DOP-C02 Security and Compliance Practice Test 8 — 15 Questions

Question 1

A company uses AWS Secrets Manager to store database credentials. The security team requires that secrets be automatically rotated every 30 days. Which rotation strategy should the engineer configure to meet this requirement with minimal operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable automatic rotation using the pre-built Lambda rotation function for the database type.. Secrets Manager can automatically rotate secrets using a Lambda function. The easiest way is to use the pre-built Lambda rotation function for the specific database type (e.g., Amazon RDS). Creating a custom Lambda function is more overhead. Manually rotating via CLI defeats automation. Using Systems Manager Parameter Store with SecureString does not provide built-in rotation.

Answer

Manually rotate the secret every 30 days using the AWS CLI.

Answer

Store the secret in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Enable automatic rotation with a custom Lambda function.

Question 2

A company is deploying a multi-tier application on AWS. The web tier must be publicly accessible, but the application tier must only be accessible from the web tier. The database tier should not be accessible from the internet at all. Which combination of security groups and network ACLs should be used?

Accepted Answer

Use security groups: allow 0.0.0.0/0 on port 80/443 to web tier, allow web tier security group to app tier, allow app tier security group to database tier.. Security groups are stateful and default to deny all inbound. By allowing inbound on port 80/443 from 0.0.0.0/0 to the web tier, and allowing inbound from the web tier's security group to the app tier, and only allowing inbound from the app tier to the database tier, you achieve the required isolation. Network ACLs are stateless and not needed if security groups are properly configured.

Answer

Use security groups: allow 0.0.0.0/0 on all ports to web tier, allow all traffic between all instances.

Answer

Place all instances in the same security group with inbound rules allowing only ports 80/443 from 0.0.0.0/0.

Answer

Use network ACLs: allow 0.0.0.0/0 on port 80/443 to web subnet, allow web subnet to app subnet, allow app subnet to database subnet.

Question 3

A DevOps engineer needs to encrypt data in transit between an Application Load Balancer (ALB) and backend EC2 instances. The application uses HTTPS. What is the simplest way to achieve this encryption?

Accepted Answer

Configure the ALB listener to use HTTPS, and configure the target group to use HTTPS with a self-signed certificate on the instances.. An ALB can terminate HTTPS at the listener and then communicate with backend instances using HTTP if desired. However, to encrypt in transit, you can use HTTPS between ALB and instances as well. The simplest way is to install the same certificate on both ALB and instances, but ALB can use a self-signed certificate. Using an internal CA or ACM Private CA is more complex. Using a TCP listener does not provide encryption.

Answer

Use an AWS Private Certificate Authority to issue certificates for the instances.

Answer

Use a Network Load Balancer instead with TLS listeners.

Answer

Place both ALB and instances in a VPC with default security groups.

Question 4

A company wants to ensure that all S3 buckets are encrypted at rest by default. Which S3 feature should be enabled at the bucket level to automatically encrypt new objects?

Accepted Answer

Default encryption. S3 default encryption allows you to set a default encryption behavior for a bucket, so that all new objects are encrypted at rest automatically. Bucket policies can enforce encryption but do not automatically encrypt. Object lock is for retention. Versioning is for object versions.

Answer

S3 Object Lock

Answer

Bucket policy with a Deny for unencrypted uploads

Answer

S3 Versioning

Question 5

A company uses Amazon Inspector to scan EC2 instances for vulnerabilities. The security team discovers that a critical vulnerability is present on an instance, but the instance is part of an Auto Scaling group. What is the MOST efficient way to remediate this vulnerability while ensuring the Auto Scaling group remains operational?

Accepted Answer

Create a new AMI with the patch, update the Auto Scaling group's launch template, and terminate instances one by one to trigger replacement.. The most efficient way is to create a new Amazon Machine Image (AMI) with the vulnerability patched, update the Auto Scaling group's launch configuration/template to use the new AMI, and then perform a rolling update (e.g., by terminating instances one by one). Manually patching each instance is inefficient because Auto Scaling will launch new instances from the old AMI. Using AWS Systems Manager Patch Manager can patch on the fly but does not update the launch template for future instances. Isolating the instance does not fix the root cause.

Answer

Patch the instance manually via SSH, then create a new AMI from it and update the launch configuration.

Answer

Detach the instance from the Auto Scaling group, patch it, and reattach it.

Answer

Use AWS Systems Manager Patch Manager to patch the instance and then set the instance to not receive future updates.

Question 6

Which TWO actions should a DevOps engineer take to prevent an S3 bucket from being publicly accessible? (Choose two.)

Accepted Answer

Enable S3 Block Public Access at the bucket level.. Enabling S3 Block Public Access at the bucket level provides a centralized, override-proof mechanism to prevent any public access to the bucket, regardless of other policies or ACLs. This setting blocks all public access by default, including access granted via bucket policies, access control lists (ACLs), or object-level permissions, and cannot be overridden by any other S3 configuration.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable S3 Server Access Logging.

Answer

Configure a lifecycle policy to delete objects.

Question 7

Which THREE of the following are best practices for managing IAM roles in AWS Organizations? (Choose three.)

Accepted Answer

Use service control policies (SCPs) to set permission boundaries.. Using IAM roles to delegate access across accounts is a best practice. Creating roles with least privilege and using service control policies (SCPs) to enforce permission boundaries are also best practices. Sharing root user credentials is never a best practice. Using a single IAM user across accounts is not recommended.

Answer

Share the root user credentials of the master account with administrators.

Answer

Use a single IAM user with full permissions across all accounts.

Question 8

Which TWO AWS services can be used to monitor for unauthorized API calls in an AWS account? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls and can be used to monitor for unauthorized activity. AWS Config evaluates resource configurations against rules. GuardDuty provides intelligent threat detection using CloudTrail logs, VPC Flow Logs, and DNS logs. CloudWatch Logs can store logs but does not directly monitor for unauthorized calls. S3 is for storage.

Answer

AWS Config

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Question 9

Which THREE of the following are valid methods to enforce encryption at rest for Amazon EBS volumes? (Choose three.)

Accepted Answer

Enable EBS encryption by default in the account.. Enabling EBS encryption by default at the account level ensures all new volumes are encrypted. You can also encrypt volumes when creating them via the console or CLI. You cannot encrypt an existing volume directly; you must create a snapshot, copy it with encryption, and create a new volume. Attaching a volume does not encrypt it.

Answer

Use the AWS CLI to encrypt an existing volume in place.

Answer

Attach the volume to an EC2 instance and use OS-level encryption.

Question 10

Which TWO of the following are benefits of using AWS Certificate Manager (ACM) to manage SSL/TLS certificates? (Choose two.)

Accepted Answer

Automatic renewal of certificates.. ACM automatically renews certificates before expiry, reducing manual overhead. It integrates with AWS services like ALB and CloudFront for easy deployment. ACM can export certificates for use on EC2 instances, but that is not a primary benefit; the main benefits are automatic renewal and integration.

Answer

Ability to use the same certificate on multiple EC2 instances.

Answer

Support for wildcard certificates only.

Answer

Free certificates for use on any AWS service.

Question 11

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an RDS MySQL database. The security team requires that all traffic between the application and the database be encrypted in transit. Currently, the database security group allows inbound traffic from the ECS tasks' security group on port 3306 (MySQL). The application uses the standard MySQL client connection without SSL. After enabling SSL on the RDS instance, the application starts failing to connect. The error logs show 'SSL connection error: protocol version mismatch'. The application runs on a custom Docker image based on Amazon Linux 2. The DevOps engineer needs to fix the connection issue. Which course of action should the engineer take?

Accepted Answer

Update the Docker image to include the latest MySQL client libraries that support TLS 1.2.. The error indicates that the MySQL client in the container does not support the TLS version required by RDS. The simplest solution is to modify the application connection string to use the '--ssl-mode=REQUIRED' flag or equivalent, but the error persists even after that. The actual fix is to update the MySQL client libraries in the container image to a version that supports TLS 1.2, as RDS requires TLS 1.2 or higher. Alternatively, the engineer can configure RDS to accept TLS 1.0, but that is not secure. Changing the security group or using SSH tunneling does not address the TLS version mismatch.

Answer

Update the application code to connect using SSL with the --ssl-mode=REQUIRED flag.

Answer

Modify the RDS parameter group to allow TLS 1.0 and 1.1.

Answer

Create a VPC peering connection and route traffic through a VPN.

Question 12

A company uses AWS Lambda functions to process sensitive data from an SQS queue. The Lambda function writes results to an S3 bucket. The security team requires that all data at rest in S3 be encrypted with a customer managed KMS key, and that the Lambda function only have access to decrypt the queue messages and encrypt the S3 objects. An IAM role is attached to the Lambda function. The engineer has configured the KMS key policy to allow the Lambda role to use the key. However, the Lambda function fails to write to S3 with a 'KMS access denied' error. The engineer verified that the S3 bucket has default encryption enabled with the same KMS key. Which additional step is most likely required?

Accepted Answer

Add an inline policy to the Lambda role that allows kms:GenerateDataKey and kms:Encrypt actions for the KMS key.. Even if the S3 bucket has default encryption, the Lambda function needs kms:GenerateDataKey permission (or kms:Encrypt) in its IAM role to encrypt objects when writing. The key policy allows the role, but the role's permissions policy must also include the necessary KMS actions. The error indicates that the role lacks the appropriate KMS action.

Answer

Disable default encryption on the S3 bucket and configure the Lambda to use SSE-S3.

Answer

Grant the Lambda role s3:PutObject permission on the bucket.

Answer

Modify the KMS key policy to allow the Lambda role to use the key without any conditions.

Question 13

A startup wants to provide temporary, limited-privilege AWS access to external contractors who will assist with a project. The contractors do not have AWS accounts. The company wants to avoid creating IAM users for each contractor. They need a solution that allows contractors to log in to the AWS Management Console for a limited time. Which AWS service should the engineer use?

Accepted Answer

Use AWS SSO with an external identity provider, and grant access to an AWS account with a permission set.. AWS SSO can be used to grant external users access to AWS accounts via a portal, with temporary credentials. You can invite users as external members in AWS SSO, and they can log in with their own email and receive temporary credentials. IAM roles cannot be directly assumed without AWS credentials. Cognito is for app users. IAM users would require creating permanent users.

Answer

Create IAM users for each contractor and attach a policy with a condition to expire access after the project.

Answer

Use Amazon Cognito user pools to create temporary user accounts.

Answer

Provide the contractors with the root user credentials of a separate AWS account.

Question 14

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). The application uses HTTPS. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. The instances currently use a self-signed certificate for the backend HTTPS listener. The engineer notices that the ALB health checks are failing, and the error message indicates 'TLS handshake failed'. The health check is configured as HTTPS. What should the engineer do to resolve the health check failure while maintaining encryption?

Accepted Answer

Change the health check to use HTTP on port 80 and allow HTTP traffic from the ALB to the instances.. The ALB health check fails because the self-signed certificate on the instances is not trusted by the ALB. ACM certificates cannot be installed on EC2 instances, so option A is not feasible. The simplest solution is to change the health check protocol to HTTP (option B), which avoids the TLS handshake entirely. This maintains encryption for the actual application traffic (HTTPS between ALB and instances) while allowing health checks to succeed. Option C is not a valid configuration; there is no 'ignore certificate' option for ALB health checks. Option D is not recommended as health checks provide essential monitoring.

Answer

Install a valid certificate from AWS Certificate Manager (ACM) on each EC2 instance and configure the ALB target group to use HTTPS with that certificate.

Answer

Configure the ALB to ignore certificate verification for health checks by setting the health check protocol to HTTPS and enabling 'ignore certificate' option.

Answer

Disable health checks on the ALB and rely on CloudWatch alarms to detect instance failures.

Question 15

A company wants to enable AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team requires that logs be encrypted at rest and that any unauthorized deletion of log files be prevented. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create a trail in the management account that applies to all accounts in the organization.. Enabling CloudTrail for all accounts in the organization ensures centralized logging. Option D is correct because S3 Object Lock prevents deletion of log files. Option B is incorrect because KMS with a customer managed key provides encryption, but the key must be created beforehand, not just enabled. Option C is incorrect because CloudWatch Logs encryption uses KMS, not S3 SSE. Option E is incorrect because CloudTrail can be configured to log management events by default, and this is not about data events.

Answer

Enable default encryption with SSE-S3 on the S3 bucket where CloudTrail delivers logs.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and enable encryption using an AWS KMS key.

Answer

Enable CloudTrail Insights to detect unusual API activity.