6.0 Security and Compliance DOP-C02 Practice Quiz

• A. An IAM role assumed by the pipeline with scoped deployment permissions
• B. A shared root user access key stored as a pipeline secret
• C. A human IAM user reused by every pipeline
• D. A resource tag that contains the access key

A role provides temporary credentials and can be scoped to the deployment actions and target resources instead of storing long-term keys. This is the correct answer.

• A. Cross-account IAM role with an external ID and least-privilege permissions
• B. An administrator access key emailed to the SaaS provider
• C. A public CloudWatch dashboard that includes all account data
• D. A shared root password stored in the SaaS configuration

A cross-account role with external ID reduces confused-deputy risk and avoids sharing long-term credentials. This is the correct answer.

• A. Permanent access keys assigned directly to the developer for production
• B. Federated human access to roles with time-bound or approval-based production elevation
• C. An EC2 instance profile attached to the developer's laptop
• D. A bucket policy granting the developer all AWS actions

Human access should use federation and roles so permissions are temporary, auditable, and aligned to environment need. This is the correct answer.

• A. Use IAM users with long-term keys for every workload and every employee
• B. Use federated roles for humans, service roles for AWS services, and instance or task roles for workloads
• C. Use security groups as the primary human identity store
• D. Use S3 bucket ACLs to represent every machine identity

Different principals need identity mechanisms designed for their lifecycle, credential delivery, and audit requirements. This is the correct answer.

• A. A standalone IAM user that nobody reviews
• B. Federated access controlled by identity provider group membership
• C. A permanent access key stored in the contractor's local tool
• D. A security group rule named after the contractor

Group-driven federation ties AWS access to the central identity lifecycle, reducing stale account access. This is the correct answer.

• A. A plaintext IAM access key stored in the AMI
• B. A developer's personal access key copied into user data
• C. An IAM role attached through an EC2 instance profile
• D. The account root credentials stored in an environment variable

An instance profile delivers temporary credentials to the instance without embedding static keys in the application. This is the correct answer.

• A. Separate IAM users created manually in every account
• B. Shared administrator credentials for each team
• C. AWS IAM Identity Center integrated with the identity provider
• D. S3 bucket policies as the workforce login system

IAM Identity Center enables federated workforce access to multiple AWS accounts through centralized permission assignments. This is the correct answer.

• A. An IAM group assigned to the Lambda function
• B. A console password embedded in the function package
• C. An unrestricted administrator user created for the function
• D. The Lambda execution role with only the required S3 and DynamoDB actions

The execution role is the machine identity for Lambda and should grant only the calls the function needs. This is the correct answer.