Apply automation for security controls and data protection.
31 practice questions under this official exam objective (DOP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
31 total · page 2 of 2Attach an instance profile with a CodeArtifact IAM role and run aws codeartifact login on
The EC2 instance must be able to pull a Python package from a CodeArtifact repository during the CodeDeploy BeforeInstall hook. The instance needs an
Set the existing WAF web ACL default action to Block and allow the office IP set at priori
Access must be limited to users from the corporate office, which is a known set of source IP addresses, so an AWS WAF IP address set is the matching c
Turn on ECR enhanced scanning and invoke an EC2 Image Builder container image pipeline fro
Continuously monitoring the container repository and automatically producing a new image when an operating system or language package vulnerability ap
Use IAM Roles Anywhere with per-device certificates for least-privilege EFS access and ama
Three requirements apply: traffic must stay private and encrypted over the Direct Connect connection, each device must follow least privilege, and acc
Allow the Kubernetes service account's assumed IAM role in the KMS key policy to use the k
The service account assumes an IAM role to reach Secrets Manager, and the secrets are encrypted with a customer managed KMS key. A key policy that doe
Store guardrail templates in CodeCommit and auto-trigger a CodePipeline pipeline via Event
The guardrails must be version controlled, reviewable, and rollbackable, must be maintained by the security team in their own organizational unit, and
Use an SCP to require the CostCenter tag, a tag policy for valid values, and update the sc
Developers are tagging EC2 instances with arbitrary CostCenter values to silence the notification script, so the tag key is present but the value is m
Add an ECR lifecycle policy expiring images with the matching tag after 15 days
The requirement is to automatically delete container images that carry a specific tag once they are older than fifteen days, and the repository holdin
Apply a permissions boundary through the CDK bootstrap default so both deployment and Lamb
Both the role developers assume to deploy the CDK application and the roles the CDK application attaches to the Lambda functions it creates carry more
Use AWS Config with a restricted-ssh custom rule on the configuration-change trigger and L
Security groups permitting SSH from 0.0.0.0/0 must be detected and remediated as soon as possible across all accounts in the organization. AWS Config
Enable ECR enhanced scanning and use EventBridge with Lambda to reject images with HIGH or
The pipeline must block deployment of images carrying HIGH or CRITICAL findings in either operating system packages or language packages, and the chec