DOP-C02 Security and Compliance Practice Test 7 — 15 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail logs. What is the most effective way to enforce this control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a Service Control Policy that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging.. A Service Control Policy (SCP) can deny the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions across all accounts in the organization, effectively preventing member accounts from disabling CloudTrail or deleting logs. Option A is incorrect because requiring all accounts to use the same trail does not prevent them from disabling or deleting that trail; they could still perform those actions. Option C is incorrect because IAM policies within each account are managed by the account administrator and can be overridden, so they are not a reliable control. Option D is incorrect because while logging to a centralized bucket helps protect logs, it does not prevent member accounts from disabling CloudTrail or deleting the trail itself in their own account; member accounts may still have permissions to modify or delete the trail.

Answer

Require all accounts to use the same CloudTrail trail.

Answer

Create an IAM policy in each account that denies cloudtrail:DeleteTrail.

Answer

Configure CloudTrail to log to an S3 bucket in a centralized logging account and deny access to the bucket from member accounts.

Question 2

A DevOps engineer is designing an AWS Lambda function that needs to read secrets from AWS Secrets Manager. What is the most secure way to provide the Lambda function access to the secret?

Accepted Answer

Assign an IAM execution role to the Lambda function with a policy that allows secretsmanager:GetSecretValue on the specific secret.. The most secure way to provide access is to assign an IAM execution role to the Lambda function with a policy that allows secretsmanager:GetSecretValue on the specific secret. This follows the principle of least privilege and avoids exposing secrets in environment variables or passing encrypted values. Option B is incorrect because Systems Manager Parameter Store is a separate service and does not directly leverage Secrets Manager for secrets. Option C is incorrect because encrypting a secret in an environment variable still exposes the encrypted value and requires managing encryption keys, which is less secure than IAM-based access control. Option D is incorrect because storing secrets in environment variables is insecure as they can be viewed in the Lambda console and are not encrypted by default.

Answer

Store the secret in AWS Systems Manager Parameter Store and grant the Lambda function access to the parameter.

Answer

Encrypt the secret using AWS KMS and pass the encrypted value as an environment variable.

Answer

Store the secret in an environment variable in the Lambda function.

Question 3

A company uses AWS CodeBuild to build and test code. The security team requires that all build artifacts be encrypted at rest. Which action should the DevOps engineer take to meet this requirement?

Accepted Answer

Enable default encryption on the S3 bucket used for CodeBuild artifacts.. To ensure all build artifacts are encrypted at rest, the simplest and most direct approach is to enable default encryption on the S3 bucket used for CodeBuild artifacts. This ensures that any object uploaded to the bucket is automatically encrypted with Amazon S3-managed keys (SSE-S3) or AWS KMS keys. Option A is incorrect because CodeBuild does not have a setting to specify a KMS key for artifact encryption at the project level; encryption is handled by the S3 bucket. Option B is incorrect because while an S3 bucket policy can enforce encryption headers, it is more complex and not necessary if default encryption is enabled. Option D is incorrect because the build environment's EBS volume encryption does not affect the artifacts stored in S3.

Answer

Create a customer-managed KMS key and specify it in the CodeBuild project's artifacts encryption settings.

Answer

Use an S3 bucket policy to deny write operations unless the request includes the x-amz-server-side-encryption header.

Answer

Configure the CodeBuild project to use an encrypted EBS volume for the build environment.

Question 4

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that any changes to IAM roles must be reviewed and approved by a security engineer before deployment. The DevOps engineer needs to implement a gating mechanism. Which approach should the engineer use?

Accepted Answer

Create a CodePipeline that deploys CloudFormation stacks and include a manual approval step for changes that modify IAM resources.. AWS CodePipeline can include a manual approval step before deploying CloudFormation stacks, allowing the security engineer to review and approve any changes to IAM roles. Option A is incorrect because AWS Config only detects changes after they occur; it cannot prevent deployment. Option B is incorrect because a service control policy would deny all IAM role creation across the organization, which is too restrictive and not a gating mechanism. Option C is incorrect because requiring MFA for CloudFormation actions does not specifically gate changes to IAM resources.

Answer

Use AWS Config to detect changes to IAM roles and trigger a Lambda function that reverts the change.

Answer

Apply a service control policy that denies iam:CreateRole and iam:UpdateAssumeRolePolicy across the organization.

Answer

Add a condition to the IAM policy that requires MFA for any CloudFormation action.

Question 5

A company is using Amazon S3 to store sensitive data. The security team mandates that all data must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS). The DevOps engineer must ensure that any new objects uploaded to the bucket are automatically encrypted. What should the engineer do?

Accepted Answer

Enable default encryption on the S3 bucket and select AWS-KMS as the encryption method.. Enabling default encryption on the S3 bucket with SSE-KMS ensures that all objects uploaded to the bucket are automatically encrypted at rest with AWS KMS. Option A is incorrect because CORS is for cross-origin requests and does not affect encryption. Option B is incorrect because while a bucket policy can enforce encryption headers, it does not provide default encryption; it only denies requests without the header, and default encryption is a simpler and more reliable method. Option D is incorrect because versioning does not encrypt data.

Answer

Enable CORS on the bucket to allow encrypted uploads.

Answer

Apply a bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header with aws:kms.

Answer

Enable S3 Versioning to protect encrypted objects.

Question 6

A DevOps engineer needs to grant cross-account access to an S3 bucket in Account A for users in Account B. The users in Account B must be able to list objects and read them. What is the most secure way to configure this access?

Accepted Answer

Create a bucket policy in Account A granting access to the root user of Account B, and create an IAM policy in Account B allowing the users to access the bucket.. It combines a bucket policy in Account A granting access to Account B's root or specific ARN, and an IAM policy in Account B allowing users to access that bucket. Option A is wrong because a bucket policy alone is insufficient; Account B users also need IAM permissions. Option B is wrong because KMS is for encryption, not access control. Option D is wrong because creating an IAM role in Account A with a trust policy allowing Account B to assume it is a valid pattern, but the question specifies users in Account B; they would need to assume the role, which is less direct than Option C for S3 access.

Answer

Create a bucket policy in Account A that grants access to the IAM user ARNs from Account B.

Answer

Create a KMS key in Account A and share it with Account B to decrypt objects.

Answer

Create an IAM role in Account A with trust policy allowing Account B to assume it, and attach a policy granting S3 access.

Question 7

A company is using AWS Lambda to process sensitive data. The security team requires that the Lambda function only be invoked from within a specific VPC and that the function's environment variables be encrypted at rest. Which TWO actions should the DevOps engineer take to meet these requirements?

Accepted Answer

Enable AWS KMS encryption for the Lambda function's environment variables using a customer-managed key.. Using a customer-managed KMS key to encrypt the Lambda function's environment variables satisfies the encryption at rest requirement. Option C is correct because configuring the Lambda function to be VPC-enabled and setting up a VPC endpoint for Lambda restricts invocation to within the specific VPC. Option B is incorrect because encrypting CloudWatch Logs does not encrypt the Lambda environment variables. Option D is incorrect because assigning an IAM execution role with KMS permissions is necessary but not sufficient; the encryption is enabled by configuring KMS on the function. Option E is incorrect because resource-based policies cannot restrict invocation to VPC origin alone; VPC configuration and endpoints are required.

Answer

Enable encryption for CloudWatch Logs using a KMS key.

Answer

Assign an IAM execution role with permissions to access a KMS key.

Answer

Attach a resource-based policy to the Lambda function that denies invoke unless the request comes from the VPC.

Question 8

A company is using AWS Secrets Manager to rotate database credentials automatically. The DevOps engineer needs to ensure that the rotation process is secure and does not cause downtime. Which THREE steps should the engineer take?

Accepted Answer

Set up CloudWatch alarms to monitor rotation failures.. CloudWatch alarms can monitor rotation failures and trigger alerts, ensuring issues are detected promptly. Option C is correct because using a separate database user for rotation allows the old credentials to remain valid while the new ones are being set, preventing downtime during the rotation process. Option E is correct because the Lambda rotation function needs IAM permissions to read and update the secret in Secrets Manager. Option A is incorrect: disabling automatic rotation for the old secret version is unnecessary; Secrets Manager automatically manages version staging during rotation. Option D is incorrect: while the Lambda function must reach Secrets Manager, using a VPC endpoint is not mandatory; the function can access Secrets Manager via the internet or a VPC endpoint, but this is not a required step for secure rotation.

Answer

Disable automatic rotation for the old secret version.

Answer

Configure the Lambda rotation function to use a VPC endpoint for Secrets Manager.

Question 9

A DevOps engineer is tasked with auditing all AWS API calls made in the account for compliance purposes. The engineer needs to ensure that the audit logs are tamper-proof and stored cost-effectively. Which TWO services should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (Option B) is the service that records all API calls made in an AWS account, providing an audit trail. To ensure these logs are tamper-proof and stored cost-effectively, Amazon S3 with Object Lock enabled (Option C) is used. Object Lock prevents logs from being deleted or overwritten, meeting compliance requirements. Option A (AWS Config) records resource configuration changes, not API calls. Option D (Amazon CloudWatch Logs) is for application and system logs, not AWS API call logs. Option E (AWS KMS) manages encryption keys but does not provide tamper-proof storage for logs.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS KMS

Question 10

Refer to the exhibit. An IAM policy is attached to an IAM user. Which of the following actions will be allowed by this policy?

Accepted Answer

DescribeInstances on an instance in us-east-1. The Allow statement grants the ec2:DescribeInstances action on all instances. The Deny statement denies all ec2 actions (ec2:*) on instances when the requested region is not us-east-1. Since the request in Option A is for us-east-1, the condition in the Deny statement is false, so the Deny does not apply. Therefore, the Allow stands and DescribeInstances is permitted. Option B (StartInstances) is not explicitly allowed by any statement, and although the Deny does not apply for us-east-1, there is no Allow, so it is implicitly denied. Option C (DescribeInstances in us-west-2) is denied because the region is not us-east-1, triggering the Deny. Option D (StopInstances in us-east-1) is also implicitly denied because no Allow exists for that action.

Answer

StartInstances on an instance in us-east-1

Answer

DescribeInstances on an instance in us-west-2

Answer

StopInstances on an instance in us-east-1

Question 11

A company has a multi-account AWS environment managed by AWS Organizations. The DevOps team uses AWS CloudFormation StackSets to deploy a standard VPC across all member accounts. The security team has noticed that in some accounts, the VPC is being modified after deployment, allowing inbound SSH access from the internet. The team wants to automatically detect and remediate these changes. The current setup includes: AWS Config enabled in all accounts with a rule that checks for unrestricted SSH access; an SNS topic in the management account that receives compliance change notifications; and a Lambda function in the management account that can remediate by updating the security group rules. However, the remediation is not working consistently. What is the most likely reason, and what is the best solution?

Accepted Answer

The Lambda function's IAM role does not have permissions to modify security groups in member accounts.. The Lambda function in the management account needs cross-account permissions to modify security groups in member accounts. The most likely issue is that the Lambda function's IAM role does not have the required permissions. The best solution is to use AWS Config conformance packs with remediation actions deployed to each member account, allowing local remediation. Option A is incorrect because the Config rule itself detects the changes. Option C is incorrect because the SNS topic can deliver messages cross-account with proper permissions, but the remediation fails due to the Lambda role's lack of permissions. Option D is incorrect because StackSets are for initial deployment, not for ongoing compliance.

Answer

The AWS Config rule is not evaluating correctly in member accounts.

Answer

The SNS topic is not delivering messages to the Lambda function due to cross-account access issues.

Answer

CloudFormation StackSets is overriding the changes, causing a race condition.

Question 12

A company is using AWS Secrets Manager to store database credentials for a multi-tier application. The application runs on EC2 instances in an Auto Scaling group. The DevOps engineer has configured the instances to retrieve the secret at boot time using a script that calls the AWS CLI. Recently, the security team discovered that the secret was exposed in the instance's user data logs. The engineer needs to implement a more secure method to access the secret without storing it in user data. The application code can be modified. The environment uses IAM roles for EC2. Which solution best meets the security requirements?

Accepted Answer

Modify the application code to use the AWS SDK to retrieve the secret from Secrets Manager using the instance's IAM role.. Modifying the application code to use the AWS SDK allows the application to retrieve the secret directly from Secrets Manager using the IAM role attached to the EC2 instance. This eliminates the need to store the secret in user data or any configuration file, as the SDK handles authentication and retrieval securely at runtime. Option A is incorrect because encrypting the file system does not prevent exposure of the secret if it is stored in a configuration file; the secret is still present in plaintext at rest until decrypted. Option B is incorrect because using Systems Manager Parameter Store does not inherently solve the issue; it still requires the script to call the AWS CLI at boot time, which could again be exposed in user data logs. Moreover, the question specifies that Secrets Manager is already in use, so switching to Parameter Store is unnecessary and does not address the root cause of storing secrets in user data. Option D is incorrect because storing the encrypted secret in user data does not prevent exposure; user data is still visible via the EC2 console or API, and decryption key management adds complexity without improving security posture.

Answer

Store the secret in a configuration file on the EC2 instance and encrypt the file system.

Answer

Store the secret in AWS Systems Manager Parameter Store and retrieve it via the AWS CLI at boot time.

Answer

Use a KMS key to encrypt the secret and store the encrypted value in user data.

Question 13

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which KMS key type should the company use to meet this requirement without manual intervention?

Accepted Answer

Customer managed key. AWS managed keys (AWS managed key) are automatically rotated every three years, not every year. Customer managed keys (Customer managed key) can be configured for automatic annual rotation. Imported key material cannot be automatically rotated. A Custom key store does not support automatic rotation.

Answer

Imported key material

Answer

Custom key store (CloudHSM)

Answer

AWS managed key

Question 14

A DevOps engineer needs to grant an IAM user temporary access to an S3 bucket for exactly one hour. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is used to generate temporary, limited-privilege credentials for IAM users or federated users. IAM roles provide temporary credentials but are assumed, not generated for a specific user. Cognito is for identity federation with mobile/web apps. SSO provides single sign-on access.

Answer

Amazon Cognito

Answer

AWS SSO

Answer

AWS IAM

Question 15

Refer to the exhibit. An IAM policy is attached to a user. The user requests an object from the 'example-bucket' bucket, specifically from the 'confidential' folder, over HTTP (not HTTPS). The source IP is within the 10.0.0.0/24 range. What will be the result of this request?

Accepted Answer

Denied, because the request uses HTTP and the Deny statement blocks it.. The Deny statement with SecureTransport false applies to all s3 actions on the confidential folder. Even though the source IP is allowed, the Deny for HTTP access will override the Allow. The request will be denied.

Answer

Denied, because the user does not have s3:GetObject permission on the confidential folder.

Answer

Allowed, because the Deny statement only applies to HTTPS.

Answer

Allowed, because the source IP is within the allowed range.