DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use an IAM policy with a condition that denies access unless the request uses HTTPS.

  Why this is correct

  An IAM policy is evaluated for every AWS API request, and the global condition key `aws:SecureTransport` returns `false` when the request was not sent over TLS/HTTPS. By attaching a policy that explicitly denies access when `aws:SecureTransport` is `false`, you enforce that all API calls must use HTTPS at the authorization layer. This is the correct, service-agnostic mechanism because IAM conditions apply uniformly to any supported AWS service, making it impossible to bypass via a non-HTTPS client.

• ✗

  Configure security groups to allow only HTTPS traffic.

  Why it's wrong here

  Security groups act as a virtual firewall at the instance or elastic network interface level, filtering traffic based on IP addresses, ports, and protocols at layers 3 and 4. They do not inspect or enforce application-layer encryption, and they are not in the network path of API calls to AWS public service endpoints such as `ec2.amazonaws.com` or `s3.amazonaws.com`. Even if a security group allowed only HTTPS port 443, a client could still issue an HTTP request directly to the AWS API endpoint, which is a managed service not subject to your security groups. Therefore, SG configuration cannot enforce TLS on API traffic.

• ✗

  Use AWS Key Management Service (KMS) to create a key and require encryption.

  Why it's wrong here

  AWS KMS manages customer master keys that encrypt data at rest, not the transport protocol used for API calls. While you can use KMS to encrypt data client-side before transmission, KMS has no capability to evaluate a request's transport mechanism or deny calls made over plain HTTP. The encryption of an API request in transit is handled by TLS at the network layer, independently of KMS keys. Attempting to require encryption via KMS would neither block insecure API calls nor satisfy the requirement to enforce HTTPS for all API traffic.

• ✗

  Enable AWS CloudTrail to log all API calls.

  Why it's wrong here

  CloudTrail logs API calls for auditing and governance, but it does not enforce encryption in transit; it merely records metadata about calls after they occur. The requirement is to mandate HTTPS or TLS for all API traffic, which CloudTrail cannot control. This option is tempting because CloudTrail is commonly used for security monitoring, and logging might seem to address compliance, but it would only be correct for a requirement to audit API activity, not to enforce transport encryption.

Go deeper

Related to this question