DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Elastic Load Balancing (ELB) with TLS termination.

  Why this is correct

  A TLS-enabled ELB (ALB or NLB) terminates the TLS/SSL handshake with clients, decrypting traffic at the AWS edge and thereby providing the cryptographic controls required for cardholder data in transit under PCI DSS Requirement 4. It also allows you to attach an AWS Certificate Manager certificate and optionally re-encrypt traffic to backend targets, so the load balancer is a correct service for securing communications.

• ✗

  AWS CloudTrail to log all API calls.

  Why it's wrong here

  AWS CloudTrail is a governance and auditing service that records every API call request, who made it, and when, storing the logs as encrypted objects in S3; however, it does not perform encryption on cardholder data or databases. Enabling CloudTrail alone leaves sensitive payloads unencrypted at rest and in transit, making it an incorrect substitute for an encryption service. It helps you detect unauthorized activity but does not cryptographically protect the data itself.

• ✓

  Amazon S3 server-side encryption (SSE-S3) for S3 objects.

  Why this is correct

  Amazon S3 Server-Side Encryption with S3-Managed Keys (SSE-S3) encrypts each object in place using AES-256 by applying a multi-layer key hierarchy, so all data written to S3 is automatically encrypted before persisting and decrypted only upon authorized read requests. This natively safeguards cardholder data at rest inside S3 buckets, satisfying the encryption requirement without you having to manage keys or alter applications.

• ✓

  AWS Key Management Service (KMS) to manage encryption keys.

  Why this is correct

  AWS Key Management Service (KMS) does not encrypt data directly but provides centralized creation, rotation, and audit of customer master keys used by other AWS services, such as SSE-KMS in S3, EBS, and RDS, to encrypt data at rest. This lets you enforce granular IAM and key policies governing which principals can decrypt cardholder data, and it integrates with CloudTrail to log every key operation. It is a correct complement for managing the cryptographic keys that underpin at-rest encryption.

• ✗

  AWS WAF to protect web applications.

  Why it's wrong here

  AWS WAF is a web application firewall operating at Layer 7 to inspect incoming HTTP/S traffic and block common attack patterns like SQL injection, cross-site scripting, and bot traffic. It has no capability to encrypt data, because it needs visibility into the plaintext request (after TLS termination) to apply rules, and it cannot protect data stored in S3 or databases. Thus WAF is a security control, not a cryptography control, and is incorrect for this requirement.

Go deeper

Related to this question