DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use IAM policy conditions to restrict access based on IP address or time of day.

  Why this is correct

  IAM policy conditions using the Condition element enable you to scope permissions by context keys such as aws:SourceIp or aws:CurrentTime. This allows you to enforce geofencing or business-hours-only access, reducing the blast radius of stolen credentials. For example, a Deny statement with a condition can block all access outside a corporate CIDR range.

• ✗

  Use only resource-based policies to manage permissions.

  Why it's wrong here

  Resource-based policies alone cannot cover all AWS services because many, such as IAM users or EC2, do not support them. Identity-based policies are required for actions that do not have a principal in the resource policy, and many services require the combining of both policy types to properly grant access. Over-relying solely on resource-based policies also complicates cross-account access and makes least privilege harder to audit.

• ✗

  Attach the AdministratorAccess managed policy to all IAM users.

  Why it's wrong here

  Attaching the AdministratorAccess managed policy to all IAM users grants explicit full permissions to every action and resource, which is the exact opposite of least privilege. This eliminates any need for conditions or scoping, giving any compromised user the ability to delete S3 buckets, terminate EC2 instances, and alter IAM roles. Least privilege demands the minimum permissions required to perform a job function, so broad managed policies should only be used for a very limited break-glass account.

• ✗

  Use the AWS account root user for daily administrative tasks.

  Why it's wrong here

  The AWS account root user has unrestricted access to all resources and services, including billing and account settings, and cannot be limited by IAM policies. Using it for daily administrative tasks creates a huge security risk because if the root credentials are compromised, there is no way to revoke them without contacting AWS Support. AWS recommends creating IAM users with administrative privileges and enabling MFA, reserving the root user only for specific account-level operations like changing the root email or closing the account.

• ✓

  Grant permissions based on the specific actions and resources needed.

  Why this is correct

  The core of least privilege is granting exactly the actions needed on exactly the required resources, using IAM policy statements that enumerate specific API calls and ARNs. This approach minimizes the surface area for privilege escalation and accidental operations, as each role or user can only interact with the intended AWS services. Combining specific actions and resource ARNs also forces you to review all policies during design, making access management more predictable.

Go deeper

Related to this question