AWS DOP-C02 Free Practice Questions — Page 2

Correct Answers: A. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.; D. In the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role.; F. In the source account, share the encrypted AMI with the target account

Why these are correct: A: You must copy the unencrypted AMI to create an encrypted version, specifying the KMS key from the source account. This creates an encrypted AMI that can be shared. D: The key policy must grant the target account permissions to create a grant, and the target account must create a KMS grant that delegates permissions to the Auto Scaling group service-linked role. This allows the Auto Scaling group to use the encrypted AMI and decrypt the EBS volumes. F: You must share the encrypted AMI (not the unencrypted one) with the target account so it can launch instances from it. Why other options are wrong: B: Using the default EBS encryption key won't work for cross-account sharing because the default key cannot be shared across accounts. You must use a customer-managed KMS key. C: Creating the grant in the source account for the target account's service-linked role is insufficient. The target account needs permissions to create the grant itself. E: Sharing the unencrypted AMI doesn't meet the encryption requirement.

Correct Answers: A. Create a new version of the common AMI with the CodeDeploy agent installed. Update the IAM role of the EC2 instances to allow access to CodeDeploy.; D. Create an application in CodeDeploy. Con gure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application.

Why these are correct: A: The CodeDeploy agent must be installed on EC2 instances for CodeDeploy to manage deployments. Creating a new AMI with the agent pre-installed ensures all instances launched by Auto Scaling have it. The IAM role must have permissions to access CodeDeploy services. D: Creating a CodeDeploy application with in-place deployment type allows updating existing instances. Specifying the Auto Scaling group as the deployment target enables CodeDeploy to manage all instances in the group. Adding the CodeDeploy action to the pipeline integrates the deployment stage. Why other options are wrong: B: The AppSpec file defines deployment steps but doesn't "grant access to CodeDeploy"—that's done through IAM roles. C: CodeDeploy in-place deployments update existing instances; they don't create new AMIs during deployment. EC2 Image Builder is unnecessary for this use case. E: Specifying individual EC2 instances as targets doesn't work well with Auto Scaling, as instances can be terminated and replaced. Targeting the Auto Scaling group is the correct approach.

Correct Answers: A. Delegate AWS Firewall Manager to a security account.; C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs.

Why these are correct: A: AWS Firewall Manager must be delegated to a security account to centrally manage WAF policies across all accounts in the organization. This provides centralized security management. C: Firewall Manager policies can automatically attach WAF web ACLs to resources like ALBs and API Gateway APIs as they're created. This ensures compliance and prevents violations proactively. Why other options are wrong: B & D: Amazon GuardDuty is a threat detection service, not a policy enforcement tool. It doesn't manage WAF web ACLs or attach them to resources. E: AWS Config detects compliance violations but doesn't proactively attach WAF web ACLs to newly created resources. It's reactive rather than preventive, and Config rules don't "attach" resources—they only report compliance status.

Correct Answer: C. Develop an AWS Con g custom rule that publishes to an Amazon Simple Noti cation Service (Amazon SNS) topic when keys are more than 90 days old.

Why C is correct: AWS Config custom rules can evaluate resource configurations against specific criteria. A custom rule can check the last rotation date of KMS keys and determine if they exceed 90 days. When keys are non-compliant (not rotated), the rule can trigger an SNS notification to alert the security team. Config continuously monitors resources, making it ideal for this compliance requirement.Why other options are wrong: A: AWS KMS does not have a built-in feature to publish to SNS when keys haven't been rotated. Manual rotation doesn't trigger automatic notifications. B: AWS Trusted Advisor doesn't have specific checks for KMS key rotation age. This would require custom logic that Trusted Advisor doesn't provide. D: AWS Security Hub aggregates security findings from various services but doesn't have a native check for KMS key rotation age that triggers SNS notifications.

Correct Answer: C. Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script.

Why C is correct: Removing unauthenticated access via a bucket policy enforces security. Modifying the CodeBuild service role to include S3 permissions allows CodeBuild to authenticate using IAM, which is AWS best practice. Using the AWS CLI to download the script leverages the service role's credentials automatically. This is the most secure approach using IAM-based authentication. Why other options are wrong: A: CodeBuild doesn't have an "AllowedBuckets" section in project settings. This isn't a valid configuration option. B: S3 doesn't support HTTPS basic authentication with tokens. S3 uses IAM for authentication and authorization. D: Hardcoding IAM access keys and secret access keys in the build spec is a major security anti-pattern. Credentials should never be embedded in code or configuration files. Using the service role is the secure method.