DOP-C02 Security and Compliance Practice Test 7 — 15 Questions

Question 1

A company runs a critical application on AWS Lambda that processes sensitive data. The security team mandates that all data must be encrypted at rest and in transit. The Lambda function uses an environment variable to store a database password. The DevOps engineer has enabled encryption of environment variables using a KMS CMK. The Lambda function also needs to decrypt the password at runtime. The engineer attaches an IAM role to the Lambda function with permissions to decrypt using the KMS key. However, when the function executes, it fails with an error 'AccessDeniedException' when trying to decrypt the environment variable. The engineer checks the IAM role and confirms that it has kms:Decrypt permission. The KMS key policy allows the root user full access. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The KMS key policy does not grant the Lambda execution role permission to use the key.. The AccessDeniedException when decrypting environment variables indicates that the Lambda execution role does not have permission to use the KMS key. Even though the key policy grants root user full access, IAM roles are not automatically included unless explicitly allowed. Option A is correct. Option B would cause a different error (InvalidCiphertextException). Option C would cause a KMSInvalidStateException. Option D is unlikely because the key policy allows root user full access and no VPC endpoint restrictions are mentioned.

Answer

The Lambda function code is trying to decrypt the wrong ciphertext.

Answer

The KMS key has been disabled or scheduled for deletion.

Answer

The Lambda function is not in a VPC, and the KMS key is restricted to VPC endpoints.

Question 2

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in all accounts are encrypted with SSE-S3. They plan to use an SCP to deny the creation of unencrypted buckets. The DevOps engineer writes an SCP with a Deny effect for s3:PutBucketEncryption without a condition. However, when testing, an administrator in a member account is able to create a bucket without encryption. The engineer checks CloudTrail and sees that the bucket was created with a PutBucket call that did not include the x-amz-server-side-encryption header. What is the most likely reason the SCP did not prevent this?

Accepted Answer

The SCP denies s3:PutBucketEncryption, but the bucket creation does not call that action; it calls s3:CreateBucket. The SCP should deny s3:CreateBucket with a condition on the encryption parameter.. The SCP denies s3:PutBucketEncryption, but creating a bucket without encryption uses the s3:CreateBucket action, not s3:PutBucketEncryption. The PutBucketEncryption action is only called when explicitly setting or modifying bucket encryption via the API. Therefore, the SCP never evaluated the CreateBucket request, allowing the unencrypted bucket to be created. To enforce encryption at creation, the SCP must deny s3:CreateBucket unless the request includes the x-amz-server-side-encryption header (or use a condition on s3:PutBucketEncryption to require encryption after creation, but that doesn't prevent creation).

Answer

The SCP should also deny s3:PutBucketDefaultEncryption, which is the correct action for default encryption.

Answer

The SCP is not attached to the organizational unit that contains the member account.

Answer

The member account is the management account of the organization, so SCPs do not apply.

Question 3

A DevOps engineer needs to enforce that all IAM users in an AWS account must use multi-factor authentication (MFA) to access the AWS Management Console. The engineer wants to implement this with minimal ongoing management. Which solution should the engineer use?

Accepted Answer

Use an IAM policy with a condition that requires aws:MultiFactorAuthPresent to be true, and attach it to a group that all users belong to.. The most efficient way to enforce MFA for all IAM users is to create a policy that denies actions unless aws:MultiFactorAuthPresent is true and attach it to a group containing all users. This centralizes management and automatically applies to new users added to the group. Password policies do not enforce MFA, and per-user policies or SSO migration are less efficient.

Answer

Enable MFA in the account password policy.

Answer

Configure AWS SSO to require MFA and migrate all IAM users to SSO.

Answer

Create an IAM policy that denies all actions unless the user has authenticated with MFA, and attach it to all users.

Question 4

A company uses AWS Organizations with multiple accounts. A security team wants to ensure that all Amazon S3 buckets across all accounts are encrypted with AWS KMS customer managed keys (CMKs) and that the keys are rotated annually. They also want to prevent any account from disabling default encryption or using AWS-managed keys. Which combination of actions should the DevOps engineer take to meet these requirements with the least operational overhead?

Accepted Answer

Create an SCP that denies s3:CreateBucket and s3:PutBucketEncryption unless the request includes the s3:x-amz-server-side-encryption-aws-kms-key-id condition key matching an approved CMK ARN, and denies kms:CreateKey and kms:EnableKeyRotation unless specific conditions are met. Attach the SCP to the root.. An SCP attached to the organization root can enforce encryption requirements across all accounts. By using condition keys like s3:x-amz-server-side-encryption-aws-kms-key-id, the SCP can require a specific CMK for S3 encryption. Similarly, conditions on kms:CreateKey can enforce rotation. This approach provides centralized, preventive control with least operational overhead.

Answer

Use AWS Config rules in each account to check for S3 bucket encryption with CMKs and KMS key rotation. Set up automatic remediation with AWS Systems Manager Automation documents to enable encryption and rotation.

Answer

Create an SCP that denies s3:PutBucketEncryption if the encryption algorithm is not aws:kms and denies kms:DisableKeyRotation. Attach the SCP to the root of the organization.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates an S3 bucket policy requiring encryption with a specific CMK and a KMS key with rotation enabled. Deploy the stack set to all accounts.

Question 5

A company runs a production workload on Amazon EC2 instances in a private subnet. The instances must retrieve secrets from AWS Secrets Manager without traversing the public internet. The company has created a VPC endpoint for Secrets Manager and attached a policy to it that allows access only to a specific secret. However, the instances still cannot retrieve the secret. The instances' IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The secret's resource policy does not grant access to the VPC endpoint or the IAM role.. When a VPC endpoint policy allows access to a secret, the secret's own resource policy can still deny access. Secrets Manager evaluates both identity-based and resource-based policies. If the secret policy does not explicitly allow the IAM role or the VPC endpoint, the request is denied. The engineer should review and update the secret policy to grant the necessary permissions, ensuring the instance role can retrieve the secret.

Answer

The VPC endpoint must be created in the same subnet as the instances.

Answer

The instances must have a public IP address to reach the Secrets Manager endpoint.

Answer

The VPC endpoint policy must allow the secretsmanager:GetSecretValue action, and the endpoint's security group must allow outbound HTTPS to the instances.

Question 6

A DevOps engineer is implementing a strategy to detect and remediate unencrypted Amazon EBS volumes across a multi-account AWS Organization. The security team wants to ensure that any newly created EBS volume without encryption is automatically encrypted and that the account owner is notified. The engineer plans to use AWS Config and AWS Lambda. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Create an AWS Lambda function that encrypts the volume and configure it as a remediation action for the AWS Config rule.. To detect unencrypted EBS volumes, AWS Config must be enabled with a rule that evaluates encryption status. For remediation, an AWS Lambda function can be configured as a custom remediation action to encrypt the volume. Together, these actions provide detection and automatic remediation. Notification via SNS is important but is a separate concern and not one of the two required actions.

Answer

Configure an Amazon SNS topic to receive notifications from AWS Config and subscribe the account owner's email.

Answer

Use AWS CloudTrail to monitor EBS volume creation and trigger a Lambda function to encrypt the volume.

Answer

Use AWS Config conformance packs to deploy the rule and remediation action across all accounts.

Question 7

A DevOps engineer needs to grant an AWS Lambda function permission to write logs to Amazon CloudWatch Logs. The function's execution role currently has no policies attached. Which action should the engineer take?

Accepted Answer

Attach the AWSLambdaBasicExecutionRole managed policy to the execution role.. The AWSLambdaBasicExecutionRole managed policy provides the minimal permissions required for a Lambda function to write logs to CloudWatch Logs. Attaching it to the execution role is the correct and secure way to grant logging permissions. Other options either grant excessive permissions or misunderstand how Lambda permissions are assigned.

Answer

Attach the CloudWatchLogsFullAccess managed policy to the execution role.

Answer

Enable CloudWatch Logs integration in the Lambda console, which automatically attaches the necessary permissions.

Answer

Create an inline policy that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, and attach it to the function's resource-based policy.

Question 8

A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?

Accepted Answer

Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.. Attaching an IAM role to the EC2 instance and using the instance profile allows the application to obtain temporary credentials from the EC2 instance metadata service (IMDS). These credentials are automatically rotated by AWS before they expire, and they are never stored on disk—they are fetched on-demand from the metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). This satisfies both the requirement for automatic rotation and the prohibition against disk storage.

Answer

Store the credentials in AWS Secrets Manager and retrieve them at application startup.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and retrieve them using the EC2 instance's IAM role.

Answer

Generate an access key and secret key for an IAM user and store them in a configuration file on the EC2 instance.

Question 9

A DevOps engineer needs to ensure that all API calls made to AWS are recorded for auditing purposes. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This provides a complete audit trail of user activity and API usage, which is essential for auditing, security analysis, and compliance requirements.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 10

A company uses AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific attribute in their SAML assertion can decrypt the data. Which KMS key policy should be used?

Accepted Answer

Modify the KMS key policy to include a condition that allows kms:Decrypt only if the SAML assertion contains the specific attribute.. KMS key policies are resource-based policies that can use IAM condition keys. To enforce a requirement based on a SAML assertion, you must first configure the IAM role's trust policy to map the SAML attribute to a session tag using sts:TagSession. Then, the KMS key policy can include a condition such as aws:PrincipalTag/attribute_name to allow kms:Decrypt only when that session tag matches the expected value. This ensures compliance at the key level, independent of S3 bucket policies. Note that saml:sub and other SAML condition keys are not supported in KMS key policies; they are only valid in IAM trust policies.

Answer

Create an S3 bucket policy that denies kms:Decrypt unless the request includes a specific tag.

Answer

Attach a resource-based policy to the S3 bucket that allows decryption only for users with the specific attribute.

Answer

Use an IAM policy that grants kms:Decrypt only if the user has the specific attribute.

Question 11

A company has a requirement to rotate database credentials every 30 days for an Amazon RDS for MySQL instance. The credentials are currently stored in AWS Secrets Manager. The DevOps engineer needs to implement automatic rotation without modifying the application code. Which solution should be used?

Accepted Answer

Configure Secrets Manager to automatically rotate the secret every 30 days using a Lambda rotation function, and have the application retrieve the secret using the Secrets Manager API.. AWS Secrets Manager natively supports automatic rotation of secrets using a Lambda function that updates both the secret in Secrets Manager and the password in the RDS MySQL instance. This solution meets the 30-day rotation requirement without modifying application code, as the application retrieves the current secret via the Secrets Manager API, which automatically handles versioning and caching.

Answer

Create a scheduled job that runs every 30 days to update the secret in Secrets Manager with a new password.

Answer

Store the credentials in AWS Systems Manager Parameter Store and configure automatic rotation using a Lambda function.

Answer

Use the AWS RDS automatic password rotation feature, which automatically updates the password every 30 days.

Question 12

A company uses AWS Organizations to manage multiple accounts. The Security team wants to prevent member accounts from disabling AWS CloudTrail or deleting CloudTrail log files. Which TWO actions should the Security team take in the organization's management account? (Choose TWO.)

Accepted Answer

Create an SCP to deny s3:DeleteObject on the CloudTrail log bucket.. An SCP that denies s3:DeleteObject on the CloudTrail log bucket prevents member accounts from deleting log files stored in S3, even if they have full administrative permissions. This is a critical control to ensure log integrity and compliance with security policies.

Answer

Create an SCP to deny cloudtrail:UpdateTrail.

Answer

Create an IAM policy in each member account to deny cloudtrail:StopLogging.

Answer

Enable AWS CloudTrail from the management account with organization trail.

Question 13

A DevOps team is designing a CI/CD pipeline that deploys a web application on Amazon ECS. The application must be compliant with PCI DSS, which requires encryption of data at rest and in transit, and logging of all access. Which THREE actions should the team implement to meet these requirements? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail and Amazon ECS logs to capture all API calls and container logs.. AWS CloudTrail captures all API calls to the AWS environment, providing an audit trail of who accessed what and when, which is required for PCI DSS logging. Amazon ECS logs (via CloudWatch Logs or FireLens) capture container-level access and application logs, ensuring comprehensive logging of all access to the application and underlying infrastructure.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Answer

Use VPC endpoints to access ECS and ECR APIs.

Question 14

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.. AWS CloudFormation StackSets can deploy a stack containing the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, new accounts automatically receive the stack. This centrally manages the rule with minimal operational overhead. Option B is incorrect because SCPs only deny API actions and cannot deploy a Config rule; they would need a separate mechanism to deploy the rule initially.

Answer

Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.

Answer

Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.

Answer

Use an AWS Config aggregator in the management account to monitor compliance across accounts.

Question 15

A financial services company is migrating its applications to AWS. The compliance team requires that all Amazon S3 buckets containing personally identifiable information (PII) must have server-side encryption enabled and block public access. The DevOps team discovers that some S3 buckets are not compliant. Which TWO actions should the team take to enforce these requirements automatically for all current and future buckets? (Select TWO.)

Accepted Answer

Use AWS Config managed rules to detect noncompliant buckets and automatically remediate by applying encryption and blocking public access.. To enforce these requirements automatically for all current and future buckets, the team should use AWS Config managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-public-read-prohibited) with auto-remediation to detect and automatically fix noncompliant buckets (option B). Additionally, an SCP that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions when the required settings are not specified prevents noncompliant buckets from being created in the first place across all accounts (option E). Together, these provide preventive and corrective controls for all existing and future buckets.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts when noncompliant buckets are created.

Answer

Attach an IAM permissions boundary to all users that prevents them from creating or modifying S3 buckets.

Answer

Apply an S3 bucket policy to each existing bucket that denies all access unless encryption is enabled.