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using customer-managed KMS keys. Additionally, any attempt to upload an unencrypted object must be denied. Which S3 bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: aws:kms. The condition 's3:x-amz-server-side-encryption':'aws:kms' in a Deny statement ensures that only requests with SSE-KMS encryption are allowed, blocking unencrypted uploads or uploads with other encryption types. Option A is wrong because 'true' is not a valid encryption type; the correct value is 'aws:kms'. Option B is wrong because it allows SSE-S3 (AES256), not KMS encryption. Option C is wrong because it checks a KMS encryption context rather than the encryption header, and it does not deny unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: true

Answer

Allow s3:PutObject with condition s3:x-amz-server-side-encryption: AES256

Answer

Allow s3:PutObject with condition kms:EncryptionContext: department:finance

Question 4

A DevOps engineer is configuring AWS Config rules to detect non-compliant security groups. The rule should trigger if any security group allows inbound SSH (port 22) from 0.0.0.0/0. Which AWS managed Config rule should be used?

Accepted Answer

restricted-ssh. 'restricted-ssh' is the managed rule that checks for SSH access from 0.0.0.0/0. Option A is wrong because 'vpc-sg-open-only-to-authorized-ports' is not specific to SSH. Option B is wrong because 'ec2-security-group-attached-to-eni' checks attachment, not rules. Option D is wrong because 'incoming-ssh-disabled' is not a managed rule.

Answer

vpc-sg-open-only-to-authorized-ports

Answer

ec2-security-group-attached-to-eni

Answer

incoming-ssh-disabled

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets created in any account within the organization are configured with block public access enabled. Which approach is the most scalable and least operationally burdensome?

Accepted Answer

Attach an SCP to the organization root that denies s3:CreateBucket unless the request includes 's3:PutBucketPublicAccessBlock'.. An SCP attached to the organization root can deny the s3:CreateBucket action unless the request includes a condition key for s3:PutBucketPublicAccessBlock, which enforces enabling block public access at bucket creation. This is a preventive, organization-wide control that scales with new accounts. Option A is wrong because AWS Config is detective and reactive, not preventive. Option B is wrong because it requires manual review and is not preventive. Option C is wrong because S3 bucket policies apply after bucket creation and cannot prevent the creation itself, plus they must be applied per bucket, making it unscalable.

Answer

Use an AWS Config managed rule to detect non-compliant buckets and trigger a remediation Lambda function.

Answer

Enable AWS CloudTrail and create a metric filter to alert on bucket creation, then manually review.

Answer

Apply an S3 bucket policy in each account that denies s3:PutBucketPublicAccessBlock with a condition.

Question 6

A company is migrating a legacy application to AWS. The application requires cross-account access to an S3 bucket in a different AWS account. The security team wants to follow the principle of least privilege. How should the DevOps engineer configure the access?

Accepted Answer

Create an IAM role in the source account with necessary permissions and attach a bucket policy in the target account granting access to that role.. It follows the recommended pattern for cross-account access: create an IAM role in the source account with necessary permissions and attach a bucket policy in the target account granting access to that role. This ensures least privilege by delegating access through a role rather than sharing long-term credentials. Option A is wrong because using root user credentials is insecure and violates least privilege. Option C is wrong because the IAM user should be in the source account, not the target account, and access keys should not be stored in Secrets Manager for this purpose; instead, a role is preferred. Option D is wrong because although it creates an IAM user in the source account, a role is the recommended practice for cross-account access as it avoids managing long-term credentials.

Answer

Generate an access key for the root user of the source account and use it in the application.

Answer

Create an IAM user in the target account with access keys and store them in AWS Secrets Manager.

Answer

Create an IAM user in the source account with programmatic access and a bucket policy allowing that user.

Question 7

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. It allows you to create rules that filter and monitor HTTP(S) requests based on conditions such as IP addresses, HTTP headers, URI strings, and SQL injection or cross-site scripting patterns. By integrating with an Application Load Balancer, AWS WAF can inspect incoming traffic and block malicious requests before they reach the EC2 instances.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Network Firewall

Question 8

A company has a CloudFormation stack that creates an S3 bucket and an EC2 instance. The bucket policy must be updated to grant the EC2 instance read access. The DevOps engineer uses a custom resource backed by a Lambda function. However, the stack update fails because the Lambda function does not have permissions to update the bucket policy. What should the engineer do to resolve this issue while following security best practices?

Accepted Answer

Update the Lambda execution role to include s3:PutBucketPolicy and add a bucket policy that grants s3:GetObject to the EC2 instance role.. Custom resources in CloudFormation require a Lambda function or other supported backend; using the EC2 instance profile directly is not a valid approach. Option B is incorrect because while adding an inline policy to the Lambda execution role for s3:PutBucketPolicy is necessary, it does not address the bucket policy that must grant s3:GetObject to the EC2 instance role. Option C is incorrect because the Lambda function itself needs the s3:PutBucketPolicy permission, not the EC2 instance. Option D is correct because it both updates the Lambda execution role to include the required permission and adds a bucket policy to allow the EC2 instance role read access.

Answer

Modify the custom resource to use the EC2 instance profile instead of a Lambda function.

Answer

Add an inline policy to the Lambda execution role that allows s3:PutBucketPolicy and ensure the bucket policy allows the EC2 instance role.

Answer

Attach a policy to the EC2 instance role that allows s3:GetObject on the bucket.

Question 9

A DevOps engineer needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (option A) is the correct service because it records API calls made to AWS services for auditing, governance, and compliance. Option B (AWS Config) is used to evaluate resource configurations against desired policies, not to record API calls. Option C (VPC Flow Logs) captures network traffic information at the VPC level. Option D (Amazon CloudWatch Logs) is a service for storing and monitoring log files from various sources, but does not itself record API calls.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 10

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team requires that all data be encrypted at rest and that automated backups are also encrypted. Which configuration meets these requirements?

Accepted Answer

Enable encryption for the RDS instance using AWS KMS.. Enabling encryption on the RDS instance using AWS KMS at creation time encrypts the data, automated backups, read replicas, and snapshots. Option A is incorrect because an S3 bucket policy cannot enforce encryption for RDS automated backups; RDS encryption must be handled at the instance level. Option C is incorrect because enabling encryption on automated backups after creating a snapshot does not encrypt the live database or future automated backups. Option D is incorrect because encrypting the underlying EBS volumes separately does not automatically encrypt the RDS data, logs, or backups; RDS encryption must be enabled directly on the instance.

Answer

Use an S3 bucket policy to enforce encryption for backup files.

Answer

Enable encryption on automated backups only after creating a snapshot.

Answer

Enable encryption on the underlying EBS volumes using KMS.

Question 11

A company is designing a secure CI/CD pipeline using AWS CodePipeline. The pipeline must comply with the principle of least privilege for IAM permissions. Which TWO actions should the DevOps engineer take? (Choose TWO.)

Accepted Answer

Scope IAM policies to specific resources, such as specific S3 buckets and CodeBuild projects.. The correct answers are D and E, as they align with the principle of least privilege by limiting permissions to only what is necessary. Option D is correct because scoping IAM policies to specific resources (e.g., particular S3 buckets and CodeBuild projects) ensures that the pipeline can only access the exact resources it needs. Option E is correct because creating separate IAM roles for CodeBuild and CodeDeploy with only the permissions they require prevents a compromised stage from affecting others. Option A is wrong because using the same IAM role for all stages violates least privilege; a single role would have permissions needed by all stages, increasing risk. Option B is wrong because Service Control Policies (SCPs) are applied at the AWS Organizations level, not to individual pipelines, and cannot be used to manage pipeline permissions directly. Option C is wrong because granting full access to all services is the opposite of least privilege and would allow unintended actions.

Answer

Use the same IAM role for all pipeline stages to simplify management.

Answer

Use an SCP to deny all pipeline actions except those explicitly allowed.

Answer

Attach an IAM policy to the pipeline itself that grants full access to all services.

Question 12

A company wants to protect its AWS account credentials. Which TWO practices are recommended by AWS? (Choose TWO.)

Accepted Answer

Enable multi-factor authentication (MFA) for privileged users.. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond a password, which is especially important for privileged users. Option E is correct because IAM roles provide temporary credentials for applications, eliminating the need to store long-term access keys and reducing security risks. Option A is incorrect because access keys should not be shared; each user should have their own keys and they should be rotated regularly. Option B is incorrect because storing IAM user passwords in a shared document violates security best practices and increases the risk of unauthorized access. Option D is incorrect because using the root user for daily administrative tasks is dangerous; the root user should be used only for limited, high-privilege tasks, and otherwise should be protected with MFA and not used for routine operations.

Answer

Generate and share access keys for all users.

Answer

Store IAM user passwords in a shared document.

Answer

Use the root user for daily administrative tasks.

Question 13

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to download an object from 'example-bucket' from an IP address 10.0.0.5. However, the request is denied. What is the most likely reason?

Accepted Answer

The IP address 10.0.0.5 is not in the allowed range.. The request is denied because the IAM policy likely includes a condition that restricts access to a specific IP address range, and 10.0.0.5 is not within that range. This is a common use of the 'aws:SourceIp' condition key, which is fully supported for S3 actions when using IAM credentials. The missing s3:ListBucket permission (option D) is not required for a direct GetObject request, especially from a programmatic client; only the s3:GetObject action is needed. Options A and B are incorrect: the bucket exists (otherwise a different error would occur) and aws:SourceIp is supported for S3.

Answer

The bucket 'example-bucket' does not exist in the account.

Answer

The policy uses 'aws:SourceIp' which is not supported for S3.

Answer

The policy does not grant s3:ListBucket permission, which is required to access objects.

Question 14

Refer to the exhibit. A DevOps engineer created an IAM role 'MyLambdaRole' for a Lambda function. The Lambda function needs to write logs to CloudWatch Logs. However, the function is not able to create log streams. What is the most likely missing configuration?

Accepted Answer

The role does not have an inline or managed policy that grants permissions for CloudWatch Logs.. The IAM role must have an inline or managed policy that grants permissions for CloudWatch Logs actions such as logs:CreateLogStream and logs:PutLogEvents. Option A is incorrect because the role name does not need a prefix; the trust policy is what matters. Option C is incorrect because the role ARN format does not affect log stream creation. Option D is incorrect because the trust policy allowing Lambda to assume the role is separate from the permissions to write logs; the question states the function is not able to create log streams, which indicates a permissions issue within the role's policies.

Answer

The role name is not prefixed with 'AWSLambda'.

Answer

The role ARN is incorrectly formatted.

Answer

The trust policy does not allow Lambda to assume the role.

Question 15

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance with the tag 'Environment=production' in us-east-1. What will happen?

Accepted Answer

The action is denied because the Deny statement explicitly denies the action for production instances.. The Deny statement explicitly denies ec2:TerminateInstances for instances with the tag 'Environment=production', and an explicit Deny overrides any Allow. Option B is wrong because the Deny applies to the user via group membership. Option C is wrong because the Deny is not region-specific; it applies globally. Option D is wrong because the Allow statement is overridden by the explicit Deny.

Answer

The action is allowed because there is no explicit Deny for the user.

Answer

The action is denied only if the instance is in the us-east-1 region.

Answer

The action is allowed because the Allow statement grants ec2:TerminateInstances.