How should I use these Security and Compliance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security and Compliance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security and Compliance domain.

DOP-C02 · topic practice

Security and Compliance practice questions

Practise AWS Certified DevOps Engineer Professional DOP-C02 Security and Compliance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security and Compliance

Practice 10 questions Browse domain →

What the exam tests

What to know about Security and Compliance

Security and Compliance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security and Compliance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security and Compliance questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Security and Compliance explanation →

A company is using AWS Organizations with multiple accounts. The Security team wants to centrally manage IAM roles that can be assumed by users in member accounts. Which solution should be used to enforce that only specific roles can be assumed across accounts, while ensuring that the policy updates are automatically applied to all accounts?

Trap 1: Create an IAM role in each member account with a trust policy that…

CloudFormation StackSets can deploy roles, but updates require re-deployment; not automatically enforced.

Trap 2: Use AWS Single Sign-On (SSO) to assign permissions to users across…

AWS SSO manages user access, not IAM role restrictions.

Trap 3: Create a resource-based policy on each IAM role in the member…

Resource-based policies are per-account and not centrally managed.

Study all Security and Compliance common traps →

A
Create an IAM role in each member account with a trust policy that allows the Security account, and use AWS CloudFormation StackSets to deploy the roles.
Why wrong: CloudFormation StackSets can deploy roles, but updates require re-deployment; not automatically enforced.
B
Use AWS Single Sign-On (SSO) to assign permissions to users across accounts.
Why wrong: AWS SSO manages user access, not IAM role restrictions.
C
Create an IAM role in the Security account with a trust policy that references a service control policy (SCP) in AWS Organizations.
SCPs can restrict IAM actions across accounts, and the trust policy can reference the SCP to enforce central control.
D
Create a resource-based policy on each IAM role in the member accounts that allows the Security account to assume the role.
Why wrong: Resource-based policies are per-account and not centrally managed.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Security and Compliance explanation →

A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?

Trap 1: Store the credentials in AWS Secrets Manager and retrieve them at…

Retrieving from Secrets Manager requires credentials to access Secrets Manager, leading to a chicken-and-egg problem.

Trap 2: Use AWS Systems Manager Parameter Store to store the credentials…

The instance role can access Parameter Store, but the credentials themselves are not automatically rotated.

Trap 3: Generate an access key and secret key for an IAM user and store…

Access keys are long-term credentials and storing them on disk is insecure.

Study all Security and Compliance common traps →

A
Store the credentials in AWS Secrets Manager and retrieve them at application startup.
Why wrong: Retrieving from Secrets Manager requires credentials to access Secrets Manager, leading to a chicken-and-egg problem.
B
Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.
Instance profiles provide temporary credentials that are automatically rotated and never stored on disk.
C
Use AWS Systems Manager Parameter Store to store the credentials and retrieve them using the EC2 instance's IAM role.
Why wrong: The instance role can access Parameter Store, but the credentials themselves are not automatically rotated.
D
Generate an access key and secret key for an IAM user and store them in a configuration file on the EC2 instance.
Why wrong: Access keys are long-term credentials and storing them on disk is insecure.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Security and Compliance explanation →

A DevOps engineer needs to ensure that all API calls made to AWS are recorded for auditing purposes. Which AWS service should be used?

Trap 1: AWS Config

AWS Config records resource configuration changes, not API calls.

Trap 2: Amazon CloudWatch Logs

CloudWatch Logs stores logs but does not automatically record API calls.

Trap 3: Amazon VPC Flow Logs

VPC Flow Logs capture IP traffic, not API calls.

Study all Security and Compliance common traps →

A
AWS CloudTrail
CloudTrail records all AWS API calls for auditing.
B
AWS Config
Why wrong: AWS Config records resource configuration changes, not API calls.
C
Amazon CloudWatch Logs
Why wrong: CloudWatch Logs stores logs but does not automatically record API calls.
D
Amazon VPC Flow Logs
Why wrong: VPC Flow Logs capture IP traffic, not API calls.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Security and Compliance explanation →

A company uses AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific attribute in their SAML assertion can decrypt the data. Which KMS key policy should be used?

Trap 1: Create an S3 bucket policy that denies kms:Decrypt unless the…

S3 bucket policies cannot deny KMS actions.

Trap 2: Attach a resource-based policy to the S3 bucket that allows…

S3 bucket policies do not control KMS decryption permissions.

Trap 3: Use an IAM policy that grants kms:Decrypt only if the user has the…

IAM policies cannot evaluate SAML attributes directly; KMS key policies can.

Study all Security and Compliance common traps →

A
Create an S3 bucket policy that denies kms:Decrypt unless the request includes a specific tag.
Why wrong: S3 bucket policies cannot deny KMS actions.
B
Modify the KMS key policy to include a condition that allows kms:Decrypt only if the SAML assertion contains the specific attribute.
KMS key policies can use conditions based on SAML attributes to control decryption.
C
Attach a resource-based policy to the S3 bucket that allows decryption only for users with the specific attribute.
Why wrong: S3 bucket policies do not control KMS decryption permissions.
D
Use an IAM policy that grants kms:Decrypt only if the user has the specific attribute.
Why wrong: IAM policies cannot evaluate SAML attributes directly; KMS key policies can.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Security and Compliance explanation →

A company has a requirement to rotate database credentials every 30 days for an Amazon RDS for MySQL instance. The credentials are currently stored in AWS Secrets Manager. The DevOps engineer needs to implement automatic rotation without modifying the application code. Which solution should be used?

Trap 1: Create a scheduled job that runs every 30 days to update the secret…

This is manual and does not handle automatic rotation of the database password.

Trap 2: Store the credentials in AWS Systems Manager Parameter Store and…

Parameter Store does not natively support rotation for RDS credentials.

Trap 3: Use the AWS RDS automatic password rotation feature, which…

RDS does not have an automatic password rotation feature without Secrets Manager.

Study all Security and Compliance common traps →

A
Create a scheduled job that runs every 30 days to update the secret in Secrets Manager with a new password.
Why wrong: This is manual and does not handle automatic rotation of the database password.
B
Store the credentials in AWS Systems Manager Parameter Store and configure automatic rotation using a Lambda function.
Why wrong: Parameter Store does not natively support rotation for RDS credentials.
C
Use the AWS RDS automatic password rotation feature, which automatically updates the password every 30 days.
Why wrong: RDS does not have an automatic password rotation feature without Secrets Manager.
D
Configure Secrets Manager to automatically rotate the secret every 30 days using a Lambda rotation function, and have the application retrieve the secret using the Secrets Manager API.
Secrets Manager provides built-in rotation for RDS with a Lambda function, and the application can retrieve credentials on-the-fly.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Security and Compliance explanation →

A company uses AWS Organizations to manage multiple accounts. The Security team wants to prevent member accounts from disabling AWS CloudTrail or deleting CloudTrail log files. Which TWO actions should the Security team take in the organization's management account? (Choose TWO.)

Trap 1: Create an SCP to deny cloudtrail:UpdateTrail.

This prevents updating the trail but not stopping or deleting it.

Trap 2: Create an IAM policy in each member account to deny…

IAM policies can be overridden by account administrators.

Trap 3: Enable AWS CloudTrail from the management account with organization…

This creates a trail, but does not prevent member accounts from disabling it.

Study all Security and Compliance common traps →

A
Create an SCP to deny cloudtrail:UpdateTrail.
Why wrong: This prevents updating the trail but not stopping or deleting it.
B
Create an IAM policy in each member account to deny cloudtrail:StopLogging.
Why wrong: IAM policies can be overridden by account administrators.
C
Create an SCP to deny s3:DeleteObject on the CloudTrail log bucket.
This prevents deletion of log files.
D
Enable AWS CloudTrail from the management account with organization trail.
Why wrong: This creates a trail, but does not prevent member accounts from disabling it.
E
Create an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail.
This prevents disabling or deleting the trail.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Security and Compliance explanation →

A DevOps team is designing a CI/CD pipeline that deploys a web application on Amazon ECS. The application must be compliant with PCI DSS, which requires encryption of data at rest and in transit, and logging of all access. Which THREE actions should the team implement to meet these requirements? (Choose THREE.)

Trap 1: Store database credentials in AWS Systems Manager Parameter Store.

Parameter Store can store secrets but does not encrypt by default; KMS should be used.

Trap 2: Use VPC endpoints to access ECS and ECR APIs.

VPC endpoints provide private connectivity, not encryption or logging.

Study all Security and Compliance common traps →

A
Enable AWS CloudTrail and Amazon ECS logs to capture all API calls and container logs.
Logging is required for auditing access.
B
Store database credentials in AWS Systems Manager Parameter Store.
Why wrong: Parameter Store can store secrets but does not encrypt by default; KMS should be used.
C
Use VPC endpoints to access ECS and ECR APIs.
Why wrong: VPC endpoints provide private connectivity, not encryption or logging.
D
Enable ECS task definition encryption using AWS KMS for environment variables and sensitive data.
KMS encryption ensures data at rest is encrypted.
E
Configure an Application Load Balancer (ALB) with an HTTPS listener using an SSL/TLS certificate.
HTTPS ensures encryption in transit.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Security and Compliance explanation →

A company runs a multi-account environment using AWS Organizations. The security team has implemented a service control policy (SCP) that denies all actions on DynamoDB tables unless the request includes a specific tag "Environment": "Production". The development team has an IAM role with full DynamoDB access in their account. When they try to create a DynamoDB table using the AWS CLI, they receive an access denied error. They are certain they included the tag. The DevOps engineer reviews the SCP and finds that it uses the condition key "aws:RequestTag". However, the engineer notices that the SCP also denies access if the request does not include the tag for tagging actions. What is the most likely reason for the access denied error?

Trap 1: The SCP requires an explicit allow statement in the IAM policy to…

SCPs work with IAM policies; an explicit allow is not needed to override a deny.

Trap 2: The IAM role does not have permission to tag resources.

The role has full DynamoDB access, including tagging.

Trap 3: The SCP is not applied to the development account because it is in…

The scenario implies the SCP is applied to the account.

Study all Security and Compliance common traps →

A
The SCP requires an explicit allow statement in the IAM policy to override the deny.
Why wrong: SCPs work with IAM policies; an explicit allow is not needed to override a deny.
B
The IAM role does not have permission to tag resources.
Why wrong: The role has full DynamoDB access, including tagging.
C
The CreateTable API does not accept tags in the request; tags must be added after creation using the TagResource API.
The CreateTable API does not support tagging at creation. The SCP condition fails because the tag is not present in the request.
D
The SCP is not applied to the development account because it is in a different OU.
Why wrong: The scenario implies the SCP is applied to the account.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Security and Compliance explanation →

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

Trap 1: Use an SCP to deny the creation of unencrypted EBS volumes and use…

SCPs cannot directly create or enforce Config rules; they only control permissions.

Trap 2: Use an AWS Config aggregator in the management account to monitor…

Config aggregator only aggregates data, it does not enforce rules.

Trap 3: Use AWS CloudFormation StackSets to deploy a stack with the Config…

CloudFormation StackSets require manual management or custom automation to apply to new accounts.

Study all Security and Compliance common traps →

A
Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.
Why wrong: SCPs cannot directly create or enforce Config rules; they only control permissions.
B
Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.
SCPs can enforce that Config rules are enabled, and a custom Config rule can enforce EBS encryption.
C
Use an AWS Config aggregator in the management account to monitor compliance across accounts.
Why wrong: Config aggregator only aggregates data, it does not enforce rules.
D
Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.
Why wrong: CloudFormation StackSets require manual management or custom automation to apply to new accounts.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Security and Compliance explanation →

A financial services company is migrating its applications to AWS. The compliance team requires that all Amazon S3 buckets containing personally identifiable information (PII) must have server-side encryption enabled and block public access. The DevOps team discovers that some S3 buckets are not compliant. Which TWO actions should the team take to enforce these requirements automatically for all current and future buckets? (Select TWO.)

Trap 1: Enable AWS CloudTrail to log all S3 API calls and send alerts when…

CloudTrail only logs, does not enforce.

Trap 2: Attach an IAM permissions boundary to all users that prevents them…

Permissions boundary does not enforce specific bucket configurations.

Trap 3: Apply an S3 bucket policy to each existing bucket that denies all…

Bucket policies do not enforce settings on future buckets.

Study all Security and Compliance common traps →

A
Enable AWS CloudTrail to log all S3 API calls and send alerts when noncompliant buckets are created.
Why wrong: CloudTrail only logs, does not enforce.
B
Use AWS Config managed rules to detect noncompliant buckets and automatically remediate by applying encryption and blocking public access.
AWS Config can detect and auto-remediate.
C
Attach an IAM permissions boundary to all users that prevents them from creating or modifying S3 buckets.
Why wrong: Permissions boundary does not enforce specific bucket configurations.
D
Apply an S3 bucket policy to each existing bucket that denies all access unless encryption is enabled.
Why wrong: Bucket policies do not enforce settings on future buckets.
E
Create an SCP that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions when the required settings are not specified.
SCPs can deny bucket creation if required settings are missing.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Security and Compliance explanation →

A DevOps engineer applies the S3 bucket policy shown in the exhibit to enforce encryption and secure transport. After applying the policy, users report that they can still upload objects without encryption. What is the most likely cause?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyIncorrectEncryption",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    },
    {
      "Sid": "DenyUnEncryptedObjectUploads",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "Null": {
          "s3:x-amz-server-side-encryption": true
        }
      }
    },
    {
      "Sid": "AllowSSL",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Trap 1: The Null condition incorrectly allows uploads without encryption.

Null condition denies when encryption header is missing, but if AES256 is provided, the header is not null.

Trap 2: The bucket policy does not apply to cross-account uploads.

The policy applies to all principals, including cross-account.

Trap 3: The bucket policy lacks an explicit Allow statement for…

Deny statements are effective without an explicit Allow.

Study all Security and Compliance common traps →

A
The Null condition incorrectly allows uploads without encryption.
Why wrong: Null condition denies when encryption header is missing, but if AES256 is provided, the header is not null.
B
The bucket policy does not apply to cross-account uploads.
Why wrong: The policy applies to all principals, including cross-account.
C
The first Deny statement only denies encryption types other than aws:kms, but allows encryption with AES256.
The condition StringNotEquals aws:kms does not deny AES256 because AES256 is not equal to aws:kms, so the Deny does not apply.
D
The bucket policy lacks an explicit Allow statement for s3:PutObject.
Why wrong: Deny statements are effective without an explicit Allow.

Full breakdown with real-world context →

Question 12mediumdrag order

Read the full Security and Compliance explanation →

Drag and drop the steps to set up an AWS CloudFormation stack with a nested stack.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13mediummatching

Read the full Security and Compliance explanation →

Match each AWS security and identity service to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Manages users, groups, roles, and permissions

Creates and manages encryption keys

Rotates and manages secrets like database credentials

DDoS protection service

Web application firewall

Question 14easymultiple choice

Read the full Security and Compliance explanation →

A company uses AWS KMS to encrypt data in S3. They want to audit who used which KMS key and when. Which AWS service should they use?

Trap 1: Amazon CloudWatch

CloudWatch monitors metrics and logs but does not provide detailed API audit trails for KMS.

Trap 2: Amazon GuardDuty

GuardDuty is for threat detection, not auditing API calls.

Trap 3: AWS Config

Config tracks configuration changes to resources, not API usage.

Study all Security and Compliance common traps →

A
Amazon CloudWatch
Why wrong: CloudWatch monitors metrics and logs but does not provide detailed API audit trails for KMS.
B
Amazon GuardDuty
Why wrong: GuardDuty is for threat detection, not auditing API calls.
C
AWS CloudTrail
CloudTrail records KMS API calls like Decrypt, Encrypt, GenerateDataKey for auditing.
D
AWS Config
Why wrong: Config tracks configuration changes to resources, not API usage.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Security and Compliance explanation →

A DevOps engineer needs to securely store database credentials for an application running on EC2. The credentials must be rotated automatically every 30 days. Which solution meets these requirements?

Trap 1: Store credentials in AWS Systems Manager Parameter Store and use a…

Parameter Store does not have built-in rotation; a custom solution is needed, making it less ideal than Secrets Manager.

Trap 2: Store credentials in an S3 bucket encrypted with KMS and use S3…

S3 Lifecycle policies manage object lifecycle, not credential rotation.

Trap 3: Use IAM roles to grant the EC2 instance access to the database,…

IAM roles are for AWS API access, not database credentials; this option is not applicable for most databases.

Study all Security and Compliance common traps →

A
Use AWS Secrets Manager to store the credentials and configure automatic rotation with the RDS rotation Lambda blueprint.
Secrets Manager supports automatic rotation via Lambda, including a built-in RDS rotation template.
B
Store credentials in AWS Systems Manager Parameter Store and use a Lambda function to rotate them.
Why wrong: Parameter Store does not have built-in rotation; a custom solution is needed, making it less ideal than Secrets Manager.
C
Store credentials in an S3 bucket encrypted with KMS and use S3 Lifecycle policies to rotate the objects.
Why wrong: S3 Lifecycle policies manage object lifecycle, not credential rotation.
D
Use IAM roles to grant the EC2 instance access to the database, eliminating the need for credentials.
Why wrong: IAM roles are for AWS API access, not database credentials; this option is not applicable for most databases.

Full breakdown with real-world context →

Question 16hardmultiple choice

Read the full Security and Compliance explanation →

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have encryption enabled. They need a preventive control that applies to all current and future accounts. Which approach should they use?

Trap 1: Use AWS Config rules to detect unencrypted buckets and…

Config rules are detective and reactive, not preventive.

Trap 2: Enable AWS CloudTrail to log all S3 API calls and send alerts when…

CloudTrail logs events but does not prevent non-compliant actions.

Trap 3: Create an IAM policy in each account that denies…

IAM policies must be applied per account and don't automatically apply to new accounts.

Study all Security and Compliance common traps →

A
Use a service control policy (SCP) in the Organizations root to deny PutBucketEncryption actions when encryption settings do not include AES256 or aws:kms.
SCPs are preventive controls that apply organization-wide, including future accounts.
B
Use AWS Config rules to detect unencrypted buckets and automatically apply encryption using a remediation action.
Why wrong: Config rules are detective and reactive, not preventive.
C
Enable AWS CloudTrail to log all S3 API calls and send alerts when non-compliant buckets are created.
Why wrong: CloudTrail logs events but does not prevent non-compliant actions.
D
Create an IAM policy in each account that denies PutBucketEncryption unless encryption is enabled.
Why wrong: IAM policies must be applied per account and don't automatically apply to new accounts.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Security and Compliance explanation →

A developer wants to grant an EC2 instance read-only access to a specific S3 bucket. Which AWS mechanism should they use to securely provide credentials to the instance?

Trap 1: Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment…

Environment variables can be read by processes and are not as secure as temporary credentials.

Trap 2: Store AWS access keys in the EC2 user data script.

User data is visible to anyone with access to the instance metadata, and keys can be exposed.

Trap 3: Retrieve the credentials from AWS Systems Manager Parameter Store…

While more secure than static keys, it's not the best practice; instance profiles are simpler and more secure.

Study all Security and Compliance common traps →

A
Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the AMI.
Why wrong: Environment variables can be read by processes and are not as secure as temporary credentials.
B
Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.
Instance profiles provide automatic rotation of temporary credentials and are the recommended best practice.
C
Store AWS access keys in the EC2 user data script.
Why wrong: User data is visible to anyone with access to the instance metadata, and keys can be exposed.
D
Retrieve the credentials from AWS Systems Manager Parameter Store using a custom script.
Why wrong: While more secure than static keys, it's not the best practice; instance profiles are simpler and more secure.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Security and Compliance explanation →

A company wants to centralize audit logs from multiple AWS accounts into a single S3 bucket. The logs must be encrypted at rest and access should be limited to the security team. Which solution is MOST secure and scalable?

Trap 1: Use an IAM role in each account that grants write access to the…

Default encryption is not as secure as enforced encryption via bucket policy, and IAM roles per account can be hard to manage.

Trap 2: Configure each account to write logs to its own S3 bucket, then…

This adds complexity and replication may not preserve encryption or access controls.

Trap 3: Use Amazon CloudWatch Logs in each account and export logs to a…

CloudWatch Logs does not encrypt at rest by default, and Lambda introduces complexity.

Study all Security and Compliance common traps →

A
Use an IAM role in each account that grants write access to the central bucket, and use S3 default encryption.
Why wrong: Default encryption is not as secure as enforced encryption via bucket policy, and IAM roles per account can be hard to manage.
B
Configure each account to write logs to its own S3 bucket, then replicate to a central bucket using S3 Cross-Region Replication.
Why wrong: This adds complexity and replication may not preserve encryption or access controls.
C
Create a central S3 bucket with a bucket policy that requires encryption (aws:SecureTransport and SSE-KMS) and restricts access to a security team IAM role.
Bucket policies can enforce encryption and limit access, and KMS provides encryption at rest.
D
Use Amazon CloudWatch Logs in each account and export logs to a central S3 bucket using a Lambda function.
Why wrong: CloudWatch Logs does not encrypt at rest by default, and Lambda introduces complexity.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full Security and Compliance explanation →

A company runs a web application on EC2 behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting (XSS) attacks. Which AWS service should they use?

Trap 1: Configure security groups to allow only HTTP/HTTPS traffic.

Security groups work at the network layer and cannot inspect application-layer payloads.

Trap 2: Configure network ACLs to block common attack patterns based on IP…

NACLs are stateless and cannot inspect content; they filter based on IP, ports, and protocols only.

Trap 3: Enable AWS Shield Advanced to protect the ALB.

Shield Advanced provides DDoS protection, not application-layer attack filtering.

Study all Security and Compliance common traps →

A
Configure security groups to allow only HTTP/HTTPS traffic.
Why wrong: Security groups work at the network layer and cannot inspect application-layer payloads.
B
Configure network ACLs to block common attack patterns based on IP ranges.
Why wrong: NACLs are stateless and cannot inspect content; they filter based on IP, ports, and protocols only.
C
Deploy AWS WAF in front of the ALB and create rules to block SQL injection and XSS.
AWS WAF provides managed rules for SQL injection and XSS at the application layer.
D
Enable AWS Shield Advanced to protect the ALB.
Why wrong: Shield Advanced provides DDoS protection, not application-layer attack filtering.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Security and Compliance explanation →

A DevOps engineer needs to ensure that all API calls made to AWS are logged for compliance. The logs must be stored in S3 for at least 7 years. Which AWS service should they use?

Trap 1: VPC Flow Logs

VPC Flow Logs capture IP traffic information, not API calls.

Trap 2: AWS Config

Config records resource configuration history, not API calls.

Trap 3: Amazon CloudWatch Logs

CloudWatch Logs captures log data from applications, not AWS API calls.

Study all Security and Compliance common traps →

A
VPC Flow Logs
Why wrong: VPC Flow Logs capture IP traffic information, not API calls.
B
AWS Config
Why wrong: Config records resource configuration history, not API calls.
C
Amazon CloudWatch Logs
Why wrong: CloudWatch Logs captures log data from applications, not AWS API calls.
D
AWS CloudTrail
CloudTrail records all AWS API calls and can deliver logs to S3 for long-term retention.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Security and Compliance sessions

Start a Security and Compliance only practice session

Every question in these sessions is drawn from the Security and Compliance domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Security and Compliance questions →Mixed DOP-C02 session

Frequently asked questions

What does the DOP-C02 exam test about Security and Compliance?: Security and Compliance questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Security and Compliance questions in a focused session?: Yes — the session launcher on this page draws every question from the Security and Compliance domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other DOP-C02 topics?: Use the topic links above to move to related areas, or go back to the DOP-C02 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the DOP-C02 exam covers. They are not copied from any real exam or dump site.

Security and Compliance only

10 questions 20 questions 30 questions 50 questions

Mixed DOP-C02 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All DOP-C02 questions Security and Compliance domain overview DOP-C02 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Security and Compliance practice questions

What to know about Security and Compliance

Common Security and Compliance exam traps

Security and Compliance questions

A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?

A DevOps engineer needs to ensure that all API calls made to AWS are recorded for auditing purposes. Which AWS service should be used?

A company uses AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific attribute in their SAML assertion can decrypt the data. Which KMS key policy should be used?

A company has a requirement to rotate database credentials every 30 days for an Amazon RDS for MySQL instance. The credentials are currently stored in AWS Secrets Manager. The DevOps engineer needs to implement automatic rotation without modifying the application code. Which solution should be used?

A company uses AWS Organizations to manage multiple accounts. The Security team wants to prevent member accounts from disabling AWS CloudTrail or deleting CloudTrail log files. Which TWO actions should the Security team take in the organization's management account? (Choose TWO.)

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

A DevOps engineer applies the S3 bucket policy shown in the exhibit to enforce encryption and secure transport. After applying the policy, users report that they can still upload objects without encryption. What is the most likely cause?

Exhibit

Drag and drop the steps to set up an AWS CloudFormation stack with a nested stack.

Match each AWS security and identity service to its function.

A company uses AWS KMS to encrypt data in S3. They want to audit who used which KMS key and when. Which AWS service should they use?

A DevOps engineer needs to securely store database credentials for an application running on EC2. The credentials must be rotated automatically every 30 days. Which solution meets these requirements?

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have encryption enabled. They need a preventive control that applies to all current and future accounts. Which approach should they use?

A developer wants to grant an EC2 instance read-only access to a specific S3 bucket. Which AWS mechanism should they use to securely provide credentials to the instance?

A company wants to centralize audit logs from multiple AWS accounts into a single S3 bucket. The logs must be encrypted at rest and access should be limited to the security team. Which solution is MOST secure and scalable?

A company runs a web application on EC2 behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting (XSS) attacks. Which AWS service should they use?

A DevOps engineer needs to ensure that all API calls made to AWS are logged for compliance. The logs must be stored in S3 for at least 7 years. Which AWS service should they use?

Track your progress over time

Start a Security and Compliance only practice session

Related DOP-C02 topic practice pages

Configuration Management and IaC practice questions

Resilient Cloud Solutions practice questions

Monitoring and Logging practice questions

Incident and Event Response practice questions