DOP-C02 Security and Compliance Practice Test 9 — 15 Questions

Question 1

A company uses AWS CodePipeline for CI/CD. The security team requires that all code changes be scanned for secrets before deployment. The pipeline consists of a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team wants to automatically scan for secrets and block the pipeline if any secrets are found. Which THREE actions should the team take? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the build project to fail the build if the scanning tool returns a non-zero exit code.. To automatically scan for secrets and block the pipeline, the team should add a scanning action in the build stage (Option C) using a custom or third-party action that integrates with AWS Marketplace. The build project should be configured to fail the build if the scanning tool returns a non-zero exit code (Option B), which prevents deployment from proceeding. Additionally, the CodeBuild service role needs permissions to retrieve the scanning tool, for example from an S3 bucket (Option E). Option A is incorrect because scanning after deployment does not block the pipeline before deployment. Option D is incorrect because an S3 bucket policy does not directly block the pipeline based on secrets detection.

Answer

Add a scanning action in the deploy stage to scan after deployment.

Answer

Configure an S3 bucket policy to deny access if secrets are detected.

Question 2

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer (ALB). The application uses an RDS MySQL database. The security team performed a penetration test and discovered that the application is vulnerable to SQL injection. The development team has deployed a WAF web ACL to the ALB that includes rules to block SQL injection attacks. However, after the deployment, the application started returning 403 errors for legitimate requests, and the security team needs to investigate. The team also wants to ensure that only approved AWS services can access the RDS database. The current security groups are configured with a rule that allows inbound traffic from the ALB security group to the RDS database on port 3306. Which combination of actions should the security team take to resolve the issue and improve the security posture?

Accepted Answer

Switch the WAF web ACL to count mode while tuning the rules, and implement an IAM policy to restrict database access to specific AWS services using the aws:SourceArn condition key.. The correct answer. Switching the WAF web ACL to count mode allows the security team to monitor requests that would be blocked without actually blocking them, enabling them to fine-tune the rules to eliminate false positives while still protecting against SQL injection. Additionally, implementing an IAM policy with the aws:SourceArn condition key can restrict database access to only approved AWS services, such as Lambda functions or specific EC2 instances, enhancing the security posture beyond just network-level controls. Option A is incorrect because disabling WAF rules would leave the application vulnerable, and network ACLs are stateless and not sufficient for fine-grained access control. Option B is incorrect because relying solely on security groups with VPC CIDR allows broad access and does not address the false positive issue. Option C is incorrect because adding a second ALB is unnecessary and does not solve the false positive problem, and using count mode alone without IAM policy does not address database access restrictions.

Answer

Disable the WAF rules that are causing false positives and add network ACLs to block all traffic to the database except from the ALB.

Answer

Remove the WAF web ACL and rely on security group ingress rules that allow all traffic from the VPC CIDR to the database.

Answer

Switch the WAF web ACL to count mode and add a second ALB in front of the database to filter traffic.

Question 3

A company uses AWS Lambda to process sensitive data stored in Amazon S3. The Lambda function is triggered by S3 object creation events. The security team requires that all data in transit be encrypted using TLS 1.2 or higher. The Lambda function currently uses the AWS SDK to download objects from S3 using HTTP (not HTTPS). The team also needs to ensure that the Lambda function only accesses S3 objects that are encrypted with a specific AWS KMS key. The Lambda execution role already has permissions to decrypt with that KMS key. Which combination of actions should the security team take to meet the requirements?

Accepted Answer

Configure the Lambda function to use HTTPS when calling S3, and add a bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match the specific KMS key.. Configuring the Lambda function to use HTTPS ensures encryption in transit via TLS 1.2, and the bucket policy condition requiring the `x-amz-server-side-encryption-aws-kms-key-id` header enforces that only objects encrypted with the specific KMS key are accessible. Option B is incorrect because while a VPC endpoint is secure, it alone does not enforce TLS 1.2 for the connection from Lambda to S3; the bucket policy can require TLS but does not enforce the specific KMS key. Option C is incorrect because enabling default encryption only encrypts objects at rest, not in transit, and does not ensure TLS 1.2. Option D is incorrect because CloudFront adds complexity and does not directly enforce TLS 1.2 between Lambda and S3.

Answer

Configure the Lambda function to use a VPC endpoint for S3, and update the bucket policy to deny requests that do not use TLS 1.2.

Answer

Enable default encryption on the S3 bucket using the specific KMS key, and update the Lambda function to use the AWS SDK's default client, which uses HTTPS.

Answer

Place a CloudFront distribution in front of the S3 bucket, and configure the Lambda function to access S3 through CloudFront using HTTPS.

Question 4

A company uses AWS CloudFormation to manage infrastructure as code. The security team requires that all changes to CloudFormation stacks be reviewed and approved before execution. The team has enabled StackSets to deploy stacks across multiple accounts. A junior developer accidentally runs a stack update that modifies a production security group, opening SSH access to 0.0.0.0/0. The security team wants to prevent this type of incident in the future. They need a solution that enforces a mandatory approval workflow for all stack updates, while still allowing automated deployments from approved CI/CD pipelines. Which solution meets these requirements?

Accepted Answer

Create an IAM policy that denies cloudformation:UpdateStack unless the request is made using a specific service role with a path /ci-cp/, and configure the CI/CD pipeline to assume that role.. By creating an IAM policy that denies cloudformation:UpdateStack unless the request comes from a specific service role with a path /ci-cp/, and configuring the CI/CD pipeline to assume that role, you ensure that only approved automated pipelines can perform stack updates. This enforces mandatory approval because the CI/CD pipeline itself can include a manual approval step before assuming the role. Option A is incorrect: change sets with manual execution by a senior engineer still require manual intervention, but the junior developer could potentially execute the change set if they have the execute permission; also, it does not prevent the developer from directly running an update. Option C is incorrect: resource-based policies on stacks are not supported in CloudFormation; stacks do not have resource-based policies. Option D is incorrect: termination protection prevents deletion, not updates; MFA protects the user's credentials but does not prevent the user from making unauthorized updates if they have the permissions.

Answer

Use CloudFormation change sets and require that they be manually executed by a senior engineer.

Answer

Attach a resource-based policy to the stack that denies updates from any principal that does not have a specific tag.

Answer

Enable termination protection on all production stacks and require MFA for stack updates.

Question 5

A company uses Amazon Inspector to assess the security of EC2 instances. The security team receives an alert that a high-severity vulnerability (CVE-2023-XXXX) was found on an EC2 instance running a critical application. The application is behind an Application Load Balancer (ALB) and uses an Auto Scaling group. The vulnerability has a known patch, but patching requires a reboot. The security team needs to remediate the vulnerability with minimal downtime. Which approach should the team take?

Accepted Answer

Create a new launch template with an updated AMI that includes the patch. Update the Auto Scaling group to use the new launch template and perform a rolling update.. Creating a new launch template with the patched AMI, updating the Auto Scaling group, and performing a rolling update ensures that instances are replaced with minimal downtime. Option B is incorrect because stopping and patching the instance would cause downtime for that specific instance, and it may not be in the Auto Scaling group. Option C is incorrect because using the same AMI but applying a patch user data script may not work reliably and does not ensure a clean state. Option D is incorrect because disabling the ALB health check would cause traffic to be sent to the vulnerable instance, increasing risk.

Answer

Remove the instance from the Auto Scaling group, disable health checks on the ALB, and apply the patch manually.

Answer

Use AWS Systems Manager Patch Manager to apply the patch on the instance without rebooting, then verify the vulnerability is resolved.

Answer

Stop the vulnerable instance, apply the patch, and start it again. Re-register it with the ALB.

Question 6

A company uses AWS Secrets Manager to store database credentials. The security team wants to automatically rotate secrets every 30 days. The database is an Amazon RDS for PostgreSQL instance. The team has configured automatic rotation with a Lambda function that updates the password in RDS and Secrets Manager. However, after the first rotation, the application starts getting database connection errors. The application uses a connection string with the secret ARN and retrieves the secret from Secrets Manager at startup using the AWS SDK. Which of the following is the most likely cause of the connection errors?

Accepted Answer

The application caches the secret at startup and does not refresh it after rotation.. If the application caches the secret at startup, it will not retrieve the updated password after rotation, causing connection errors. Option A is incorrect because a Lambda timeout or throttling would prevent the rotation from completing, but the rotation succeeded (new password set), so the issue is on the application side. Option C is incorrect because if the Lambda lacked permissions to update the secret, the rotation would have failed entirely, not just after the first rotation. Option D is incorrect because Amazon RDS does not have built-in automatic password rotation; Secrets Manager manages the rotation, so there is no conflict.

Answer

The Lambda function is not configured with a sufficient timeout and is being throttled.

Answer

The Lambda function does not have permission to update the secret in Secrets Manager.

Answer

The RDS instance has automatic password rotation enabled, which conflicts with Secrets Manager rotation.

Question 7

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts are encrypted with AES-256 (SSE-S3) and that public access is blocked. The team wants to use a preventive control that automatically remediates non-compliant buckets. Which solution should the security team implement?

Accepted Answer

Create a Service Control Policy (SCP) that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the bucket is not configured correctly.. A Service Control Policy (SCP) is a preventive control that can deny actions across all accounts in an AWS Organization. Option A describes creating an SCP that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions if the bucket is not configured correctly. This prevents any non-compliant bucket from being created or modified. Options B and C are detective or not resource-specific, and Option D (AWS Config with Lambda) is detective and reactive, not preventive. Therefore, Option A is the correct solution.

Answer

Enable CloudTrail to log all S3 API calls and set up a CloudWatch Events rule to notify the security team.

Answer

Use AWS Identity and Access Management (IAM) policies to deny access to S3 buckets that do not have encryption enabled.

Answer

Use AWS Config rules to detect non-compliant buckets and trigger a Lambda function to remediate.

Question 8

A company uses Amazon CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed AWS KMS key. The team has enabled encryption on the CloudWatch Logs log group using a KMS key. However, after enabling encryption, the application fails to write logs to the log group. The application uses an IAM role that has the following permissions: logs:CreateLogStream, logs:PutLogEvents, and logs:DescribeLogStreams. Which additional permission does the application need?

Accepted Answer

kms:Encrypt. To write to an encrypted CloudWatch Logs log group, the IAM role needs kms:Encrypt permission on the KMS key to encrypt log data at rest. Option B is incorrect because kms:GenerateDataKey is not required; CloudWatch Logs does not use envelope encryption with data keys. Option C is incorrect because kms:CreateGrant is used to grant temporary access to a KMS key, not for writing logs. Option D is incorrect because kms:Decrypt is used for reading encrypted logs, not writing them.

Answer

kms:GenerateDataKey

Answer

kms:CreateGrant

Answer

kms:Decrypt

Question 9

A company is using AWS CloudTrail to log API activity. The security team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and alerted. What is the MOST secure and efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the UpdateTrail API call and triggers an SNS notification.. A CloudWatch Events rule can match the UpdateTrail API call in real time and trigger an SNS notification, ensuring immediate detection. Option A is wrong because Trusted Advisor runs periodic checks and does not provide real-time alerts. Option B is wrong because GuardDuty focuses on threat detection using network and account activity, not specifically on CloudTrail configuration changes. Option C is wrong because AWS Config rules evaluate resource configurations periodically or on configuration changes, but they are not designed for real-time API call monitoring and may have delays; CloudWatch Events provides event-driven, real-time detection.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration and email the security team.

Answer

Enable Amazon GuardDuty and configure a custom threat list to monitor CloudTrail API calls.

Answer

Create an AWS Config rule to detect changes to CloudTrail configuration and send an SNS notification.

Question 10

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to block traffic from known malicious IP addresses before it reaches the ALB. What is the MOST effective approach?

Accepted Answer

Use AWS WAF with an IP set rule to block the malicious IP addresses.. AWS WAF integrated with an Application Load Balancer can block traffic from known malicious IP addresses using IP set rules at the application layer. This is the most effective approach because WAF is specifically designed to filter web traffic, supports managed IP lists, and can be updated dynamically. Option B (NACLs) operates at the subnet level, is stateless, and requires manual rule management, making it less suitable for fine-grained IP blocking. Option C (AWS Network Firewall) provides VPC-level network inspection but is not optimized for ALB-specific traffic filtering. Option D (security groups) are stateful but are not designed for large-scale IP block lists and lack application-layer inspection capabilities.

Answer

Configure network ACLs on the ALB's subnet to block the malicious IPs.

Answer

Use AWS Network Firewall to inspect and block traffic at the VPC level.

Answer

Configure security groups to deny inbound traffic from the malicious IP addresses.

Question 11

A company has an S3 bucket with sensitive data. The security team requires that all data uploaded to the bucket be automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). How can this be enforced?

Accepted Answer

Use an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.. S3 bucket policies can deny uploads that do not include the x-amz-server-side-encryption header. Option A is wrong because default encryption applies to objects without encryption headers, but does not enforce encryption. Option C is wrong because CloudTrail logs actions but does not enforce encryption. Option D is wrong because an IAM policy requiring encryption only applies to the IAM principal and does not cover all access methods, making it less effective than a bucket policy.

Answer

Enable default encryption on the S3 bucket with SSE-KMS.

Answer

Enable AWS CloudTrail to monitor uploads and alert on unencrypted objects.

Answer

Create an IAM policy that requires all S3 operations to use SSE-KMS.

Question 12

A DevOps team uses AWS CodePipeline to deploy a web application. The application stores user session data in an ElastiCache Redis cluster. The security team mandates that all data in transit between the application and Redis must be encrypted. What should the team do?

Accepted Answer

Enable encryption in transit on the ElastiCache Redis cluster and configure the application to use TLS.. ElastiCache Redis supports encryption in transit using TLS, which must be enabled at cluster creation. Option A is wrong because NACLs do not encrypt traffic. Option B is wrong because the application must use TLS, but the cluster must also be configured to support it. Option C is wrong because VPC peering does not encrypt traffic.

Answer

Use a network ACL to allow only encrypted traffic on the Redis port.

Answer

Modify the application to use TLS when connecting to Redis.

Answer

Place the application and Redis cluster in the same VPC and use VPC peering.

Question 13

A company is using AWS CodeBuild as part of its CI/CD pipeline. The build projects need to access a private Amazon ECR repository to pull Docker images. What is the MOST secure way to grant CodeBuild access to ECR?

Accepted Answer

Create a service role for CodeBuild with an IAM policy that grants ECR pull access.. CodeBuild can assume an IAM service role with a policy that grants pull access to the ECR repository. This is the most secure approach because it avoids static credentials and leverages AWS identity and access management. Option A is wrong: a VPC endpoint provides private network connectivity to ECR but does not grant access; IAM permissions are still required. Option B is wrong: storing ECR credentials in Parameter Store introduces static credentials that must be managed and rotated, making it less secure than using an IAM role. Option D is wrong: using the AWS CLI to retrieve an authorization token requires managing temporary credentials and is more complex; the service role approach is simpler and more secure.

Answer

Configure a VPC endpoint for ECR and allow CodeBuild to connect through it.

Answer

Store ECR credentials in AWS Systems Manager Parameter Store and retrieve them in the buildspec.

Answer

Use the AWS CLI to retrieve an ECR authorization token and pass it to Docker.

Question 14

A security engineer needs to audit who accessed a specific S3 object and from which IP address over the past 30 days. Which AWS service should be used?

Accepted Answer

Amazon S3 server access logs. S3 server access logs provide detailed records of all requests made to an S3 bucket, including the requester identity (such as the AWS account or IAM user) and the source IP address. These logs can be enabled for a bucket and delivered to a target bucket for analysis. Option A is wrong because AWS CloudTrail, by default, records management events (e.g., bucket creation) but not data events (e.g., GetObject) unless specifically configured. Option B is wrong because Amazon CloudWatch Logs can store and monitor logs but does not generate access logs for S3. Option D is wrong because AWS Config records resource configuration changes, not access requests.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 15

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all unused IAM users are automatically identified and removed after 90 days of inactivity. What is the MOST effective solution?

Accepted Answer

Use IAM Access Analyzer to generate findings for unused access and automate user removal with a Lambda function.. The most effective solution is using IAM Access Analyzer (Option D) because it continuously monitors and generates findings for unused IAM roles and users, and those findings can be used to trigger automated remediation via AWS Lambda, integrating with AWS Organizations to manage multi-account environments. Option A is incorrect because the IAM credential report only provides a point-in-time snapshot and requires manual review, which is not scalable. Option B is incorrect because CloudTrail Insights detects unusual API activity but does not specifically identify inactive IAM users by their last activity; it requires custom analysis to determine inactivity. Option C is incorrect because although an AWS Config rule can detect IAM users, Config rules are not designed to evaluate inactivity based on last login or API calls; they would require custom logic and periodic evaluations, and the suggested approach of directly deleting users via Lambda after 90 days is risky without confirmation of inactivity. IAM Access Analyzer provides specific findings about unused access, which is exactly what is needed to automate the identification and removal of unused IAM users after 90 days of inactivity.

Answer

Use the IAM credential report to review last activity dates and manually delete users.

Answer

Enable CloudTrail Insights to detect inactive users and send alerts.

Answer

Use an AWS Config rule to detect IAM users and trigger a Lambda function to delete them after 90 days.