Apply automation for security controls and data protection.
31 practice questions under this official exam objective (DOP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
31 total · page 1 of 2Set the vulnerable CodeArtifact package version to archived and allow direct publishing wh
A critical vulnerability was found in the most recently consumed version of a package that the repository pulls from a public upstream, and the vulner
Activate the Control Tower RDS encryption guardrail and notify through EventBridge to SNS
With AWS Control Tower already governing the landing zone and all databases running on Amazon RDS, the most operationally efficient compliance path is
Deploy a restrictive instance template with Lambda and EventBridge to isolate instances ca
To automatically isolate compromised EC2 instances across all accounts when a specific tag is applied, standardize the behavior with a CloudFormation
Enable the proactive Control Tower S3 KMS-encryption control with CloudFormation hooks on
Every S3 bucket created through CloudFormation must be KMS-encrypted at creation time. Because the requirement applies to bucket creation within stack
Deny when the EC2 instance source VPC and IP do not match the caller's source VPC and IP v
Limiting instance credentials to the instance they belong to requires comparing where the credential was issued against where it is being used. The AW
Centralize pre-scan and post-scan ECR repositories in the shared account and gate promotio
To centralize container image scanning with the least administrative overhead, create the pre-scan and post-scan Amazon ECR repositories in the shared
Give each application an S3 Object Lambda access point that redacts data as objects are re
Because the raw data must be redacted differently for each of the three reporting applications, each application needs its own on-read transformation.
Deny all actions when ec2:MetadataHttpTokens is not required so existing instances lose AP
The requirement covers all current EC2 instances, including those already running, not only newly launched ones. An SCP that explicitly denies every a
Trigger CodePipeline with EventBridge on new commits and alert from ECR image scan finding
Two capabilities are required. First, the manual build and deploy process must become automated, which is done by storing the Dockerfile and deploymen
Create a Control Tower landing zone with per-team OUs, enroll existing accounts, and provi
The requirement is preventive and detective governance across all current accounts plus automatic coverage of accounts created in the future, with a d
Enforce the cost allocation tag with CDK tagging and deploy SQS queues defined as CDK cons
Two problems must be solved together: the cost allocation tag is not always applied, and SQS queues in different stacks end up with different configur
Replacing FullAWSAccess with an EC2-only Allow caps the admin roles to EC2 actions and den
Service control policies are evaluated at every level of the organization hierarchy, and an account's effective permissions are the intersection of wh
Update S3 bucket policies to the new IP range and deny S3 access with an SCP on the two OU
Two distinct changes are required: updating the permitted corporate IP range on the ten S3 buckets, and revoking S3 access for two organizational unit
ECR Pull Through Cache and VPC Endpoints for ECS
This question tests securing Amazon ECS by using ECR pull-through cache rules to proxy public images and Interface VPC endpoints for private repositor
Use a CloudFormation hook enforcing encryption and deploy it across the OU with StackSets
The policy must be enforced before a CloudFormation stack operation proceeds in the accounts of the organizational unit, which means the control has t
Use Macie and Step Functions to redact PII in production before copying, and schedule the
The compliance requirement is that PII must be anonymized before it leaves the production environment, and that each environment uses its own KMS key.
Build an Account Factory Customization blueprint with the baseline and provision every acc
Every account must receive the Control Tower guardrails and an initial baseline configuration, with the least operational overhead. An Account Factory
Deny AWS actions from source IPs outside the company range with an SCP attached to the org
The company delegates a known IP range for its VPC CIDR blocks and all non-cloud hardware, and needs to prevent any principal outside that range from
Define a PermissionBoundaries policy and a DeveloperBoundary attached to the CreateAndMana
Both the DevOps team and the developers must be able to create IAM users, but developers must not be able to grant those users excessive permissions,
Implement the token check in a CloudFront Function with CloudWatch logging and continuous
The authorization token check must happen at the edge so that CloudFront and S3 can both be protected from direct access, the check activity must be l