Overview
Security and Compliance has three task statements. The first is identity at scale: least-privilege policies, role-based and attribute-based access control, automatic credential rotation for machine identities with AWS Secrets Manager, and controlling human and machine access with MFA, AWS STS and instance profiles. The second automates security controls across accounts and Regions with Security Hub, Organizations, Control Tower and Systems Manager, layers defenses with ACM, AWS WAF, Config, GuardDuty, security groups, network ACLs, Detective and Network Firewall, discovers sensitive data with Amazon Macie, and encrypts data with KMS, CloudHSM and ACM.
The third task statement covers security monitoring and auditing: robust audit trails, alerts on unexpected or anomalous events, CloudTrail and CloudWatch Logs configuration, and analysis of logs, metrics and findings.
How it's tested
Domain 6 questions describe an access requirement, a protection gap or a security event across many accounts. You choose the identity pattern, layered control, encryption option or detection and alerting setup that enforces policy automatically and leaves an audit trail.
-
Right-size access
Users or workloads need access, and you choose roles, ABAC tags, permissions boundaries or session policies that keep it minimal.
-
Layer the controls
A threat or exposure is described, and you choose the combination of WAF, network controls, Config rules and detection services.
-
Detect and respond
Suspicious activity must be caught, and you route GuardDuty, Security Hub or CloudTrail signals to alerts and automated actions.
Developers create resources tagged with their project, and each should manage only their own project's resources as projects multiply. Writing a role per project does not scale. An attribute-based policy that allows actions only when the resource's project tag matches the principal's project tag grants access automatically for new projects, so ABAC is the better design.
Task statements 3
Official task statements from the Amazon Web Services outline, in outline order.
6.1 Implement techniques for identity and access management at scaleLeast privilege, RBAC and ABAC, machine credential rotation and human and machine access controls.
- What it means
- This task covers designing least-privilege policies, implementing role-based and attribute-based access control, rotating machine credentials automatically with AWS Secrets Manager, and managing access for people and workloads through MFA, AWS STS temporary credentials and IAM instance profiles.
- What to understand
- Least privilege starts with narrow actions and resources, tightened with conditions and checked with IAM Access Analyzer policy generation and validation. ABAC uses tags on principals and resources, so policies stay constant as teams grow. Secrets Manager rotates database credentials with a Lambda rotation function. Workloads should use roles and temporary credentials, never long-lived access keys.
- How it shows up
- An access model must scale or tighten, and you choose the policy pattern or credential mechanism.
- Common confusion
- Thinking a permissions boundary grants access; like an SCP, it only sets a maximum.
6.2 Apply automation for security controls and data protectionMulti-account security automation, defense in depth, sensitive data discovery and encryption.
- What it means
- This task covers automating security controls across accounts and Regions with Security Hub, Organizations, Control Tower and Systems Manager, combining controls such as ACM, AWS WAF, Config rules, GuardDuty, security groups, network ACLs, Detective and Network Firewall, discovering sensitive data with Amazon Macie, and encrypting data in transit and at rest with KMS, CloudHSM and ACM.
- What to understand
- Delegated administrator accounts let Security Hub, GuardDuty and Macie be enabled for every member account, including new ones. Security groups are stateful and attach to interfaces, while network ACLs are stateless and attach to subnets. KMS key policies control who can use a key. CloudHSM gives single-tenant HSMs when keys must stay under customer control.
- How it shows up
- A protection requirement is stated, and you choose which controls to combine and how to automate them.
- Common confusion
- Choosing CloudHSM when KMS meets the requirement; CloudHSM is for dedicated, customer-controlled hardware.
6.3 Implement security monitoring and auditing solutionsAudit trails, anomaly alerts, service and application logging, and analysis of findings.
- What it means
- This task covers implementing robust security auditing, alerting on unexpected or anomalous security events, configuring logging with CloudTrail and CloudWatch Logs, and analyzing logs, metrics and security findings.
- What to understand
- An organization trail records management events for every account into a central, protected bucket, and log file validation detects tampering. Data events such as S3 object access must be enabled separately. EventBridge rules on GuardDuty findings or sensitive API calls can notify or remediate. Security Hub aggregates findings, and Detective helps investigate their root cause.
- How it shows up
- Security events must be recorded, detected or investigated, and you choose the logging and alerting design.
- Common confusion
- Assuming CloudTrail records S3 object-level reads by default; data events need explicit configuration.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Least privilege
Grant only the actions and resources required.
- Remember
- Access Analyzer can generate policies from activity.
- Tested as
- Policy design questions.
- Trap
- Using wildcards for convenience.
-
ABAC
Access decisions based on matching tags.
- Remember
- Scales without new policies per team.
- Tested as
- Growing organizations.
- Trap
- Creating a role per project instead.
-
Permissions boundary
Maximum permissions for an IAM entity.
- Remember
- Lets developers create roles safely.
- Tested as
- Delegated administration.
- Trap
- Treating it as a grant.
-
Secrets Manager rotation
Scheduled rotation using a Lambda function.
- Remember
- Managed rotation exists for supported databases.
- Tested as
- Machine credential questions.
- Trap
- Rotating without updating the application to fetch the secret.
-
AWS STS
Issues temporary security credentials.
- Remember
- AssumeRole underlies cross-account access.
- Tested as
- Machine and human access.
- Trap
- Distributing long-lived access keys.
-
Amazon GuardDuty
Threat detection from logs and runtime signals.
- Remember
- Enable organization-wide with a delegated admin.
- Tested as
- Detecting compromise.
- Trap
- Expecting it to block traffic itself.
-
AWS Security Hub
Aggregates findings and runs security standard checks.
- Remember
- Cross-Region aggregation available.
- Tested as
- Central security posture.
- Trap
- Thinking it detects threats on its own like GuardDuty.
-
Amazon Detective
Investigates findings using linked activity data.
- Remember
- Used after detection to find root cause.
- Tested as
- Investigation scenarios.
- Trap
- Choosing it for detection.
-
Amazon Macie
Discovers sensitive data in S3.
- Remember
- Automated discovery runs across buckets.
- Tested as
- PII discovery questions.
- Trap
- Using GuardDuty to find PII.
-
AWS KMS key policies
Resource policies that control key use.
- Remember
- Cross-account use needs key policy and IAM permission.
- Tested as
- Encryption access issues.
- Trap
- Granting IAM permission without a key policy statement.
-
CloudTrail organization trail
Single trail logging all member accounts.
- Remember
- Members cannot disable it.
- Tested as
- Audit requirements.
- Trap
- Creating separate trails each team can delete.
-
AWS WAF
Filters HTTP requests at CloudFront, ALB or API Gateway.
- Remember
- Managed rule groups cover common attacks.
- Tested as
- Application-layer protection.
- Trap
- Using network ACLs for SQL injection.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Detection and investigation services
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| GuardDuty | Detects threats | Analyzes logs and runtime signals | Expecting automatic blocking |
| Security Hub | Aggregates findings and checks standards | Central view and scoring | Expecting raw threat detection |
| Detective | Investigates findings | Graphs related activity | Choosing it to detect |
| Macie | Finds sensitive data in S3 | Data classification | Using it for network threats |
Permission limits
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Identity policy | Grants permissions to a principal | Allows actions | Forgetting resource policies also matter |
| Permissions boundary | Caps one principal's permissions | Per user or role | Treating it as an allow |
| SCP | Caps permissions for accounts | Per account or OU | Expecting it to affect the management account |
Network controls
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Security group | Stateful, instance level | Allow rules only | Trying to add deny rules |
| Network ACL | Stateless, subnet level | Allow and deny rules | Forgetting return traffic ports |
| AWS Network Firewall | Managed stateful firewall for VPCs | Deep inspection and domain filtering | Using it for HTTP-layer rules WAF handles |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Detective for detection
- What candidates pick
- Enable Amazon Detective to detect compromised instances.
- Why it looks right
- The name suggests detecting.
- Why it's wrong
- Detective investigates existing findings; GuardDuty is the service that detects threats.
Clue to watch for Requirement is to detect suspicious activity.
-
Network ACL for web attacks
- What candidates pick
- Block SQL injection with network ACL rules.
- Why it looks right
- ACLs can deny traffic.
- Why it's wrong
- ACLs filter by IP and port and cannot inspect HTTP content; AWS WAF rules can.
Clue to watch for Application-layer attack patterns.
-
Rotation without retrieval
- What candidates pick
- Turn on Secrets Manager rotation while apps keep a copied password.
- Why it looks right
- Rotation is now enabled.
- Why it's wrong
- Applications holding a copy break after rotation; they must fetch the secret at runtime.
Clue to watch for Rotation causes outages.
-
IAM-only KMS sharing
- What candidates pick
- Add kms:Decrypt to the other account's role policy.
- Why it looks right
- IAM normally grants access.
- Why it's wrong
- Cross-account key use also requires the key policy to trust that account.
Clue to watch for AccessDenied on a key from another account.
-
Per-account trails
- What candidates pick
- Create a trail in each account managed by its team.
- Why it looks right
- Teams own their accounts.
- Why it's wrong
- Members could stop or delete them; an organization trail to a locked central bucket is tamper-resistant.
Clue to watch for Audit logs must not be disabled by account users.
-
CloudHSM by default
- What candidates pick
- Move all encryption keys into CloudHSM.
- Why it looks right
- Dedicated hardware sounds safer.
- Why it's wrong
- KMS meets most needs with less effort; CloudHSM fits only explicit single-tenant or FIPS-level key control requirements.
Clue to watch for No dedicated-HSM requirement is stated.
-
Findings without action
- What candidates pick
- Enable Security Hub and consider the requirement met.
- Why it looks right
- Findings are now centralized.
- Why it's wrong
- Automatic response needs EventBridge rules routing findings to Lambda, Automation or notifications.
Clue to watch for Requirement says respond automatically.
Answer framework
Apply these steps to any DOP-C02 question about access, protection or security monitoring.
- Identify who or what needs access, human or machine, and from which account, then prefer roles with short-lived temporary credentials.
- Pick the policy layer that matches the scope: identity policy, resource policy, permissions boundary, session policy or SCP.
- For protection, list the layers involved, such as edge, network, host, data and identity, and pick one control for each gap.
- Choose the right security service for the job: GuardDuty detects, Macie classifies, Security Hub aggregates and Detective investigates.
- Make it organization-wide with delegated administrators so new accounts are covered, and route findings through EventBridge to alerts, tickets or automatic remediation runbooks.
Practice question
Want more like this? The DOP-C02 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with identity because it underpins the rest. Write and test policies in a sandbox: a least-privilege policy with conditions, an ABAC policy based on tags, a permissions boundary for developer-created roles, and a cross-account role. Use IAM Access Analyzer to validate each one. Then store a database credential in Secrets Manager, turn on rotation, and confirm the application still connects afterwards.
Next, enable the security services through delegated administrators in a test organization: GuardDuty, Security Hub with a security standard, Macie and Detective. Generate sample findings, route them through EventBridge to SNS and a Lambda function, and follow one finding into Detective. Add AWS WAF managed rules in front of an ALB.
Finally, set up an organization trail to a central bucket with log file validation, enable S3 data events for one bucket, and review KMS key policies for cross-account access. Keep a comparison card of the security services and review it before each practice exam.
FAQ
How much of DOP-C02 is Security and Compliance?
Security and Compliance is 17% of scored content, about 11 of the 65 scored questions, tied with Configuration Management and IaC.
How deep does DOP-C02 go on IAM policy evaluation?
Deep enough to know that an explicit deny wins, and that SCPs, permissions boundaries and session policies cap permissions while identity and resource policies grant them.
Do I need the Security Specialty exam first?
No. There are no prerequisites. Security Specialty goes deeper, but this domain focuses on automating security across accounts as part of DevOps work.
Is Amazon Inspector in scope?
Inspector is not named in these task statements, but it can appear as a vulnerability scanning option. Check the in-scope services list in the exam guide and know its role versus GuardDuty.
When is CloudHSM the right answer?
Choose it when the question requires dedicated single-tenant hardware or full customer control of key material. Otherwise KMS is simpler and integrates with more services.
Which logs matter most for security auditing?
CloudTrail management and data events, VPC Flow Logs, and application logs in CloudWatch Logs. Know how to centralize, protect and alert on each.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 6 knowledge
You have covered access at scale, automated controls, encryption and security auditing. See whether you can separate similar security services in timed questions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the DOP-C02 AI tutor Get any concept explained your way