DOP-C02 Security and Compliance Practice Test 9 — 15 Questions

Question 1

A company is using AWS Secrets Manager to store database credentials for a multi-tier application. The application runs on EC2 instances in an Auto Scaling group. The DevOps engineer has configured the instances to retrieve the secret at boot time using a script that calls the AWS CLI. Recently, the security team discovered that the secret was exposed in the instance's user data logs. The engineer needs to implement a more secure method to access the secret without storing it in user data. The application code can be modified. The environment uses IAM roles for EC2. Which solution best meets the security requirements?

Accepted Answer

Modify the application code to use the AWS SDK to retrieve the secret from Secrets Manager using the instance's IAM role.. Option B is correct because using the AWS SDK with the IAM role attached to the EC2 instance retrieves the secret programmatically without storing it in user data. The IAM role should have permissions to access the secret. Option A is wrong because hardcoding still stores the secret in the code or configuration. Option C is wrong because the EC2 Systems Manager Parameter Store is another option but the question is about Secrets Manager, and storing the secret in Parameter Store still requires retrieval at runtime; the same pattern applies, but using the SDK with IAM role is the standard secure method. Option D is wrong because the KMS key is used for encryption, not for retrieving the secret; the secret is already encrypted.

Answer

Store the secret in a configuration file on the EC2 instance and encrypt the file system.

Answer

Store the secret in AWS Systems Manager Parameter Store and retrieve it via the AWS CLI at boot time.

Answer

Use a KMS key to encrypt the secret and store the encrypted value in user data.

Question 2

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which KMS key type should the company use to meet this requirement without manual intervention?

Accepted Answer

Customer managed key. AWS managed keys (AWS managed key) are automatically rotated every three years, not every year. Customer managed keys (Customer managed key) can be configured for automatic annual rotation. Imported key material cannot be automatically rotated. A Custom key store does not support automatic rotation.

Answer

Imported key material

Answer

Custom key store (CloudHSM)

Answer

AWS managed key

Question 3

A DevOps engineer needs to grant an IAM user temporary access to an S3 bucket for exactly one hour. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is used to generate temporary, limited-privilege credentials for IAM users or federated users. IAM roles provide temporary credentials but are assumed, not generated for a specific user. Cognito is for identity federation with mobile/web apps. SSO provides single sign-on access.

Answer

Amazon Cognito

Answer

AWS SSO

Answer

AWS IAM

Question 4

Refer to the exhibit. An IAM policy is attached to a user. The user requests an object from the 'example-bucket' bucket, specifically from the 'confidential' folder, over HTTP (not HTTPS). The source IP is within the 10.0.0.0/24 range. What will be the result of this request?

Accepted Answer

Denied, because the request uses HTTP and the Deny statement blocks it.. The Deny statement with SecureTransport false applies to all s3 actions on the confidential folder. Even though the source IP is allowed, the Deny for HTTP access will override the Allow. The request will be denied.

Answer

Denied, because the user does not have s3:GetObject permission on the confidential folder.

Answer

Allowed, because the Deny statement only applies to HTTPS.

Answer

Allowed, because the source IP is within the allowed range.

Question 5

A company uses AWS Secrets Manager to store database credentials. The security team requires that secrets be automatically rotated every 30 days. Which rotation strategy should the engineer configure to meet this requirement with minimal operational overhead?

Accepted Answer

Enable automatic rotation using the pre-built Lambda rotation function for the database type.. Secrets Manager can automatically rotate secrets using a Lambda function. The easiest way is to use the pre-built Lambda rotation function for the specific database type (e.g., Amazon RDS). Creating a custom Lambda function is more overhead. Manually rotating via CLI defeats automation. Using Systems Manager Parameter Store with SecureString does not provide built-in rotation.

Answer

Manually rotate the secret every 30 days using the AWS CLI.

Answer

Store the secret in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Enable automatic rotation with a custom Lambda function.

Question 6

A company is deploying a multi-tier application on AWS. The web tier must be publicly accessible, but the application tier must only be accessible from the web tier. The database tier should not be accessible from the internet at all. Which combination of security groups and network ACLs should be used?

Accepted Answer

Use security groups: allow 0.0.0.0/0 on port 80/443 to web tier, allow web tier security group to app tier, allow app tier security group to database tier.. Security groups are stateful and default to deny all inbound. By allowing inbound on port 80/443 from 0.0.0.0/0 to the web tier, and allowing inbound from the web tier's security group to the app tier, and only allowing inbound from the app tier to the database tier, you achieve the required isolation. Network ACLs are stateless and not needed if security groups are properly configured.

Answer

Use security groups: allow 0.0.0.0/0 on all ports to web tier, allow all traffic between all instances.

Answer

Place all instances in the same security group with inbound rules allowing only ports 80/443 from 0.0.0.0/0.

Answer

Use network ACLs: allow 0.0.0.0/0 on port 80/443 to web subnet, allow web subnet to app subnet, allow app subnet to database subnet.

Question 7

A DevOps engineer needs to encrypt data in transit between an Application Load Balancer (ALB) and backend EC2 instances. The application uses HTTPS. What is the simplest way to achieve this encryption?

Accepted Answer

Configure the ALB listener to use HTTPS, and configure the target group to use HTTPS with a self-signed certificate on the instances.. An ALB can terminate HTTPS at the listener and then communicate with backend instances using HTTP if desired. However, to encrypt in transit, you can use HTTPS between ALB and instances as well. The simplest way is to install the same certificate on both ALB and instances, but ALB can use a self-signed certificate. Using an internal CA or ACM Private CA is more complex. Using a TCP listener does not provide encryption.

Answer

Use an AWS Private Certificate Authority to issue certificates for the instances.

Answer

Use a Network Load Balancer instead with TLS listeners.

Answer

Place both ALB and instances in a VPC with default security groups.

Question 8

A company wants to ensure that all S3 buckets are encrypted at rest by default. Which S3 feature should be enabled at the bucket level to automatically encrypt new objects?

Accepted Answer

Default encryption. S3 default encryption allows you to set a default encryption behavior for a bucket, so that all new objects are encrypted at rest automatically. Bucket policies can enforce encryption but do not automatically encrypt. Object lock is for retention. Versioning is for object versions.

Answer

S3 Object Lock

Answer

Bucket policy with a Deny for unencrypted uploads

Answer

S3 Versioning

Question 9

A company uses Amazon Inspector to scan EC2 instances for vulnerabilities. The security team discovers that a critical vulnerability is present on an instance, but the instance is part of an Auto Scaling group. What is the MOST efficient way to remediate this vulnerability while ensuring the Auto Scaling group remains operational?

Accepted Answer

Create a new AMI with the patch, update the Auto Scaling group's launch template, and terminate instances one by one to trigger replacement.. The most efficient way is to create a new Amazon Machine Image (AMI) with the vulnerability patched, update the Auto Scaling group's launch configuration/template to use the new AMI, and then perform a rolling update (e.g., by terminating instances one by one). Manually patching each instance is inefficient because Auto Scaling will launch new instances from the old AMI. Using AWS Systems Manager Patch Manager can patch on the fly but does not update the launch template for future instances. Isolating the instance does not fix the root cause.

Answer

Patch the instance manually via SSH, then create a new AMI from it and update the launch configuration.

Answer

Detach the instance from the Auto Scaling group, patch it, and reattach it.

Answer

Use AWS Systems Manager Patch Manager to patch the instance and then set the instance to not receive future updates.

Question 10

Which TWO actions should a DevOps engineer take to prevent an S3 bucket from being publicly accessible? (Choose two.)

Accepted Answer

Enable S3 Block Public Access at the bucket level.. Option B is correct because enabling S3 Block Public Access at the bucket level provides a centralized, override-proof mechanism to prevent any public access to the bucket, regardless of other policies or ACLs. This setting blocks all public access by default, including access granted via bucket policies, access control lists (ACLs), or object-level permissions, and cannot be overridden by any other S3 configuration.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable S3 Server Access Logging.

Answer

Configure a lifecycle policy to delete objects.

Question 11

Which THREE of the following are best practices for managing IAM roles in AWS Organizations? (Choose three.)

Accepted Answer

Use service control policies (SCPs) to set permission boundaries.. Using IAM roles to delegate access across accounts is a best practice. Creating roles with least privilege and using service control policies (SCPs) to enforce permission boundaries are also best practices. Sharing root user credentials is never a best practice. Using a single IAM user across accounts is not recommended.

Answer

Share the root user credentials of the master account with administrators.

Answer

Use a single IAM user with full permissions across all accounts.

Question 12

Which TWO AWS services can be used to monitor for unauthorized API calls in an AWS account? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls and can be used to monitor for unauthorized activity. AWS Config evaluates resource configurations against rules. GuardDuty provides intelligent threat detection using CloudTrail logs, VPC Flow Logs, and DNS logs. CloudWatch Logs can store logs but does not directly monitor for unauthorized calls. S3 is for storage.

Answer

AWS Config

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Question 13

Which THREE of the following are valid methods to enforce encryption at rest for Amazon EBS volumes? (Choose three.)

Accepted Answer

Enable EBS encryption by default in the account.. Enabling EBS encryption by default at the account level ensures all new volumes are encrypted. You can also encrypt volumes when creating them via the console or CLI. You cannot encrypt an existing volume directly; you must create a snapshot, copy it with encryption, and create a new volume. Attaching a volume does not encrypt it.

Answer

Use the AWS CLI to encrypt an existing volume in place.

Answer

Attach the volume to an EC2 instance and use OS-level encryption.

Question 14

Which TWO of the following are benefits of using AWS Certificate Manager (ACM) to manage SSL/TLS certificates? (Choose two.)

Accepted Answer

Automatic renewal of certificates.. ACM automatically renews certificates before expiry, reducing manual overhead. It integrates with AWS services like ALB and CloudFront for easy deployment. ACM can export certificates for use on EC2 instances, but that is not a primary benefit; the main benefits are automatic renewal and integration.

Answer

Ability to use the same certificate on multiple EC2 instances.

Answer

Support for wildcard certificates only.

Answer

Free certificates for use on any AWS service.

Question 15

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an RDS MySQL database. The security team requires that all traffic between the application and the database be encrypted in transit. Currently, the database security group allows inbound traffic from the ECS tasks' security group on port 3306 (MySQL). The application uses the standard MySQL client connection without SSL. After enabling SSL on the RDS instance, the application starts failing to connect. The error logs show 'SSL connection error: protocol version mismatch'. The application runs on a custom Docker image based on Amazon Linux 2. The DevOps engineer needs to fix the connection issue. Which course of action should the engineer take?

Accepted Answer

Update the Docker image to include the latest MySQL client libraries that support TLS 1.2.. The error indicates that the MySQL client in the container does not support the TLS version required by RDS. The simplest solution is to modify the application connection string to use the '--ssl-mode=REQUIRED' flag or equivalent, but the error persists even after that. The actual fix is to update the MySQL client libraries in the container image to a version that supports TLS 1.2, as RDS requires TLS 1.2 or higher. Alternatively, the engineer can configure RDS to accept TLS 1.0, but that is not secure. Changing the security group or using SSH tunneling does not address the TLS version mismatch.

Answer

Update the application code to connect using SSL with the --ssl-mode=REQUIRED flag.

Answer

Modify the RDS parameter group to allow TLS 1.0 and 1.1.

Answer

Create a VPC peering connection and route traffic through a VPN.