Security and Compliance — DOP-C02 Practice Quiz

Question 1

A company uses AWS Certificate Manager (ACM) to issue public TLS certificates for several externally imported certificates that ACM cannot auto-renew (they were imported from a third-party CA). The security team was recently caught off guard when one imported certificate expired, causing a production outage. They need an automated, low-maintenance solution that proactively alerts the operations team at least 30 days before ANY imported certificate expires, across all accounts in the organization. Which approach BEST meets this requirement?

Accepted Answer

Enable the AWS Config managed rule acm-certificate-expiration-check across the organization, and configure a conformance pack with EventBridge to notify an SNS topic when a certificate is flagged noncompliant.

Answer

Create a Lambda function scheduled with EventBridge that calls acm:ListCertificates daily and publishes to SNS, deploying it manually in every account.

Answer

Rely on the ACM.expiryEventsDaysBeforeExpiry AWS Health event, which ACM automatically emits for imported certificates, and route it to SNS via EventBridge.

Answer

Enable Security Hub and use the AWS Foundational Security Best Practices control for ACM, which suppresses findings until a certificate is within 30 days of expiry.

Question 2

A DevOps engineer at a financial services company must produce an on-demand report that lists all EC2 instances across 40 member accounts and 3 regions that do NOT have detailed monitoring enabled. Auditors request this report ad hoc and expect it within minutes, without deploying additional infrastructure. AWS Config is already enabled organization-wide with a delegated administrator account hosting an aggregator. What is the MOST efficient way to generate this cross-account, cross-region inventory report?

Accepted Answer

Use AWS Config advanced queries (SQL-based) against the configuration aggregator in the delegated administrator account to select resources of type AWS::EC2::Instance where detailed monitoring is disabled.

Answer

Deploy a Lambda function in every account and region that calls the EC2 DescribeInstances API, aggregate results in an S3 bucket, and query them with Athena.

Answer

Create a custom AWS Config rule with a Lambda evaluation function and review the compliance timeline in each member account individually.

Answer

Enable AWS Systems Manager Inventory across all accounts and use Resource Data Sync to consolidate instance metadata into an S3 bucket for querying.

Question 3

A DevOps team manages 40 AWS accounts under AWS Organizations. The security team needs a single, read-only view of AWS Config rule compliance status across all member accounts and multiple regions, updated automatically as new accounts join the organization. They want to minimize ongoing operational overhead and avoid deploying custom scripts to fetch data from each account. Which approach best meets these requirements?

Accepted Answer

Create an organization-wide AWS Config aggregator in a delegated administrator account with an organization data source covering all enabled regions.

Answer

Deploy a Lambda function in each account on a schedule that calls the Config API and writes compliance data to a central S3 bucket for consolidation.

Answer

Create an individual account-based Config aggregator in the management account and manually add each of the 40 accounts and their regions as authorized sources.

Answer

Enable AWS Config in each account and use CloudWatch cross-account dashboards to visualize the compliance metrics centrally.

Question 4

A company must demonstrate to auditors that all EC2 instances, EBS volumes, and RDS instances across a 60-account AWS Organization carry mandatory cost-allocation tags (CostCenter, Owner, Environment). The security team needs a single, auditable compliance report that is continuously updated, and they want to minimize the amount of custom code they build and maintain. Resources that lack required tags must be flagged automatically. What is the MOST operationally efficient way to meet these requirements?

Accepted Answer

Deploy the AWS Config managed rule 'required-tags' via an organization conformance pack from the delegated administrator account, and view aggregated compliance results in a Config aggregator.

Answer

Write a Lambda function invoked on a daily EventBridge schedule in every account that calls the Resource Groups Tagging API, evaluates tags, and writes results to a central DynamoDB table for reporting.

Answer

Enable AWS Security Hub across the organization and rely on the CIS AWS Foundations Benchmark controls to detect resources missing mandatory tags.

Answer

Create a Service Control Policy that denies creation of any resource that does not include the three required tags, then export CloudTrail denied events to Athena for reporting.

Question 5

A financial services company runs 40 accounts under AWS Organizations. The compliance team wants to enforce a standardized set of ~60 Config rules (mapped to PCI DSS controls) across all existing and future member accounts. Requirements: the rules must be deployed centrally from the management/delegated administrator account, versioned as code in a Git repository, and automatically applied to any newly created account without manual per-account setup. Which approach best meets these requirements?

Accepted Answer

Author a Config conformance pack YAML template stored in Git, then deploy it as an organization conformance pack from the Config delegated administrator account so it applies to all member accounts automatically.

Answer

Create a CloudFormation StackSet with service-managed permissions that provisions the 60 individual Config rules into each account, and manually run drift detection weekly to confirm compliance.

Answer

Enable Security Hub with the PCI DSS standard in every account and rely on its managed controls, exporting the findings config to Git for version tracking.

Answer

Deploy the Config rules in the management account only, and use cross-account IAM roles so the management account's Config recorder evaluates resources in every member account.

Question 6

A financial services company must enforce a compliance policy that requires all IAM user access keys to be rotated every 90 days across a single AWS account. The security team wants an automated, auditable mechanism that continuously detects access keys older than 90 days and automatically deactivates them without requiring engineers to write custom polling scripts or maintain long-running compute. Which solution best meets these requirements with the least operational overhead?

Accepted Answer

Create an AWS Config managed rule 'access-keys-rotated' with maxAccessKeyAge set to 90, and attach an SSM Automation remediation action that deactivates non-compliant keys.

Answer

Schedule a Lambda function with EventBridge to run daily, call the IAM API to list all access keys, compare creation dates, and deactivate keys older than 90 days.

Answer

Enable Amazon GuardDuty and create an EventBridge rule that triggers a Lambda function to deactivate keys whenever GuardDuty reports stale credential findings.

Answer

Configure AWS Security Hub with the CIS benchmark standard and rely on its automated remediation to deactivate access keys older than 90 days.

Question 7

A financial services company runs workloads across 40 AWS accounts in an organization. The security team maintains a list of approved (hardened) AMI IDs. They want to continuously detect any EC2 instance launched from a non-approved AMI across all accounts, record the compliance state centrally for audits, AND prevent developers from launching non-approved AMIs in the first place. Which combination of controls best satisfies both the detective and preventive requirements with the least custom code?

Accepted Answer

Deploy an AWS Config organization managed rule (approved-amis-by-id) via a conformance pack, aggregate results in a delegated administrator account, and attach a Service Control Policy (SCP) that denies ec2:RunInstances unless the ec2:ImageID condition key matches an approved AMI list.

Answer

Enable GuardDuty across the organization to detect non-approved AMI launches and use a permissions boundary on all developer IAM roles to block ec2:RunInstances for unapproved images.

Answer

Create a Lambda function subscribed to CloudTrail RunInstances events in each account that terminates instances launched from non-approved AMIs, and store findings in a central DynamoDB table for auditing.

Answer

Use Security Hub custom controls to flag non-approved AMIs and rely on an IAM identity-based policy in each account to deny launching unapproved AMIs.

Question 8

A DevOps engineer manages compliance for an organization with 60 accounts in AWS Organizations. The security team wants a single AWS Config rule that checks whether all EBS volumes are encrypted, deployed consistently across every existing and future member account, with results visible centrally. They do not want to manually create or maintain the rule in each account, and they want the security account (not the management account) to own the deployment. What is the MOST operationally efficient approach?

Accepted Answer

Register the security account as a delegated administrator for AWS Config, then create an organization Config rule (PutOrganizationConfigRule) using the encrypted-volumes managed rule so it is deployed to all member accounts automatically.

Answer

Use a CloudFormation StackSet with service-managed permissions from the management account to deploy an identical Config rule into each member account and enable automatic deployment for new accounts.

Answer

Create the Config rule in the security account and share it with member accounts using AWS Resource Access Manager (RAM), enabling automatic propagation to new accounts.

Answer

Deploy a Config conformance pack from the management account containing the encrypted-volumes rule, and rely on each account owner to accept the conformance pack invitation.

Question 9

A financial services company must prove to auditors that no member account in their AWS Organization can disable AWS Config recording or delete the organization CloudTrail trail without immediate detection and automatic re-enablement. Account administrators in member accounts currently hold broad IAM permissions that include config and cloudtrail actions. Which combination of controls BEST enforces this governance requirement with the least ongoing operational effort?

Accepted Answer

Deploy a Service Control Policy at the organization root denying cloudtrail:StopLogging, cloudtrail:DeleteTrail, and config:StopConfigurationRecorder/DeleteConfigurationRecorder, and enable AWS Config with an organization-managed aggregator plus a conformance pack to continuously verify recorder status.

Answer

Grant each member account administrator a permissions boundary that removes config and cloudtrail write actions, and rely on quarterly manual audits to confirm compliance.

Answer

Create an EventBridge rule in each member account that triggers a Lambda function to re-enable Config whenever StopConfigurationRecorder is called, and email the security team when CloudTrail is deleted.

Answer

Enable CloudTrail Insights and GuardDuty in every account so that anomalous API activity such as StopLogging generates findings that the security team can review and remediate.

Question 10

A media company allows external partners to upload files directly to an S3 bucket that feeds a downstream processing pipeline. The security team wants an automated, managed solution that scans newly uploaded objects for malware and prevents the pipeline from processing infected files, with minimal custom code and no need to manage scanning infrastructure. Which approach best satisfies these requirements?

Accepted Answer

Enable GuardDuty Malware Protection for S3 on the bucket, and use the object tags it applies (scan status) combined with an S3 bucket policy or EventBridge-triggered logic to block or route infected objects away from the pipeline.

Answer

Deploy a fleet of EC2 instances running an open-source antivirus engine, triggered by S3 event notifications, and have the instances delete infected objects.

Answer

Enable Amazon Macie on the bucket to classify uploaded objects and automatically quarantine any object flagged as malware.

Answer

Turn on S3 Object Lock in governance mode so that infected objects cannot be modified or read by the downstream pipeline.

Question 11

A company has 40 AWS accounts managed in AWS Organizations and is adding roughly 5 new accounts per quarter. The security team wants Amazon GuardDuty findings from all accounts—including any account created in the future—to be centrally visible and managed from a single dedicated security account, with minimal ongoing manual effort. Which approach meets these requirements?

Accepted Answer

Designate the security account as the GuardDuty delegated administrator from the Organizations management account, then enable auto-enable for all existing accounts and turn on auto-enable for new organization member accounts.

Answer

Enable GuardDuty individually in each member account and configure a cross-account IAM role in the security account to periodically pull findings from every account via API on a scheduled Lambda function.

Answer

Enable GuardDuty in the Organizations management account and use an EventBridge rule to forward findings to the security account, adding new accounts to the rule as they are created.

Answer

Send GuardDuty invitations from the security account to each member account and re-run an onboarding script manually whenever a new account joins the organization.

Question 12

A company runs production microservices on Amazon EKS. The security team wants to detect runtime threats inside containers, such as processes connecting to known cryptomining domains or containers escaping to the host, while minimizing operational overhead. They already have GuardDuty enabled with foundational data sources. What is the MOST operationally efficient way to achieve container-level runtime threat detection?

Accepted Answer

Enable GuardDuty Runtime Monitoring for EKS and use automated agent management so GuardDuty deploys and maintains the security agent on the cluster nodes.

Answer

Deploy a third-party host-based IDS as a DaemonSet on every node and forward alerts to Security Hub through a custom Lambda integration.

Answer

Enable VPC Flow Logs on the EKS worker node subnets and build CloudWatch Logs Insights queries to identify connections to malicious domains.

Answer

Enable GuardDuty EKS Audit Log Monitoring only, which inspects Kubernetes control plane API activity for suspicious runtime behavior inside containers.

Question 13

A security team has enabled Amazon GuardDuty across an AWS Organization with a delegated administrator account. A dedicated vulnerability scanning EC2 instance runs authorized port scans against internal subnets every night as part of the compliance program. GuardDuty repeatedly generates 'Recon:EC2/Portscan' findings for this instance, flooding the security team's ticketing queue and desensitizing analysts to genuine threats. The team wants to stop these specific benign findings from consuming analyst attention while ensuring the same finding type is still generated and investigated when it originates from ANY other instance. What is the MOST operationally efficient approach?

Accepted Answer

Create a GuardDuty suppression rule in the delegated administrator account that filters on the finding type 'Recon:EC2/Portscan' combined with the scanning instance's resource ID, so matching findings are auto-archived but still recorded.

Answer

Add the scanning instance's IP addresses to a GuardDuty trusted IP list so GuardDuty no longer evaluates traffic from that instance.

Answer

Disable the 'Recon:EC2/Portscan' finding type in the GuardDuty detector for the entire organization to eliminate the noise.

Answer

Create an EventBridge rule that matches all 'Recon:EC2/Portscan' findings and routes them to a Lambda function that deletes the tickets after creation.

Question 14

A financial services company must continuously detect any IAM roles, S3 buckets, KMS keys, or other resources across their AWS Organization that grant access to external principals (accounts outside the organization). The security team wants a fully managed solution that generates findings when such external access is detected, aggregates them centrally, and requires minimal custom code. Auditors also require evidence that findings are reviewed and archived when access is intentional. Which approach BEST meets these requirements?

Accepted Answer

Enable IAM Access Analyzer with the organization as the zone of trust in a delegated administrator account, and use archive rules to automatically suppress findings for known-intentional external access.

Answer

Deploy an AWS Config organization conformance pack with custom Lambda rules that parse every resource policy for external ARNs and write results to an S3 evidence bucket.

Answer

Enable GuardDuty across the organization and create EventBridge rules that trigger when GuardDuty detects cross-account access to IAM roles and S3 buckets.

Answer

Use IAM Access Advisor in each member account on a scheduled basis and export the last-accessed data to a central account for review by auditors.

Question 15

A company must enforce a policy that all IAM user access keys across 50 member accounts in AWS Organizations are automatically deactivated after 90 days and users notified. A DevOps engineer wants a centrally managed, event-driven solution that runs without deploying and maintaining code in every account. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Deploy an AWS Config managed rule (access-keys-rotated) via an organization Config rule from the delegated administrator account, and configure an automatic remediation action using an SSM Automation document that assumes a cross-account role to deactivate the key and publish an SNS notification.

Answer

Create a Lambda function in each member account triggered by an EventBridge schedule that calls IAM ListAccessKeys, deactivates keys older than 90 days, and sends email through SES.

Answer

Enable IAM Access Analyzer in the management account to detect old access keys and rely on its findings to automatically deactivate keys after 90 days.

Answer

Configure a Secrets Manager rotation schedule of 90 days for each IAM user's access key so the keys are rotated and old versions invalidated automatically.

Question 16

A company uses AWS IAM Identity Center (successor to AWS SSO) with permission sets federated from an external identity provider. A compliance auditor requires that all human access to production accounts must automatically expire after a maximum of 1 hour and that every console and CLI action performed through federated access is captured in a tamper-evident, centrally aggregated audit trail. Currently, permission sets grant an 8-hour session and CloudTrail is enabled only in each member account. Which combination of changes BEST meets these requirements with the least ongoing operational effort?

Accepted Answer

Reduce the session duration on the relevant permission sets to 1 hour, and configure an organization trail in AWS CloudTrail that delivers events from all accounts to a central S3 bucket with log file validation enabled.

Answer

Write a Lambda function triggered every hour by EventBridge to revoke active IAM Identity Center sessions, and enable CloudTrail Insights in each member account.

Answer

Set the maximum session duration on the IAM roles that Identity Center provisions in each account to 1 hour manually, and configure S3 server access logging on each account's individual CloudTrail bucket.

Answer

Attach a permissions boundary limiting session length to 1 hour to each permission set, and enable AWS Config in all accounts to record IAM changes.

Question 17

A company allows individual application teams to create their own IAM roles for Lambda functions and EC2 instances so they can move quickly. The security team is concerned that developers could create roles with more privileges than they themselves hold, effectively escalating privileges. The security team wants to let developers continue self-servicing IAM role creation, but guarantee that no role they create can ever exceed a defined maximum set of permissions, and that developers cannot bypass the control by editing or deleting it. Which approach BEST meets these requirements?

Accepted Answer

Attach an IAM permissions boundary policy defining the maximum allowed permissions, and use an IAM policy condition (iam:PermissionsBoundary and Deny on iam:DeleteRolePermissionsBoundary) so developers can only create roles that have the mandated boundary attached.

Answer

Grant developers full iam:CreateRole permissions and rely on AWS Config custom rules to detect and delete any role that has excessive permissions after creation.

Answer

Create the roles centrally in a shared services account and have developers assume them via cross-account trust so they never call IAM APIs directly.

Answer

Apply a Service Control Policy that denies all iam:CreateRole calls, and require developers to open a ticket for the security team to create each role manually.

Question 18

A company stores database credentials in AWS Secrets Manager in a central security account (Account A). Application workloads running in a separate workload account (Account B) must retrieve these credentials at runtime. The security team requires that the secret be encrypted with a customer managed KMS key and that credentials automatically rotate every 30 days. After configuring cross-account IAM roles in Account B, the applications receive an AccessDeniedException when calling GetSecretValue. What combination of configurations is required to resolve the access issue while meeting the requirements?

Accepted Answer

Attach a resource-based policy to the secret in Account A granting the Account B role secretsmanager:GetSecretValue, and add a key policy statement on the customer managed KMS key granting the Account B role kms:Decrypt.

Answer

Enable automatic rotation on the secret and add the Account B role as a principal in the rotation Lambda's execution role so it inherits decrypt permissions.

Answer

Replace the customer managed KMS key with the AWS managed aws/secretsmanager key, since customer managed keys cannot be shared across accounts.

Answer

Add secretsmanager:GetSecretValue to the Account B role's identity policy only; cross-account secret access does not require a resource policy when IAM roles are configured.

Question 19

A company uses AWS Secrets Manager to store database credentials for an Amazon RDS for PostgreSQL instance. A DevOps engineer configured automatic rotation with a custom Lambda rotation function using the four-step rotation model. After deploying, the rotation runs but applications intermittently fail to authenticate immediately after each rotation event, receiving 'password authentication failed' errors for a brief period. Investigation shows the Lambda function updates the password in RDS during the createSecret step. Which change to the rotation function will resolve the intermittent authentication failures?

Accepted Answer

Move the logic that changes the database password from the createSecret step to the setSecret step, and only mark the AWSCURRENT stage after the finishSecret step completes.

Answer

Increase the Lambda function timeout and memory so the rotation completes faster and reduces the window of failed authentications.

Answer

Configure applications to retrieve the secret using the AWSPREVIOUS version stage so they always use the older working credentials.

Answer

Reduce the rotation schedule frequency from every 30 days to every 90 days to minimize how often the failures can occur.

Question 20

A financial services company discovers during an audit that several Lambda functions and ECS tasks read database credentials from environment variables set at deployment time. The security team must remediate this so that credentials are never stored statically in task definitions or function configuration, are automatically rotated every 30 days, and any access to the credentials is captured in a centralized audit trail for compliance reporting. Which approach BEST meets all of these requirements?

Accepted Answer

Store the credentials in AWS Secrets Manager, enable a rotation Lambda with a 30-day schedule, grant the workloads IAM permissions to call GetSecretValue at runtime, and rely on CloudTrail data events / Secrets Manager logging to record each retrieval.

Answer

Store the credentials as SecureString parameters in SSM Parameter Store encrypted with a KMS CMK, reference them in the task definitions using valueFrom, and use a scheduled EventBridge rule to overwrite the parameters every 30 days.

Answer

Keep the credentials in environment variables but encrypt the task definitions and function configuration with a customer-managed KMS key, and enable AWS Config to detect when credentials change.

Answer

Store the credentials in AWS Secrets Manager, but inject them into environment variables at deploy time using a CodePipeline stage so the workloads do not call the API at runtime, and rotate them manually each month.

More DOP-C02 practice