DOP-C02 Security and Compliance Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. This S3 bucket policy allows the root user of account 111122223333 to perform which actions?

Accepted Answer

Read and write objects in the bucket. The policy grants s3:GetObject and s3:PutObject to the root user of the specified account. It does not grant other actions. The resource is objects under my-bucket. The principal is the root user of the other account.

Answer

Change the bucket policy

Answer

Delete objects from the bucket

Answer

List objects in the bucket

Question 2

A company uses AWS CodePipeline to deploy a web application. The deployment includes an EC2 instance running behind an Application Load Balancer. The security team requires that all data in transit to the application be encrypted. Which configuration best meets this requirement without breaking the deployment?

Accepted Answer

Create an HTTPS listener on the ALB with a certificate from AWS Certificate Manager and redirect HTTP to HTTPS.. Option C is correct because the Application Load Balancer supports SSL/TLS termination using certificates from AWS Certificate Manager, enabling HTTPS encryption. Option A is wrong because CodePipeline does not encrypt traffic at the ALB level. Option B is wrong because AWS WAF is a web application firewall, not for encryption. Option D is wrong because CloudFront can handle HTTPS, but adding it changes the architecture unnecessarily and may break the pipeline if not properly configured.

Answer

Configure CodePipeline to use an encrypted artifact bucket.

Answer

Enable AWS WAF on the ALB to enforce HTTPS.

Answer

Place a CloudFront distribution in front of the ALB and configure it to require HTTPS.

Question 3

A DevOps engineer is configuring AWS Config to detect changes to security group rules. The engineer wants to receive near-real-time notifications when a security group rule that allows inbound SSH traffic is created. Which combination of services and configurations should the engineer use? (Choose the best answer.)

Accepted Answer

Create an AWS Config rule to evaluate security groups, and configure an Amazon EventBridge rule to match 'Config Rules Compliance Change' events and trigger an SNS topic.. Option B is correct because AWS Config uses managed rules (like restricted-ssh) and can stream configuration changes to CloudWatch Events (now Amazon EventBridge), which triggers a Lambda function to send SNS notifications. Option A is wrong because AWS Config does not directly send to SNS without an intermediary. Option C is wrong because GuardDuty focuses on threats, not configuration changes. Option D is wrong because CloudTrail logs API calls but not configuration state changes directly; using Config is more appropriate.

Answer

Enable Amazon GuardDuty and create a custom threat list for SSH access.

Answer

Use AWS CloudTrail to monitor CreateSecurityGroup API calls and send events to CloudWatch Logs.

Answer

Set up AWS Config to send configuration change notifications directly to an SNS topic.

Question 4

A company has a security policy requiring that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. The DevOps engineer needs to enforce this policy. What is the simplest way to achieve this?

Accepted Answer

Create an IAM policy that denies all actions unless MFA is present, and attach it to all IAM users or groups.. Option A is correct because an IAM policy with a condition for aws:MultiFactorAuthPresent: true can be attached to a group or user to deny access if MFA is not used. Option B is wrong because MFA cannot be enforced at the resource level for S3. Option C is wrong because it only applies to root user, not IAM users. Option D is wrong because Cognito is for application users, not AWS console access.

Answer

Use Amazon Cognito to require MFA for console access.

Answer

Enable MFA delete on the root account.

Answer

Enable MFA on the S3 bucket policy.

Question 5

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail logs. What is the most effective way to enforce this control?

Accepted Answer

Apply a Service Control Policy that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging.. Option D is correct because a Service Control Policy (SCP) can deny actions like cloudtrail:DeleteTrail and cloudtrail:StopLogging across all accounts in the organization. Option A is wrong because CloudTrail is a regional service, and disabling in one region would still affect logs. Option B is wrong because IAM policies are per-account and can be overridden by account admins. Option C is wrong because limiting to one trail is not a control; accounts could still modify that trail.

Answer

Require all accounts to use the same CloudTrail trail.

Answer

Create an IAM policy in each account that denies cloudtrail:DeleteTrail.

Answer

Configure CloudTrail to log to an S3 bucket in a centralized logging account and deny access to the bucket from member accounts.

Question 6

A DevOps engineer is designing an AWS Lambda function that needs to read secrets from AWS Secrets Manager. What is the most secure way to provide the Lambda function access to the secret?

Accepted Answer

Assign an IAM execution role to the Lambda function with a policy that allows secretsmanager:GetSecretValue on the specific secret.. Option B is correct because the Lambda execution role should have an IAM policy with permissions to access the specific secret. Option A is wrong because hardcoding secrets is insecure. Option C is wrong because SSM Parameter Store is separate; if using Secrets Manager, permissions should be on that service. Option D is wrong because environment variables are not encrypted by default and are visible in the console.

Answer

Store the secret in AWS Systems Manager Parameter Store and grant the Lambda function access to the parameter.

Answer

Encrypt the secret using AWS KMS and pass the encrypted value as an environment variable.

Answer

Store the secret in an environment variable in the Lambda function.

Question 7

A company uses AWS CodeBuild to build and test code. The security team requires that all build artifacts be encrypted at rest. Which action should the DevOps engineer take to meet this requirement?

Accepted Answer

Enable default encryption on the S3 bucket used for CodeBuild artifacts.. Option A is correct because CodeBuild stores artifacts in an S3 bucket; enabling default encryption on that bucket ensures all objects are encrypted. Option B is wrong because CodeBuild artifacts are stored in S3, not EBS. Option C is wrong because the artifact bucket is managed by the customer. Option D is wrong although it could work, but enabling default encryption on the bucket is simpler and more direct.

Answer

Create a customer-managed KMS key and specify it in the CodeBuild project's artifacts encryption settings.

Answer

Use an S3 bucket policy to deny write operations unless the request includes the x-amz-server-side-encryption header.

Answer

Configure the CodeBuild project to use an encrypted EBS volume for the build environment.

Question 8

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that any changes to IAM roles must be reviewed and approved by a security engineer before deployment. The DevOps engineer needs to implement a gating mechanism. Which approach should the engineer use?

Accepted Answer

Create a CodePipeline that deploys CloudFormation stacks and include a manual approval step for changes that modify IAM resources.. Option B is correct because CloudFormation StackSets with approval gates in CodePipeline allow manual approval steps before applying updates. Option A is wrong because AWS Config detects changes but does not prevent them. Option C is wrong because IAM policy conditions cannot prevent CloudFormation from creating roles. Option D is wrong because service control policies affect all actions, not just IAM changes, and are too broad.

Answer

Use AWS Config to detect changes to IAM roles and trigger a Lambda function that reverts the change.

Answer

Apply a service control policy that denies iam:CreateRole and iam:UpdateAssumeRolePolicy across the organization.

Answer

Add a condition to the IAM policy that requires MFA for any CloudFormation action.

Question 9

A company is using Amazon S3 to store sensitive data. The security team mandates that all data must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS). The DevOps engineer must ensure that any new objects uploaded to the bucket are automatically encrypted. What should the engineer do?

Accepted Answer

Enable default encryption on the S3 bucket and select AWS-KMS as the encryption method.. Option A is correct because enabling default encryption on the S3 bucket with SSE-KMS ensures all objects are encrypted with KMS. Option B is wrong because bucket policies only enforce encryption headers, not default encryption, and can be bypassed. Option C is wrong because CORS is for cross-origin requests. Option D is wrong because versioning does not encrypt data.

Answer

Enable CORS on the bucket to allow encrypted uploads.

Answer

Apply a bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header with aws:kms.

Answer

Enable S3 Versioning to protect encrypted objects.

Question 10

A DevOps engineer needs to grant cross-account access to an S3 bucket in Account A for users in Account B. The users in Account B must be able to list objects and read them. What is the most secure way to configure this access?

Accepted Answer

Create a bucket policy in Account A granting access to the root user of Account B, and create an IAM policy in Account B allowing the users to access the bucket.. Option C is correct because it combines a bucket policy in Account A granting access to Account B's root or specific ARN, and an IAM policy in Account B allowing users to access that bucket. Option A is wrong because a bucket policy alone is insufficient; Account B users also need IAM permissions. Option B is wrong because an IAM role in Account A with a trust policy from Account B is a common pattern, but the question specifies users in Account B, so the role approach works but requires users to assume the role; option C is more direct for S3 access. Option D is wrong because KMS is for encryption, not access control.

Answer

Create a bucket policy in Account A that grants access to the IAM user ARNs from Account B.

Answer

Create a KMS key in Account A and share it with Account B to decrypt objects.

Answer

Create an IAM role in Account A with trust policy allowing Account B to assume it, and attach a policy granting S3 access.

Question 11

A company is using AWS Lambda to process sensitive data. The security team requires that the Lambda function only be invoked from within a specific VPC and that the function's environment variables be encrypted at rest. Which TWO actions should the DevOps engineer take to meet these requirements?

Accepted Answer

Enable AWS KMS encryption for the Lambda function's environment variables using a customer-managed key.. Option A is correct because configuring the Lambda function to access a VPC and using a VPC endpoint for Lambda ensures invocation only from within the VPC. Option D is correct because using AWS KMS to encrypt environment variables meets the encryption requirement. Option B is wrong because resource-based policies control which principals can invoke, but cannot restrict to VPC origin alone. Option C is wrong because CloudWatch Logs encryption is separate from environment variables. Option E is wrong because execution role permissions do not encrypt environment variables.

Answer

Enable encryption for CloudWatch Logs using a KMS key.

Answer

Assign an IAM execution role with permissions to access a KMS key.

Answer

Attach a resource-based policy to the Lambda function that denies invoke unless the request comes from the VPC.

Question 12

A company is using AWS Secrets Manager to rotate database credentials automatically. The DevOps engineer needs to ensure that the rotation process is secure and does not cause downtime. Which THREE steps should the engineer take?

Accepted Answer

Set up CloudWatch alarms to monitor rotation failures.. Option A is correct because the Lambda rotation function needs permissions to read and update the secret. Option C is correct because using a separate user for rotation allows the old credentials to remain valid during rotation. Option E is correct because CloudWatch alarms can detect rotation failures. Option B is wrong because the rotation function should have network access to the database, but using a VPC endpoint is not required; the function can be in a VPC. Option D is wrong because disabling rotation for old secrets would break the rotation process.

Answer

Disable automatic rotation for the old secret version.

Answer

Configure the Lambda rotation function to use a VPC endpoint for Secrets Manager.

Question 13

A DevOps engineer is tasked with auditing all AWS API calls made in the account for compliance purposes. The engineer needs to ensure that the audit logs are tamper-proof and stored cost-effectively. Which TWO services should the engineer use?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail logs API calls and can be configured to deliver to S3. Option D is correct because S3 with object lock prevents log tampering. Option A is wrong because CloudWatch Logs is for application logs, not API calls. Option C is wrong because Config records resource changes, not API calls. Option E is wrong because KMS encrypts but does not provide tamper-proof storage; object lock does.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS KMS

Question 14

Refer to the exhibit. An IAM policy is attached to an IAM user. Which of the following actions will be allowed by this policy?

Accepted Answer

DescribeInstances on an instance in us-east-1. Option B is correct because the Deny statement only denies ec2 actions on instances when the requested region is NOT us-east-1. Since DescribeInstances is allowed by the first statement and the Deny does not apply to DescribeInstances (action is ec2:*, but the condition only denies if region is not us-east-1, and if the request is for us-east-1, the condition is false, so the Deny does not apply. However, note that the Deny statement denies all ec2 actions (including DescribeInstances) on instances when the condition is met. But if the request is for us-east-1, the condition is false, so no Deny, so DescribeInstances in us-east-1 is allowed. Option A is wrong because StopInstances is an ec2 action on an instance, and if the region is us-east-1, the condition is false, so the Deny does not apply, but the Allow statement only allows DescribeInstances, not StopInstances. Since there is no explicit Allow for StopInstances, it is implicitly denied. Option C is wrong because if the region is us-west-2, the condition is true, so the Deny applies to all ec2 actions on instances, including DescribeInstances, so it is denied. Option D is wrong because although the Deny would apply to StartInstances if region is not us-east-1, but if region is us-east-1, the Deny does not apply, but there is no Allow for StartInstances, so it is implicitly denied.

Answer

StartInstances on an instance in us-east-1

Answer

DescribeInstances on an instance in us-west-2

Answer

StopInstances on an instance in us-east-1

Question 15

A company has a multi-account AWS environment managed by AWS Organizations. The DevOps team uses AWS CloudFormation StackSets to deploy a standard VPC across all member accounts. The security team has noticed that in some accounts, the VPC is being modified after deployment, allowing inbound SSH access from the internet. The team wants to automatically detect and remediate these changes. The current setup includes: AWS Config enabled in all accounts with a rule that checks for unrestricted SSH access; an SNS topic in the management account that receives compliance change notifications; and a Lambda function in the management account that can remediate by updating the security group rules. However, the remediation is not working consistently. What is the most likely reason, and what is the best solution?

Accepted Answer

The Lambda function's IAM role does not have permissions to modify security groups in member accounts.. Option C is correct because AWS Config rules in member accounts cannot directly trigger cross-account remediation via SNS unless the Lambda function has permission to modify resources in those accounts. The most likely issue is that the Lambda function's IAM role does not have permissions to modify security groups in member accounts. The best solution is to use AWS Config conformance packs with remediation actions that are deployed to each member account, which can then execute remediation locally. Option A is wrong because the Config rule itself is working (it detects changes). Option B is wrong because the SNS topic is receiving notifications, but the Lambda function's role lacks cross-account permissions. Option D is wrong because StackSets are for initial deployment, not for ongoing compliance.

Answer

The AWS Config rule is not evaluating correctly in member accounts.

Answer

The SNS topic is not delivering messages to the Lambda function due to cross-account access issues.

Answer

CloudFormation StackSets is overriding the changes, causing a race condition.

DOP-C02 Security and Compliance Practice Test 8 — 15 Questions

Exhibit

DOP-C02 Security and Compliance Practice Test 8 — 15 Questions

Exhibit