Implement security monitoring and auditing solutions.
11 practice questions under this official exam objective (DOP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
11 total · page 1 of 1Activate the Control Tower RDS encryption guardrail and notify through EventBridge to SNS
With AWS Control Tower already governing the landing zone and all databases running on Amazon RDS, the most operationally efficient compliance path is
Use configuration change recording with the ssh-restricted Config rule and SNS for notific
The environment scales in and out frequently, so recording must capture configuration changes as they occur rather than only on a periodic schedule, a
Query an Athena table over the organization CloudTrail trail with partition projection to
Finding the top users and roles across all accounts requires the CloudTrail data from every account in one place and a query engine efficient enough t
Add a resource-based policy to the Lambda function so AWS Config can invoke it
A custom AWS Config rule that uses a Lambda function requires AWS Config to be authorized to invoke that function, which is granted through a resource
Enable GuardDuty EKS Audit Log Monitoring and Amazon Detective with EKS audit logs as a so
The platform needs additional security for unauthorized logins and abrupt logouts on EKS, plus a summarized view of resource behaviour across the envi
Use an organization trail in the management account with CloudWatch anomaly detection and
Monitoring S3 access across all accounts requires a single organization trail delivered to CloudWatch in the Organizations management account, with da
Create a custom metric for blocked requests from a metrics filter and alarm using CloudWat
The alert must fire on sudden changes in blocked traffic and must not fire on other changes in WAF log behavior. A CloudWatch Logs metrics filter that
Send CloudTrail management events to CloudWatch Logs, filter failed ConsoleLogin, and alar
Console sign-in activity is recorded by CloudTrail as management events, so those events are what must be delivered to CloudWatch Logs. A CloudWatch L
Match the CloudTrail event pattern for AssumeRole in EventBridge and notify SNS from a Lam
Assuming a role is recorded by CloudTrail as an API call, so the way to observe it is a CloudTrail event pattern filtered on the AssumeRole action for
Use Systems Manager Inventory with AWS Config rules to identify prohibited applications
Auditing which applications are installed across a fleet is exactly what Systems Manager Inventory collects, and AWS Config can evaluate that inventor
Use AWS Config with a restricted-ssh custom rule on the configuration-change trigger and L
Security groups permitting SSH from 0.0.0.0/0 must be detected and remediated as soon as possible across all accounts in the organization. AWS Config