DOP-C02 Security and Compliance Practice Test 6 — 15 Questions

Question 1

A company is migrating a legacy application to AWS. The application requires a shared file system accessible from multiple EC2 instances. The compliance team mandates encryption at rest and in transit, with automatic key rotation. Which storage solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon EFS with encryption at rest and in transit. EFS supports encryption at rest with AWS KMS and encryption in transit via TLS, and can enable automatic key rotation by using a KMS key with automatic rotation. S3 is object storage, not a shared file system. FSx for Windows File Server requires manual key rotation. EBS is block storage, not shared.

Answer

Amazon S3 with server-side encryption

Answer

Amazon EBS with encryption enabled

Answer

Amazon FSx for Windows File Server with encryption

Question 2

A DevOps engineer needs to ensure that an S3 bucket policy enforces encryption in transit for all access. Which policy statement should be added?

Accepted Answer

{"Effect":"Deny","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. To enforce encryption in transit, use a condition that denies access unless the request uses 'aws:SecureTransport' set to 'true'. This requires a Deny effect with the condition.

Answer

{"Effect":"Deny","Condition":{"StringEquals":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Condition":{"Bool":{"aws:SecureTransport":"false"}}}

Answer

{"Effect":"Allow","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 3

A DevOps team uses AWS CodePipeline to deploy a web application. Security scanning must be integrated into the pipeline to check for vulnerabilities before deployment to production. Which action should be taken?

Accepted Answer

Add an Amazon Inspector scan action as a test stage in the pipeline. Amazon Inspector can be integrated as a test action in CodePipeline to scan for vulnerabilities. GuardDuty is a threat detection service, not a scanning tool for code or containers. Config evaluates resource configurations. Trusted Advisor provides best practice checks, not vulnerability scanning.

Answer

Enable AWS GuardDuty in the account

Answer

Activate AWS Trusted Advisor for security checks

Answer

Use AWS Config rules to check for vulnerabilities

Question 4

An application running on EC2 needs to access an S3 bucket. To follow the principle of least privilege, what is the recommended approach?

Accepted Answer

Create an IAM role with a policy allowing only necessary S3 actions and attach it to the EC2 instance. The best practice is to create an IAM role with a policy that grants only the required S3 actions and attach the role to the EC2 instance. This avoids using long-term credentials. Access keys are long-term and insecure. Bucket policy can be used but is not the most secure for instance access. Security group is for network access, not API access.

Answer

Store AWS access keys in the application configuration

Answer

Use an S3 bucket policy to allow access from the EC2 instance's public IP

Answer

Configure the EC2 security group to allow outbound access to S3

Question 5

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are tamper-proof and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and digital signing to ensure logs have not been tampered with. S3 object lock prevents deletion but not modification. MFA delete protects deletion but not modification. SSE encrypts data at rest but does not protect integrity.

Answer

Server-side encryption (SSE-S3)

Answer

S3 Object Lock

Answer

MFA delete on the S3 bucket

Question 6

A DevOps engineer is troubleshooting a failed AWS CodeBuild project. The build fails with an error indicating that the IAM role does not have permission to describe Amazon ECR repositories. The role used by CodeBuild has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage"],"Resource":"*"}]}. What is the missing permission?

Accepted Answer

ecr:DescribeRepositories. The policy allows several ECR actions but does not include 'ecr:DescribeRepositories'. The error specifically mentions 'describe' which is that action. The other actions are present.

Answer

ecr:InitiateLayerUpload

Answer

ecr:GetRepositoryPolicy

Answer

ecr:ListImages

Question 7

A company wants to automatically detect and respond to suspicious activity in their AWS account. Which service should be used to generate alerts based on threat intelligence?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using threat intelligence. Inspector is for vulnerability scanning. Config is for resource configuration. CloudWatch is for monitoring metrics and logs but does not have built-in threat intelligence.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon CloudWatch

Question 8

A company needs to audit all changes to IAM policies in their AWS account. Which services can be used to track and log these changes? (Select TWO.)

Accepted Answer

AWS Config. AWS CloudTrail logs API calls, including IAM policy changes. AWS Config can track configuration changes to IAM resources. CloudWatch Logs stores logs but does not track changes itself. GuardDuty is for threat detection. S3 is storage.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 9

A security team wants to enforce that all Amazon S3 buckets in the organization are encrypted at rest. Which actions can achieve this? (Select THREE.)

Accepted Answer

Configure an AWS Config rule to detect unencrypted buckets and trigger remediation. You can create an SCP to deny creation of buckets without encryption, use a Config rule to detect noncompliant buckets, and use a bucket policy to deny PutObject without encryption headers. S3 Block Public Access is for preventing public access, not encryption. Cross-Region Replication does not enforce encryption.

Answer

Enable S3 Block Public Access at the account level

Answer

Set up Cross-Region Replication for all buckets

Question 10

Which AWS services can be used to protect a web application from common web exploits like SQL injection and cross-site scripting? (Select TWO.)

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that filters malicious requests. CloudFront can be integrated with WAF to provide protection at the edge. Shield Advanced provides DDoS protection, not application-layer exploits. Cognito is for authentication. Inspector is for vulnerability scanning.

Answer

AWS Shield Advanced

Answer

Amazon Inspector

Answer

Amazon Cognito

Question 11

A DevOps engineer created the IAM policy shown in the exhibit and attached it to a user. The user tries to upload an object to my-bucket without specifying the ACL. Why does the upload fail?

Accepted Answer

The policy condition requires the ACL to be bucket-owner-full-control, but the user did not specify it. The policy condition requires the ACL to be 'bucket-owner-full-control'. If the user does not specify an ACL, the default is usually 'private', which does not satisfy the condition. Therefore the action is denied. The resource ARN is correct. The action is allowed. The condition specifies StringEquals, which is correct for comparison.

Answer

The Effect should be Deny for this policy to work

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket

Answer

The user does not have permission to list the bucket

Question 12

A DevOps engineer executed the CLI command shown in the exhibit. After creation, the security team requires that the log files be encrypted with a KMS key that is rotated every 90 days. The current key is a customer managed key with automatic rotation enabled set to 365 days. What should the engineer do to meet the requirement?

Accepted Answer

Create a new KMS key with automatic rotation set to 90 days and update the trail with the new key. The requirement is to encrypt log files with a KMS key that rotates every 90 days. The current key rotates every 365 days, and you cannot change the rotation period of an existing customer managed key; you must create a new key with the desired rotation period. Once created, you update the CloudTrail trail to use the new key by specifying the --kms-key-id parameter. Option D correctly describes this process. Option A is wrong because you cannot change the rotation period of an existing key. Option B is wrong because manually rotating a key does not meet the automatic rotation requirement and is not recommended. Option C is wrong because you cannot modify the rotation period of an existing key.

Answer

Use the existing key and change the rotation period in KMS

Answer

Disable automatic rotation and manually rotate the key every 90 days

Answer

Modify the KMS key to set the rotation period to 90 days

Question 13

A company uses AWS CodePipeline to deploy a web application. The deployment includes an EC2 instance running behind an Application Load Balancer. The security team requires that all data in transit to the application be encrypted. Which configuration best meets this requirement without breaking the deployment?

Accepted Answer

Create an HTTPS listener on the ALB with a certificate from AWS Certificate Manager and redirect HTTP to HTTPS.. The Application Load Balancer supports SSL/TLS termination using certificates from AWS Certificate Manager, enabling HTTPS encryption. Option A is wrong because CodePipeline does not encrypt traffic at the ALB level. Option B is wrong because AWS WAF is a web application firewall, not for encryption. Option D is wrong because CloudFront can handle HTTPS, but adding it changes the architecture unnecessarily and may break the pipeline if not properly configured.

Answer

Configure CodePipeline to use an encrypted artifact bucket.

Answer

Enable AWS WAF on the ALB to enforce HTTPS.

Answer

Place a CloudFront distribution in front of the ALB and configure it to require HTTPS.

Question 14

A DevOps engineer is configuring AWS Config to detect changes to security group rules. The engineer wants to receive near-real-time notifications when a security group rule that allows inbound SSH traffic is created. Which combination of services and configurations should the engineer use? (Choose the best answer.)

Accepted Answer

Create an AWS Config rule to evaluate security groups, and configure an Amazon EventBridge rule to match 'Config Rules Compliance Change' events and trigger an SNS topic.. AWS Config can use managed rules such as 'restricted-ssh' to evaluate security groups, and when the rule detects a non-compliant change, it publishes a 'Config Rules Compliance Change' event to Amazon EventBridge. EventBridge can then directly invoke an SNS topic to send near-real-time notifications. Option A is incorrect because Amazon GuardDuty is a threat detection service that monitors for malicious activity, not for configuration compliance. Option C is incorrect because AWS CloudTrail logs API calls like CreateSecurityGroup, but it does not evaluate the configuration state (such as whether the rule allows SSH) and is not designed for near-real-time compliance notifications. Option D is incorrect because while AWS Config can deliver configuration change notifications to SNS, it sends notifications for all configuration changes, not specifically filtered for non-compliant security group rules; EventBridge provides the necessary filtering to target only the specific compliance violation.

Answer

Enable Amazon GuardDuty and create a custom threat list for SSH access.

Answer

Use AWS CloudTrail to monitor CreateSecurityGroup API calls and send events to CloudWatch Logs.

Answer

Set up AWS Config to send configuration change notifications directly to an SNS topic.

Question 15

A company has a security policy requiring that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. The DevOps engineer needs to enforce this policy. What is the simplest way to achieve this?

Accepted Answer

Create an IAM policy that denies all actions unless MFA is present, and attach it to all IAM users or groups.. Creating an IAM policy that denies all actions unless MFA is present, then attaching it to all IAM users or groups, is the simplest way to enforce MFA for console access. This uses the `aws:MultiFactorAuthPresent` condition key to require MFA. Option A is incorrect because Amazon Cognito is used for application-level authentication, not AWS IAM console access. Option C is incorrect because MFA delete on the root account only protects S3 versioning, not console access. Option D is incorrect because S3 bucket policies cannot enforce MFA for console login.

Answer

Use Amazon Cognito to require MFA for console access.

Answer

Enable MFA delete on the root account.

Answer

Enable MFA on the S3 bucket policy.