DOP-C02 Security and Compliance Practice Test 6 — 15 Questions

Question 1

A DevOps engineer needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The company requires that the encryption key be managed by AWS and rotated automatically. Which encryption option should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3). SSE-S3 uses Amazon S3 managed keys (AES-256) and automatically rotates them. AWS manages the entire key management process, including rotation, with no additional cost. This meets the requirement that the encryption key be managed by AWS and rotated automatically, with minimal operational overhead.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer-managed key

Answer

Client-side encryption with an AWS KMS managed key

Question 2

Refer to the exhibit. A security team wants to enforce that passwords expire after 60 days. Which action should be taken?

Accepted Answer

Use the update-account-password-policy CLI command with --max-password-age 60. The update-account-password-policy CLI command sets --max-password-age 60 to enforce 60-day rotation, but this API does NOT perform a partial/merge update: AWS documents that any parameter you don't explicitly pass reverts to its default value (e.g. complexity requirements default to false, password reuse prevention defaults to 0, disabling those protections) rather than preserving the account's current settings. To safely add the 60-day expiration without weakening other policy settings, you must re-specify the account's full existing password policy (all complexity/reuse parameters) together with --max-password-age 60 in the same call.

Answer

Use the AWS Management Console to change the password policy for each IAM user

Answer

Create a new IAM user and set the password policy on that user

Answer

Delete the current password policy and create a new one

Question 3

Refer to the exhibit. A user outside the 192.0.2.0/24 IP range attempts to get an object from example-bucket. What will happen?

Accepted Answer

The request is denied because the Deny statement applies. The request is denied because the bucket policy contains an explicit Deny statement that applies to the user's IP range. In AWS IAM policies, an explicit Deny always overrides any Allow. The user is outside 192.0.2.0/24, so the Deny statement (which likely denies access to users outside that range) applies, resulting in denial. Even if there is an Allow statement that matches, the explicit Deny takes precedence.

Answer

The request is allowed because the Allow statement matches

Answer

The request is allowed because there is no explicit Deny for GetObject

Answer

The request is denied because the policy is malformed

Question 4

A company uses AWS Organizations with multiple accounts. The Security team needs to enforce that all newly created S3 buckets in any account are configured with server-side encryption (SSE-S3 or SSE-KMS) and block public access. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:CreateBucket unless the request includes the x-amz-server-side-encryption header and the PublicAccessBlockConfiguration.. A service control policy (SCP) applied to the organization root can provide a strong preventive guardrail, but not by conditioning s3:CreateBucket on encryption/public-access headers that the CreateBucket API doesn't actually accept (those settings are configured via separate PutBucketEncryption and PutPublicAccessBlock calls, made after the bucket exists). A correct preventive design combines an SCP that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption changes that would weaken the required settings, with AWS Config rules (or a Service Catalog product with baked-in secure defaults) to ensure every new bucket is actually configured correctly, since SCPs alone cannot auto-configure a resource's settings at creation time.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to remediate noncompliant buckets.

Answer

Create an IAM policy in each account that denies s3:CreateBucket unless encryption is specified and public access is blocked.

Answer

Use AWS Config rules with automatic remediation to delete or remediate noncompliant buckets after creation.

Question 5

A company uses AWS CodeBuild to build and test code. The build process requires access to a private PyPI repository hosted on an internal network. The CodeBuild project is configured with a VPC. However, the build fails with a timeout error when trying to connect to the PyPI repository. The security group for the CodeBuild project allows outbound HTTPS to 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The security group for the PyPI repository does not allow inbound traffic from the CodeBuild security group.. The CodeBuild project is in a VPC with outbound HTTPS allowed to 0.0.0.0/0, but the timeout occurs when reaching a private PyPI repository on the internal network. The most likely cause is that the PyPI repository's security group does not permit inbound traffic from the CodeBuild project's security group — security groups are stateful and must explicitly allow inbound connections on the repository side. Without that inbound rule, the TCP handshake never completes, producing a timeout.

Answer

CodeBuild does not support VPC connectivity.

Answer

The VPC subnet has a NAT gateway that routes traffic to the internet instead of the internal network.

Answer

The VPC subnet does not have a route to the internal network.

Question 6

A company is using AWS CodeCommit for source control. A developer accidentally committed a file containing AWS access keys. The keys have been removed from the file, but the commit history still contains them. What is the most secure way to remove the keys from the repository?

Accepted Answer

Use git filter-branch to remove the file from all commits and force push the changes.. Using git filter-branch (or BFG Repo-Cleaner) rewrites the entire commit history to purge the file containing the keys from every commit, then force-pushing replaces the remote history. This is the only way to remove secrets from historical commits, not just the current tip.

Answer

Delete the file from the repository and commit the deletion.

Answer

Use the AWS CLI command 'aws codecommit delete-file' with the --keep-history flag.

Answer

Revert the commit that added the keys.

Question 7

Which THREE measures can be taken to protect sensitive data stored in an Amazon S3 bucket? (Choose three.)

Accepted Answer

Enable default encryption on the bucket (SSE-S3 or SSE-KMS).. Enabling default encryption, blocking public access, and enabling versioning are key security measures to protect sensitive data at rest, prevent unauthorized access, and protect against accidental deletion or overwrite respectively. Option A (Enable server access logging) is incorrect because server access logging is used for auditing and monitoring, not for direct protection of data. Option B (Enable cross-region replication) is incorrect because cross-region replication is primarily for disaster recovery and data availability, not for security. Option E (Configure a bucket policy that denies all access) is incorrect because denying all access would prevent any legitimate use of the bucket; proper security uses least privilege, not an outright deny all.

Answer

Enable server access logging for the bucket.

Answer

Enable cross-region replication.

Answer

Configure a bucket policy that denies all access.

Question 8

A company runs a critical application on EC2 instances that need to access an S3 bucket with sensitive data. The security team has enabled S3 bucket policies that require TLS for all requests (aws:SecureTransport). The application is failing to access the S3 bucket, and logs show errors like 'Access Denied'. The application uses the AWS SDK to make requests. What is the most likely cause of the failure?

Accepted Answer

The application is using HTTP instead of HTTPS to connect to S3.. The scenario states the application is failing specifically because the bucket policy enforces aws:SecureTransport, and the symptom described (Access Denied consistent with a TLS-enforcement deny) points to the request being made over plain HTTP, not to a missing IAM permission. A missing s3:GetObject permission would also produce an Access Denied error, but it would occur regardless of the request's transport protocol and would not be tied to the specific TLS-enforcement condition described in the scenario. Since the question specifies the security team's TLS-enforcing bucket policy as the relevant control, and the failure aligns with that policy's deny condition, an IAM permissions gap is not the most likely cause here.

Answer

The S3 bucket is accessed through a VPC endpoint that does not support TLS.

Answer

The application's IAM role does not have s3:GetObject permission.

Answer

The bucket policy requires a specific TLS version that the application does not support.

Question 9

A company is using AWS KMS to encrypt data at rest in Amazon S3. The Security team requires that all encryption keys be automatically rotated annually. Which key type should be used to meet this requirement?

Accepted Answer

AWS managed symmetric key. The key type that automatically rotates annually is the AWS managed symmetric key. AWS managed keys are automatically rotated every year by AWS KMS, with no option to disable or customize the rotation period. Customer managed symmetric keys can be rotated, but the rotation is optional and must be enabled; they do not rotate automatically by default. Asymmetric keys and custom key stores do not support automatic rotation.

Answer

Asymmetric KMS key

Answer

Customer managed symmetric key

Answer

Custom key store backed by AWS CloudHSM

Question 10

An organization uses AWS Organizations with multiple accounts. The Security team needs to enforce a policy that prohibits the creation of S3 buckets with public access in any account. Which policy type should be used?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) in AWS Organizations define the maximum permissions for IAM principals in member accounts and can be attached at the OU or account level. An SCP that denies `s3:PutBucketPublicAccessBlock` or `s3:PutBucketAcl` with public grants (or denies `s3:PutBucketPolicy` allowing public access) enforces the prohibition across all accounts in scope.

Answer

IAM permissions boundary

Answer

AWS CloudTrail trail

Answer

AWS Config rule

Question 11

A company wants to monitor and detect suspicious API activity across all AWS accounts in an organization. Which TWO services should be used together?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (D) is correct because it records API activity across all accounts in an AWS Organization when configured as an organization trail, capturing management and data events that provide the raw audit log of who called which API, from where, and when. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with machine learning and threat intelligence to detect suspicious or malicious API activity, such as credential compromise or reconnaissance, across all member accounts via delegated administration. Together they satisfy the requirement: CloudTrail supplies the organization-wide API event data and GuardDuty performs the detection. Amazon Inspector (A) is not correct because it only scans EC2 instances, container images, and Lambda functions for software vulnerabilities and network exposure, not API activity. AWS Config (B) is not correct because it evaluates resource configuration compliance and records configuration changes, not suspicious API behavior. Amazon CloudWatch Logs (C) is not correct because it is a log storage and monitoring service that can centralize logs but does not itself detect suspicious API activity.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 12

A company uses AWS CodeBuild to build and test code. The build jobs need to access a private S3 bucket to download dependencies. Which THREE steps are required to securely grant access?

Accepted Answer

Configure the S3 bucket policy to allow access from the CodeBuild service principal. Option A is correct because the S3 bucket policy must explicitly grant access to the CodeBuild service principal (codebuild.amazonaws.com), since the bucket is private and denies access by default. Option C is correct because CodeBuild assumes an IAM service role whose policy must include s3:GetObject (and typically s3:ListBucket) on the specific bucket ARN to download the dependencies. Option E is correct because that IAM role must be attached to the CodeBuild project via the service role field so the build job actually assumes the permissions. Option B is not required because a VPC endpoint for S3 is only needed when the build runs inside a VPC and requires private network connectivity, not for basic secure access. Option D is not required because a KMS key is only needed if the bucket uses SSE-KMS encryption and the role must be granted kms:Decrypt; it is not a mandatory step for granting S3 access.

Answer

Set up a VPC endpoint for S3

Answer

Create a KMS key and grant CodeBuild access to it

Question 13

A company runs a production application on EC2 instances behind an Application Load Balancer (ALB). The application handles sensitive data. The Security team wants to encrypt all traffic between the ALB and the EC2 instances using TLS. They have created a self-signed certificate on each instance. However, the ALB health checks are failing with a 502 error. The instances are healthy when accessed directly via SSH. What is the MOST likely cause?

Accepted Answer

The target group health check is configured to use HTTPS, but the self-signed certificate is not trusted by the ALB. AWS Elastic Load Balancing does not validate the certificate presented by a target when performing an HTTPS health check or forwarding HTTPS traffic to a target group -- self-signed certificates on backend targets are explicitly supported and documented by AWS for this reason, so certificate trust is not the failure mode here. Given only self-signed-cert framing, a more accurate root cause for 502s on an HTTPS health check (with SSH access working) would be a health check protocol/port mismatch (e.g. health check configured for HTTP against an HTTPS-only listener, or vice versa), the target's web server not actually listening/responding on the health check port, or a backend TLS handshake failure due to an unsupported cipher/protocol on the self-signed certificate -- not certificate trust. As written, none of the four options correctly diagnoses the scenario, and option D's explanation is also incomplete (it doesn't actually address the security group reasoning it raises).

Answer

The EC2 instances are not configured with a certificate that matches the ALB's domain name

Answer

The ALB is configured to use a different TLS protocol version than the instances

Answer

The security groups on the EC2 instances do not allow inbound traffic from the ALB

Question 14

A company uses AWS Organizations with multiple accounts. The security team has implemented an SCP that denies the creation of IAM users. However, a developer in the 'development' account was able to create an IAM user. The DevOps engineer is asked to investigate. The SCP is attached to the root organizational unit (OU) and also to the 'development' OU. The 'development' account is a member of the 'development' OU. The SCP effect is 'Deny' on the 'iam:CreateUser' action. The developer's IAM permissions are managed by an IAM policy that allows 'iam:*'. The engineer checks CloudTrail and sees that the CreateUser API call succeeded. What is the most likely reason?

Accepted Answer

The 'development' account is the management account of the organization, so SCPs do not apply to it.. SCPs do not apply to the management account of an AWS Organization. If the 'development' account is the management account, the SCP denying iam:CreateUser would have no effect, allowing the developer to create the user despite the SCP. This is the most likely reason the API call succeeded.

Answer

The SCP is attached at the root OU but not inherited by the 'development' OU due to an explicit deny on inheritance.

Answer

The SCP is not effective because the developer's IAM policy explicitly allows iam:CreateUser and SCPs cannot override explicit allows.

Answer

The SCP is not applied because the account has a resource-based policy that overrides the SCP.

Question 15

A company is using AWS CodeBuild to build and test a Java application. The build process requires access to a private Maven repository hosted on an internal HTTPS server. The DevOps engineer has configured CodeBuild to use a VPC and placed the build environment in a private subnet. The security group for the build environment allows outbound HTTPS to the Maven repository's security group. The Maven repository server is in the same VPC but in a different private subnet. The build fails with a 'Connection refused' error when trying to download dependencies. The engineer checks the security group rules and confirms they are correct. What is the most likely cause?

Accepted Answer

The security group on the Maven repository server does not allow inbound HTTPS from the CodeBuild security group.. The most likely cause is that the security group attached to the Maven repository server does not have an inbound rule allowing HTTPS traffic from the CodeBuild security group. The engineer only verified the outbound rule on the CodeBuild side, but security groups are stateful, so outbound rules alone are not sufficient when the destination security group blocks inbound traffic. Option C is correct. Option A (Route53) is not relevant because the hosts are in the same VPC and DNS resolution is not the issue. Option B (wrong URL) would likely cause a different error (e.g., 404 Not Found). Option D (NACL blocking ephemeral ports) is possible but less likely because the error 'Connection refused' specifically indicates the target actively refused the connection, which strongly suggests a missing inbound rule on the server's security group. Note that network ACLs are stateless and would need both inbound and outbound rules, but the security group for the server is the more immediate check.

Answer

The private DNS resolution is failing because the VPC does not have Route53 Resolver enabled.

Answer

The CodeBuild buildspec is using the wrong URL for the Maven repository.

Answer

The network ACL on the private subnets is blocking outbound ephemeral ports.