DOP-C02 Security and Compliance Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance with the tag 'Environment=production' in us-east-1. What will happen?

Accepted Answer

The action is denied because the Deny statement explicitly denies the action for production instances.. Option C is correct because the Deny statement explicitly denies TerminateInstances for instances with tag Environment=production, regardless of any Allow. Option A is wrong because Deny overrides Allow. Option B is wrong because the Deny applies to all instances with that tag. Option D is wrong because the Deny is explicit.

Answer

The action is allowed because there is no explicit Deny for the user.

Answer

The action is denied only if the instance is in the us-east-1 region.

Answer

The action is allowed because the Allow statement grants ec2:TerminateInstances.

Question 2

A company is migrating a legacy application to AWS. The application requires a shared file system accessible from multiple EC2 instances. The compliance team mandates encryption at rest and in transit, with automatic key rotation. Which storage solution meets these requirements?

Accepted Answer

Amazon EFS with encryption at rest and in transit. EFS supports encryption at rest with AWS KMS and encryption in transit via TLS, and can enable automatic key rotation by using a KMS key with automatic rotation. S3 is object storage, not a shared file system. FSx for Windows File Server requires manual key rotation. EBS is block storage, not shared.

Answer

Amazon S3 with server-side encryption

Answer

Amazon EBS with encryption enabled

Answer

Amazon FSx for Windows File Server with encryption

Question 3

A DevOps engineer needs to ensure that an S3 bucket policy enforces encryption in transit for all access. Which policy statement should be added?

Accepted Answer

{"Effect":"Deny","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. To enforce encryption in transit, use a condition that denies access unless the request uses 'aws:SecureTransport' set to 'true'. This requires a Deny effect with the condition.

Answer

{"Effect":"Deny","Condition":{"StringEquals":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Condition":{"Bool":{"aws:SecureTransport":"false"}}}

Answer

{"Effect":"Allow","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 4

A company wants to centrally manage user access to multiple AWS accounts using federated identity. Which AWS service should be used to create a single sign-on (SSO) solution?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is purpose-built to centrally manage user access and permissions across multiple AWS accounts and applications from a single place. It allows you to create or connect your existing identity source (e.g., Active Directory, Okta, Azure AD) and then define fine-grained permission sets that map users or groups to specific roles in each account, enabling a true single sign-on (SSO) experience without needing to create IAM users in every account.

Answer

AWS Organizations

Answer

AWS Directory Service for Microsoft Active Directory

Answer

Amazon Cognito

Question 5

A DevOps team uses AWS CodePipeline to deploy a web application. Security scanning must be integrated into the pipeline to check for vulnerabilities before deployment to production. Which action should be taken?

Accepted Answer

Add an Amazon Inspector scan action as a test stage in the pipeline. Amazon Inspector can be integrated as a test action in CodePipeline to scan for vulnerabilities. GuardDuty is a threat detection service, not a scanning tool for code or containers. Config evaluates resource configurations. Trusted Advisor provides best practice checks, not vulnerability scanning.

Answer

Enable AWS GuardDuty in the account

Answer

Activate AWS Trusted Advisor for security checks

Answer

Use AWS Config rules to check for vulnerabilities

Question 6

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that all encryption keys be rotated automatically every 365 days. Which type of KMS key should be used?

Accepted Answer

Customer managed key (CMK). AWS managed keys (aws/s3) are automatically rotated every year (365 days). Customer managed keys allow you to set a custom rotation period (any length between 90 days and 10 years) but require enabling rotation. The key is that aws/s3 keys rotate automatically without any configuration. However, the question says 'all encryption keys' and 'every 365 days' - both options can achieve that, but aws/s3 keys are automatically rotated, while customer managed keys need rotation enabled. The best practice is to use the most appropriate. But note: customer managed keys can be rotated automatically if you enable it. The question might be ambiguous, but typical exam scenario: use customer managed keys for more control. However, the security team requires automatic rotation; both can do it. The nuance: customer managed keys have a rotation period that you can set, but the default is 365 days when you enable rotation. So both work. But the question says 'which type' - likely they want customer managed because it allows you to control the policy. However, aws/s3 keys are automatically rotated and cannot be customized. Since the requirement is 'every 365 days', which is the default for both, but aws/s3 keys are already rotated on that schedule. I think the answer is 'Customer managed key' because it's a key you own and have control over the rotation policy. Actually, aws/s3 keys are rotated annually, but you cannot view or manage them. For compliance, you might need to control the key. So I'll go with customer managed key.

Answer

AWS owned key

Answer

Custom key store backed by CloudHSM

Answer

AWS managed key (aws/s3)

Question 7

An application running on EC2 needs to access an S3 bucket. To follow the principle of least privilege, what is the recommended approach?

Accepted Answer

Create an IAM role with a policy allowing only necessary S3 actions and attach it to the EC2 instance. The best practice is to create an IAM role with a policy that grants only the required S3 actions and attach the role to the EC2 instance. This avoids using long-term credentials. Access keys are long-term and insecure. Bucket policy can be used but is not the most secure for instance access. Security group is for network access, not API access.

Answer

Store AWS access keys in the application configuration

Answer

Use an S3 bucket policy to allow access from the EC2 instance's public IP

Answer

Configure the EC2 security group to allow outbound access to S3

Question 8

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are tamper-proof and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and digital signing to ensure logs have not been tampered with. S3 object lock prevents deletion but not modification. MFA delete protects deletion but not modification. SSE encrypts data at rest but does not protect integrity.

Answer

Server-side encryption (SSE-S3)

Answer

S3 Object Lock

Answer

MFA delete on the S3 bucket

Question 9

A DevOps engineer is troubleshooting a failed AWS CodeBuild project. The build fails with an error indicating that the IAM role does not have permission to describe Amazon ECR repositories. The role used by CodeBuild has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage"],"Resource":"*"}]}. What is the missing permission?

Accepted Answer

ecr:DescribeRepositories. The policy allows several ECR actions but does not include 'ecr:DescribeRepositories'. The error specifically mentions 'describe' which is that action. The other actions are present.

Answer

ecr:InitiateLayerUpload

Answer

ecr:GetRepositoryPolicy

Answer

ecr:ListImages

Question 10

A company wants to automatically detect and respond to suspicious activity in their AWS account. Which service should be used to generate alerts based on threat intelligence?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using threat intelligence. Inspector is for vulnerability scanning. Config is for resource configuration. CloudWatch is for monitoring metrics and logs but does not have built-in threat intelligence.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon CloudWatch

Question 11

A company needs to audit all changes to IAM policies in their AWS account. Which services can be used to track and log these changes? (Select TWO.)

Accepted Answer

AWS Config. AWS CloudTrail logs API calls, including IAM policy changes. AWS Config can track configuration changes to IAM resources. CloudWatch Logs stores logs but does not track changes itself. GuardDuty is for threat detection. S3 is storage.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 12

A security team wants to enforce that all Amazon S3 buckets in the organization are encrypted at rest. Which actions can achieve this? (Select THREE.)

Accepted Answer

Configure an AWS Config rule to detect unencrypted buckets and trigger remediation. You can create an SCP to deny creation of buckets without encryption, use a Config rule to detect noncompliant buckets, and use a bucket policy to deny PutObject without encryption headers. S3 Block Public Access is for preventing public access, not encryption. Cross-Region Replication does not enforce encryption.

Answer

Enable S3 Block Public Access at the account level

Answer

Set up Cross-Region Replication for all buckets

Question 13

Which AWS services can be used to protect a web application from common web exploits like SQL injection and cross-site scripting? (Select TWO.)

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that filters malicious requests. CloudFront can be integrated with WAF to provide protection at the edge. Shield Advanced provides DDoS protection, not application-layer exploits. Cognito is for authentication. Inspector is for vulnerability scanning.

Answer

AWS Shield Advanced

Answer

Amazon Inspector

Answer

Amazon Cognito

Question 14

A DevOps engineer created the IAM policy shown in the exhibit and attached it to a user. The user tries to upload an object to my-bucket without specifying the ACL. Why does the upload fail?

Accepted Answer

The policy condition requires the ACL to be bucket-owner-full-control, but the user did not specify it. The policy condition requires the ACL to be 'bucket-owner-full-control'. If the user does not specify an ACL, the default is usually 'private', which does not satisfy the condition. Therefore the action is denied. The resource ARN is correct. The action is allowed. The condition specifies StringEquals, which is correct for comparison.

Answer

The Effect should be Deny for this policy to work

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket

Answer

The user does not have permission to list the bucket

Question 15

A DevOps engineer executed the CLI command shown in the exhibit. After creation, the security team requires that the log files be encrypted with a KMS key that is rotated every 90 days. The current key is a customer managed key with automatic rotation enabled set to 365 days. What should the engineer do to meet the requirement?

Accepted Answer

Create a new KMS key with automatic rotation set to 90 days and update the trail with the new key. To change the KMS key or its rotation period, you must update the trail. You can specify a new key with the --kms-key-id parameter when updating the trail. Changing the key rotation period is done through KMS, not CloudTrail. But the question is about meeting the 90-day rotation. The engineer should update the trail to use a different KMS key that has a rotation period of 90 days. Note: You cannot change the rotation period of an existing KMS key; you must create a new one. However, the options: B is correct because you can update the trail to use a new key with the desired rotation. A is wrong because you cannot change rotation period of existing key; you create a new key. C is wrong because the key is already used; you can't modify its rotation period. D is wrong because disabling rotation is opposite.

Answer

Use the existing key and change the rotation period in KMS

Answer

Disable automatic rotation and manually rotate the key every 90 days

Answer

Modify the KMS key to set the rotation period to 90 days

DOP-C02 Security and Compliance Practice Test 7 — 15 Questions

Exhibit

DOP-C02 Security and Compliance Practice Test 7 — 15 Questions

Exhibit