DOP-C02 Security and Compliance Practice Test 9 — 15 Questions

Question 1

A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the most appropriate service because it is specifically designed to manage secrets like database passwords, with automatic rotation, encryption, and fine-grained access control. Option A (DynamoDB) is a database, not a secrets manager. Option B (S3) can store encrypted data but lacks built-in secret rotation and management. Option C (Systems Manager Parameter Store SecureString) can store secrets but does not support automatic rotation, making Secrets Manager the better choice.

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store (SecureString)

Question 2

A company uses AWS KMS to encrypt data in S3. The security team requires that the key material be rotated every 90 days. What should be done to meet this requirement?

Accepted Answer

Create a customer managed key and manually rotate it every 90 days.. AWS KMS customer managed keys support manual rotation, which allows you to rotate the key material every 90 days as required. Automatic key rotation for customer managed keys is only available with a minimum rotation period of 365 days (yearly), so it cannot meet a 90-day requirement. Manual rotation creates a new backing key while retaining the old one for decryption of previously encrypted data, ensuring compliance with the 90-day rotation policy.

Answer

Create a customer managed key and enable automatic yearly rotation.

Answer

Use an AWS managed key (SSE-S3) and enable rotation.

Answer

Use a custom key store with imported key material and enable automatic rotation.

Question 3

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet that needs to download patches from the internet. Which solution is MOST secure and scalable?

Accepted Answer

Create a NAT Gateway in a public subnet and update the private route table.. A NAT Gateway resides in a public subnet, has an Elastic IP, and performs source NAT for outbound-only traffic from private subnets. Updating the private subnet's route table with 0.0.0.0/0 → NAT Gateway gives the EC2 instance internet egress for patch downloads without exposing it to inbound connections. It is managed, highly available within the AZ, and scales automatically, satisfying both the security and scalability requirements.

Answer

Launch a proxy server in a public subnet and route traffic through it.

Answer

Assign an Elastic IP to the instance in the private subnet.

Answer

Use a VPC endpoint to the Amazon Linux repository.

Question 4

A company wants to centralize logging of all API calls made within their AWS account for auditing. Which service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service designed to log all API calls made within an AWS account, providing a detailed audit trail of actions taken by users, roles, and services. It records API activity across the AWS Management Console, SDKs, CLI, and other services. CloudTrail logs can be delivered to S3 and CloudWatch Logs for analysis.

Answer

Amazon S3 access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 5

A DevOps engineer is designing a CI/CD pipeline that deploys to production. The security team mandates that all code changes must be reviewed and signed off by two senior developers before deployment. How can this be enforced?

Accepted Answer

Set up a pull request approval rule in CodeCommit requiring two approvals.. CodeCommit's pull request approval rules allow you to require a specific number of approvals before a pull request can be merged. By configuring an approval rule template that requires two approvals from senior developers, you enforce the mandatory code review and sign-off before any change is merged into the production branch, which then triggers the CI/CD pipeline.

Answer

Use CloudWatch Events to trigger a manual approval step in CodePipeline.

Answer

Restrict push access to the production branch to only the two senior developers.

Answer

Use AWS Lambda to send a notification when a change is pushed.

Question 6

A company has an AWS Lambda function that processes sensitive data. The function needs to access an RDS database with credentials stored in Secrets Manager. What is the MOST secure way to grant the Lambda function access to the secret?

Accepted Answer

Attach an IAM role to the Lambda function with permissions to read the secret and retrieve it at runtime.. Attaching an IAM role to the Lambda function and granting it secretsmanager:GetSecretValue for the specific secret is the AWS-native, most secure pattern. The Lambda execution role provides temporary, automatically rotated credentials via STS, and the secret is fetched at runtime so it is never stored in code, environment variables, or configuration. This also enables CloudTrail auditing of every secret access.

Answer

Use AWS KMS to encrypt the credentials and pass them as parameters.

Answer

Store the credentials directly in the Lambda function's environment variables.

Answer

Use Lambda environment variables with encryption enabled.

Question 7

Which TWO actions can be taken to protect an S3 bucket from being publicly accessible? (Select TWO.)

Accepted Answer

Use an SCP to deny s3:PutBucketPolicy.. An SCP (Service Control Policy) can explicitly deny the s3:PutBucketPolicy action at the AWS Organizations level, which prevents any IAM principal in affected accounts from attaching a public bucket policy. This is a preventive guardrail that overrides any permissive IAM permissions, ensuring the bucket cannot be made publicly accessible via policy statements.

Answer

Enable default encryption on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Use CloudFront to serve the bucket content.

Question 8

Which THREE measures can be taken to ensure that EC2 instances are compliant with a security policy that requires all instances to be in a VPC with specific tags? (Select THREE.)

Accepted Answer

Use AWS Config rules to detect non-compliant instances.. AWS Config rules can evaluate EC2 instances against a desired configuration, such as being in a VPC with specific tags. By using a custom or managed rule (e.g., 'required-tags' or 'ec2-instance-in-vpc'), you can detect non-compliant instances and trigger remediation actions. This provides continuous monitoring and reporting of compliance status without blocking the launch itself.

Answer

Use EC2 Auto Scaling to launch instances only in the correct VPC.

Answer

Use CloudWatch alarms to monitor instance launches.

Question 9

A DevOps engineer must ensure that all API calls in an AWS account are logged for compliance. The logs should be stored in an S3 bucket with server-side encryption enabled. Which two services should be used together to meet these requirements?

Accepted Answer

AWS CloudTrail and Amazon S3. AWS CloudTrail is the service that records API activity in an AWS account, and it can deliver those event logs directly to an Amazon S3 bucket, where server-side encryption (SSE-S3 or SSE-KMS) can be enabled to meet the compliance requirement. This combination of CloudTrail and Amazon S3 (option B) satisfies both logging all API calls and storing them encrypted in S3. Option A is wrong because CloudWatch Logs is not the required encrypted S3 storage target for CloudTrail API logs. Option C is wrong because VPC Flow Logs capture IP traffic metadata, not API calls. Option D is wrong because AWS Config records resource configuration changes, not all API calls, and pairing it with CloudTrail does not by itself provide the encrypted S3 log storage.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs and Amazon S3

Answer

AWS Config and AWS CloudTrail

Question 10

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across accounts are encrypted with AWS KMS. Which combination of controls should be used to enforce this?

Accepted Answer

Use an SCP to deny s3:PutBucketEncryption with encryption disabled, and AWS Config rules to detect non-compliant buckets.. It combines preventive and detective controls. An SCP can deny the s3:PutBucketEncryption action unless the bucket is configured with KMS encryption, which prevents non-compliant buckets from being created or modified. AWS Config rules then detect any existing non-compliant buckets or changes that bypass the SCP, providing continuous compliance monitoring.

Answer

Attach an IAM policy to all users denying s3:PutObject without KMS.

Answer

Use an SCP to deny s3:CreateBucket without encryption, and rely on CloudTrail to alert.

Answer

Use AWS Config rules only, with automatic remediation via Lambda.

Question 11

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. What is the most likely cause?

Accepted Answer

The Lambda function is not configured to access the VPC where the RDS instance resides.. The most likely cause of the timeout error is that the Lambda function is not configured to access the VPC where the RDS instance resides. When Secrets Manager rotates a secret for an RDS database, the rotation Lambda function must connect to the database to update the credentials. If the Lambda function is not attached to the same VPC (or a VPC with proper routing and security group rules), it cannot reach the RDS instance, causing network connection attempts to hang until the function times out.

Answer

The Lambda function's execution role lacks the required IAM permissions.

Answer

The secret rotation schedule is set to less than 24 hours.

Answer

The Lambda function does not have permission to access the S3 bucket.

Question 12

A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that EBS snapshots are shared with another account without exposing the underlying data. What is the correct approach?

Accepted Answer

Share the encrypted snapshot and update the KMS key policy to allow the target account to use the key.. Sharing an encrypted EBS snapshot requires the KMS key policy to grant the target account permission to use the key (via kms:Decrypt and kms:CreateGrant). Without this, the target account cannot decrypt the snapshot to create volumes or copies. AWS KMS enforces that the key policy explicitly allows cross-account access, and the target account must have the corresponding IAM permissions.

Answer

Share the encrypted snapshot without modifying the KMS key policy.

Answer

Create an unencrypted copy of the snapshot and share it.

Answer

Share the encrypted snapshot and also share the KMS key with the target account.

Question 13

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices an increase in false positives blocking legitimate traffic. Which action should be taken to reduce false positives while maintaining security?

Accepted Answer

Adjust the rate-based rule threshold to a higher value.. Adjusting the rate-based rule threshold to a higher value allows more legitimate traffic while still blocking excessive requests. Option A: Removing the rule would weaken security. Option B: AWS Shield Advanced is a DDoS protection service, not a replacement for fine-tuning WAF rules. Option D: Changing action to 'Count' logs requests but does not block them, reducing security.

Answer

Remove the rate-based rule that is causing false positives.

Answer

Replace AWS WAF with AWS Shield Advanced.

Answer

Change the rule action from 'Block' to 'Count'.

Question 14

A company has a Lambda function that processes sensitive data and needs to access an RDS database. The security team requires that the database credentials are automatically rotated every 30 days. Which service should be used to store and rotate the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like RDS. It supports native, built-in rotation for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) without requiring custom Lambda functions. The automatic rotation can be scheduled at a desired interval (e.g., every 30 days) using a rotation schedule defined in the secret's configuration, and it integrates directly with RDS to update the credentials on both the secret and the database.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS IAM roles

Question 15

A company is using AWS CloudTrail to log API events. The security team wants to ensure that log files are tamper-proof and available for incident investigation. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation.. Option C is correct because enabling CloudTrail log file validation generates a digest file for each log file, allowing you to verify that logs have not been altered or deleted after delivery. Option D is correct because S3 Object Lock enforces WORM (write once, read many) protection, preventing log files from being overwritten or deleted during a defined retention period, which directly supports tamper-proofing and availability for investigations. Option A is not correct because CloudWatch Logs is a monitoring/log aggregation service and does not by itself provide tamper-proofing or immutability for CloudTrail log files. Option B is not correct because SSE-S3 only provides encryption at rest and does not prevent modification or deletion of log files. Option E is not correct because AWS KMS encryption, while stronger in key control, still does not enforce immutability or tamper resistance on its own.

Answer

Store logs in Amazon CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3).

Answer

Use AWS KMS to encrypt the logs.