Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

DOP-C02 AWS Certified DevOps Engineer- Professional

  • Amazon
  • 12 free sample questions

About this exam

DOP-C02 is the Amazon exam AWS Certified DevOps Engineer- Professional. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
DOP-C02
Vendor
Amazon
Practice questions
Not available yet
Free sample questions
12
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for DOP-C02.

Question 1

A company has multiple accounts in an organization in AWS Organizations. The company's
SecOps team needs to receive an Amazon Simple Notification Service (Amazon SNS)
notification if any account in the organization turns off the Block Public Access feature on
an Amazon S3 bucket. A DevOps engineer must implement this change without affecting
the operation of any AWS accounts. The implementation must ensure that individual
member accounts in the organization cannot turn off the notification. Which solution will
meet these requirements?

  1. Option A:
    Designate an account to be the delegated Amazon GuardDuty administrator account.
    Turn on GuardDuty for all accounts across the organization. In the GuardDuty administrator
    account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. In the same
    account, create an Amazon EventBridge rule that uses an event pattern for GuardDuty findings and a
    target of the SNS topic.
  2. Option B:
    Create an AWS CloudFormation template that creates an SNS topic and subscribes the
    SecOps team’s email address to the SNS topic. In the template, include an Amazon EventBridge rule uses an event pattern of CloudTrail activity for s3: PutBucketPublicAccessBlock and a target of the SNS topic. Deploy the stack to every account in the organization by using CloudFormation StackSets.
  3. Option C:
    Turn on AWS Config across the organization. In the delegated administrator account, create an SNS
    topic. Subscribe the SecOps team's email address to the SNS topic. Deploy a conformance pack that
    uses the s3-bucket-level-public-access-prohibited AWS Config managed rule in each account and
    uses an AWS Systems Manager document to publish an event to the SNS topic to notify the SecOps
    team.
  4. Option D:
    Turn on Amazon Inspector across the organization. In the Amazon Inspector delegated
    administrator account, create an SNS topic. Subscribe the SecOps team’s email address to the SNS
    topic. In the same account, create an Amazon EventBridge rule that uses an event pattern for public
    network exposure of the S3 bucket and publishes an event to the SNS topic to notify the SecOps
    team
Show answer and explanation

Correct answer: C

Amazon GuardDuty is primarily on threat detection and response, not configuration monitoring A
conformance pack is a collection of AWS Config rules and remediation actions that can be easily
deployed as a single entity in an account and a Region or across an organization in AWS
Organizations. 

Question 2 (choose 3)

A company has an organization in AWS Organizations. The organization includes workload accounts
that contain enterprise applications. The company centrally manages users from an operations
account. No users can be created in the workload accounts. The company recently added an
operations team and must provide the operations team members with administrator access to each
workload account.
Which combination of actions will provide this access? (Choose three.)

  1. Option A:
    Create a SysAdmin role in the operations account. Attach the AdministratorAccess policy to the
    role. Modify the trust relationship to allow the sts:AssumeRole action from the workload accounts.

  2. Option B:
    Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the
    role. Modify the trust relationship to allow the sts:AssumeRole action from the operations account.

  3. Option C:
    Create an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as an
    authenticated role.

  4. Option D:
    In the operations account, create an IAM user for each operations team member.

  5. Option E:
    In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy
    that allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add all
    operations team members to the group.

  6. Option F:
    Create an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user for
    each operations team member.
Show answer and explanation

Correct answer: B, D, E

 Since the company manages users centrally in the operations account and does not allow users in workload accounts, the proper AWS cross-account access design is to create an IAM user for each operations team member in the operations account (D), create a SysAdmin role with the AdministratorAccess policy in each workload account and configure its trust policy to allow the operations account to assume it (B), and create a SysAdmins IAM group in the operations account with permissions to perform sts:AssumeRole on the SysAdmin roles in all workload accounts (E). This allows operations team members to authenticate once in the operations account and then assume administrator roles in the workload accounts without creating local users there, which follows AWS security best practices for centralized identity management.
See all 12 free sample questions