Deploy automation to create, onboard, and secure AWS accounts in a multi-account or multi-Region environment.
12 practice questions under this official exam objective (DOP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
12 total · page 1 of 1Enable the proactive Control Tower S3 KMS-encryption control with CloudFormation hooks on
Every S3 bucket created through CloudFormation must be KMS-encrypted at creation time. Because the requirement applies to bucket creation within stack
Restrict CodeConnections Provider and HA Regions
This guide explains how to restrict AWS CodeConnections to a specific Git provider using SCPs and ensure high availability across Regions by creating
Use a service-managed StackSet on the root OU and deploy a separate stack in the managemen
CloudFormation StackSets does not create stack instances in the Organizations management account, even when the organization root is a deployment targ
Deny sso and sso-directory actions in the DevOps permission set with an aws:SourceAccount
The SCP attached at the organization root has no effect because AWS Organizations SCPs do not apply to the management account, which is precisely the
Deploying CDK Security Controls Across AWS Accounts
This question evaluates the ability to deploy standardized security controls across a multi-account AWS environment using AWS Control Tower and CloudF
Create a Control Tower landing zone with per-team OUs, enroll existing accounts, and provi
The requirement is preventive and detective governance across all current accounts plus automatic coverage of accounts created in the future, with a d
Create the AWSControlTowerExecution role in the new account and enroll it with the Service
Enrolling a newly created account into an existing AWS Control Tower landing zone requires two things in the workflow: the new account must contain an
Use a CloudFormation hook enforcing encryption and deploy it across the OU with StackSets
The policy must be enforced before a CloudFormation stack operation proceeds in the accounts of the organizational unit, which means the control has t
Build an Account Factory Customization blueprint with the baseline and provision every acc
Every account must receive the Control Tower guardrails and an initial baseline configuration, with the least operational overhead. An Account Factory
Federate the corporate IdP through IAM Identity Center with SAML and deny IAM user login p
Every console user must authenticate through the corporate identity provider. Configuring identity federation with SAML 2.0 in AWS IAM Identity Center
Store guardrail templates in CodeCommit and auto-trigger a CodePipeline pipeline via Event
The guardrails must be version controlled, reviewable, and rollbackable, must be maintained by the security team in their own organizational unit, and
Create a cross-account role in the management account that the new account's Lambda execut
Only the Organizations management account can create new accounts, so moving the Lambda function to a dedicated account requires the new account's Lam