Implement techniques for identity and access management at scale.
25 practice questions under this official exam objective (DOP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
25 total · page 1 of 2Deny iam:CreateUser with an SCP attached to the research team's account
The Research Administrator permission set grants AdministratorAccess, and the requirement is that no one on the research team can create IAM users. A
Deny when the EC2 instance source VPC and IP do not match the caller's source VPC and IP v
Limiting instance credentials to the instance they belong to requires comparing where the credential was issued against where it is being used. The AW
Create an IAM OIDC identity provider, a role trusting the IdP audience, and use AssumeRole
An internal web app must call S3 in a specific account using the existing OIDC-only identity provider auth.company.com. Create an IAM OIDC identity pr
Granting EC2 Access to CodeArtifact for Python Packages
This question tests the correct method for an EC2 instance to authenticate with AWS CodeArtifact using IAM roles and the codeartifact login CLI. It es
Configure the EKS Pod Identity Agent add-on so pods obtain credentials without an OIDC pro
EKS Pod Identity gives pods AWS credentials without storing any IAM credentials in Kubernetes Secrets and without the instance metadata service. Becau
Deny all actions when ec2:MetadataHttpTokens is not required so existing instances lose AP
The requirement covers all current EC2 instances, including those already running, not only newly launched ones. An SCP that explicitly denies every a
Deny sso and sso-directory actions in the DevOps permission set with an aws:SourceAccount
The SCP attached at the organization root has no effect because AWS Organizations SCPs do not apply to the management account, which is precisely the
Enable IAM authorization on the API methods and require SigV4-signed requests from the int
The APIs are private behind an interface VPC endpoint, and after the resource policies were changed to allow only endpoint-sourced requests, invocatio
Use IAM Roles Anywhere for the on-premises pipeline and CodeArtifact external connections
To move an on-premises CI/CD pipeline and its public repository dependencies into CodeArtifact with the least overhead, create an IAM Roles Anywhere t
Replacing FullAWSAccess with an EC2-only Allow caps the admin roles to EC2 actions and den
Service control policies are evaluated at every level of the organization hierarchy, and an account's effective permissions are the intersection of wh
Update S3 bucket policies to the new IP range and deny S3 access with an SCP on the two OU
Two distinct changes are required: updating the permitted corporate IP range on the ten S3 buckets, and revoking S3 access for two organizational unit
Deny AWS actions from source IPs outside the company range with an SCP attached to the org
The company delegates a known IP range for its VPC CIDR blocks and all non-cloud hardware, and needs to prevent any principal outside that range from
Centralize a domain and shared-library repository in the shared services account and use i
Each application team needs full control over its own packages in its own account, while common libraries must be shared org-wide, and the design must
Federate the corporate IdP through IAM Identity Center with SAML and deny IAM user login p
Every console user must authenticate through the corporate identity provider. Configuring identity federation with SAML 2.0 in AWS IAM Identity Center
Define a PermissionBoundaries policy and a DeveloperBoundary attached to the CreateAndMana
Both the DevOps team and the developers must be able to create IAM users, but developers must not be able to grant those users excessive permissions,
Attach an instance profile with a CodeArtifact IAM role and run aws codeartifact login on
The EC2 instance must be able to pull a Python package from a CodeArtifact repository during the CodeDeploy BeforeInstall hook. The instance needs an
Create an EBS CSI driver IAM role with the required permissions and attach it to the CSI d
The PVC fails with could not create volume in EC2: UnauthorizedOperation, which is an authorization failure raised when the EBS CSI driver calls the E
Check for blocking SCPs and IAM permission boundaries, fix them in CodeCommit, and deploy
Developers in only some accounts are losing S3 access, and everything in the organization including IAM policies and S3 bucket policies is deployed th
Use IAM Roles Anywhere with per-device certificates for least-privilege EFS access and ama
Three requirements apply: traffic must stay private and encrypted over the Direct Connect connection, each device must follow least privilege, and acc
Allow the Kubernetes service account's assumed IAM role in the KMS key policy to use the k
The service account assumes an IAM role to reach Secrets Manager, and the secrets are encrypted with a customer managed KMS key. A key policy that doe