Security and Compliance — AWS Certified DevOps Engineer DOP-C02 practice questions

A team wants AWS Inspector v2 to continuously scan all ECR images in the account for CVEs and notify on critical findings. Which configuration is BEST?

1. Enable Inspector v2 with ECR scanning at the account level
2. It fails closed when any dependent AWS service is degraded
3. It cannot integrate with AWS Systems Manager runbooks here
4. It is a container-only feature not supported on serverless

Answer: A — Enable Inspector v2 with ECR scanning at the account level

Inspector v2 + EventBridge findings is the documented pattern. B/C/D scan different things.

AWS CONFIG REMEDIATION:

1. Manually applying fixes after reviewing Config console findings each week
2. Auto-remediation via SSM Automation documents triggered when an AWS Config rule reports non-compliance
3. Deleting non-compliant resources automatically with no operator review
4. AWS Config rules that only alert via email with no remediation path

Answer: B — Auto-remediation via SSM Automation documents triggered when an AWS Config rule reports non-compliance

Config + Auto Remediation: governance at scale. SSM Automation documents fix common drifts. EventBridge can route Config events to Lambda for custom actions. Conformance Packs bundle rules + remediations. Critical for compliance enforcement. DOP governance + automation.

A team wants to enforce that no IAM principal can disable CloudTrail in any account. Which control BEST achieves this org-wide?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. Service Control Policy on the Organization root denying
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: C — Service Control Policy on the Organization root denying

SCPs are the org-wide preventive control. B is per-principal. C/D are detective.

CONTAINER IMAGE SCANNING:

1. ECR enhanced scanning (Inspector v2 integration): vulnerability +
2. It only functions when all resources are in a single AZ zone
3. It writes findings to S3 only and cannot notify EventBridge for th
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: A — ECR enhanced scanning (Inspector v2 integration): vulnerability +

Container image scanning: critical for security. ECR Basic Scanning (free, CVEs only). Enhanced Scanning (Inspector v2 integration) — secrets + OS + language packages. Lambda containers also scanned. Quarantine vulnerable images. Tools alternative: Trivy, Snyk, Aqua in pipeline. DOP container security.

Which is the BEST way to detect and block AWS API actions originating from IP ranges outside the corporate network?

1. IAM policy condition with aws:SourceIp deny on key roles, paired
2. It only functions when all resources are in a single AZ zone
3. It writes findings to S3 only and cannot notify EventBridge for th
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: A — IAM policy condition with aws:SourceIp deny on key roles, paired

aws:SourceIp in IAM conditions is the documented IP guardrail; GuardDuty supplies detection. B/C don't reach IAM. D doesn't help.

Which is the recommended way to manage SECRETS in CI/CD pipelines?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. It runs exclusively on Fargate and cannot target EC2 fleets
4. AWS Secrets Manager (rotating credentials) and Parameter

Answer: D — AWS Secrets Manager (rotating credentials) and Parameter

Secrets management: Secrets Manager for rotation (DB creds), Parameter Store (free standard tier) for general config. Pipeline IAM role retrieves at runtime. Reference in CodeBuild buildspec, ECS task definition, Lambda env vars (encrypted with KMS).

A team needs to grant a CI/CD role in account A access to deploy to an S3 bucket in account B. Which is the CORRECT combination?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. Bucket policy in account B granting the account-A role
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: C — Bucket policy in account B granting the account-A role

Cross-account S3 requires both sides. Off-by-one IAM trap. B/C alone fails. D denies but doesn't grant.

Which is the BEST way to enforce security policies in IaC?

1. Manually reviewing templates in pull requests with no automated tooling
2. cfn-lint / cfn-nag (CloudFormation linting) and CDK Aspects for pre-deployment policy checks, backed by AWS Config rules post-deployment
3. Relying solely on IAM permissions to block insecure resource creation
4. Running security scans only after resources are already deployed to production

Answer: B — cfn-lint / cfn-nag (CloudFormation linting) and CDK Aspects for pre-deployment policy checks, backed by AWS Config rules post-deployment

Policy-as-code for IaC: pre-deployment linting (cfn-nag, cfn-lint, Checkov, tfsec). CDK Aspects programmatic enforcement. Post-deployment AWS Config rules + remediation. Defense in depth.

AWS WAF managed rules need to block known SQL injection patterns on a CloudFront distribution. The team also wants log samples of blocked requests for tuning. Which configuration is CORRECT?

1. Attach the AWS managed SQL injection rule group to the WAF web
2. It only functions when all resources are in a single AZ zone
3. It writes findings to S3 only and cannot notify EventBridge
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: A — Attach the AWS managed SQL injection rule group to the WAF web

Managed rule + WAF logging is the documented setup. Shield Standard is DDoS only. C/D unrelated.

A team needs all CloudTrail logs to be immutable and queryable via SQL for 7 years. Which BEST combination meets the requirement?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge for th
3. CloudTrail Lake event data store with extended retention up to 7
4. It runs exclusively on Fargate and cannot target EC2 fleets for th

Answer: C — CloudTrail Lake event data store with extended retention up to 7

CloudTrail Lake supports up to 7-year retention + SQL. Object Lock for immutability. B is short retention. C lacks immutability. D wrong.

AWS WAF managed rules?

Pre-built rule sets (OWASP Top 10, bot control). Save custom rule writing.

Secrets Manager rotation?

Lambda function rotates secret. Built-in for RDS.

Security Hub auto-remediation?

Custom action → EventBridge → Lambda fixes finding.

Parameter Store SecureString?

KMS-encrypted parameter. For non-rotating config secrets.