AWS DOP-C02 Free Practice Questions — Page 3

Correct Answers: B. Create permission sets. Attach an inline policy that includes the required permissions and uses the aws:PrincipalTag condition key to scope the permissions.; C. Create a group in the IdP. Place users in the group. Assign the group to accounts and the permission sets in IAM Identity Center.; F. Enable attributes for access control in IAM Identity Center. Map attributes from the IdP as key-value pairs.

Why these are correct: B: Permission sets in IAM Identity Center define what users can do. Using inline policies with the aws:PrincipalTag condition key allows scoping permissions based on user attributes, implementing least privilege. C: Creating groups in the IdP and assigning them to accounts and permission sets establishes the connection between users, their permissions, and which accounts they can access. F: Enabling attributes for access control and mapping attributes from the IdP as key-value pairs allows user attributes (like team or department) to be used in permission policies for fine-grained access control. Why other options are wrong: A: IAM policies are created in individual AWS accounts, not in IAM Identity Center. Permission sets are the correct construct for IAM Identity Center. D: You don't assign groups to OUs or directly to IAM policies in IAM Identity Center. The assignment is to accounts and permission sets. E: While you can apply tags to users, the question specifies using an external IdP, so attributes should be mapped from the IdP rather than manually applied as tags.

Correct Answers: A. Check the ApproximateAgeOfOldestMessage metric for the SQS queue. Increase the Lambda function concurrency limit.; D. Check the WriteThrottleEvents metric for the DynamoDB table. Increase the maximum write capacity units (WCUs) for the table's scaling policy.

Why these are correct: A: ApproximateAgeOfOldestMessage indicates how long messages are waiting in the queue. If this metric is high, messages aren't being processed quickly enough. Increasing Lambda concurrency allows more function instances to process messages simultaneously, reducing the backlog. D: WriteThrottleEvents indicates DynamoDB is rejecting write requests due to insufficient capacity. If Lambda is being throttled when writing to DynamoDB, increasing the maximum WCUs in the auto scaling policy allows the table to scale up and handle more writes. Why other options are wrong: B: A redrive policy sends failed messages to a dead-letter queue but doesn't address processing delays for valid messages. C: NumberOfMessagesSent measures incoming message rate, not processing delays. Increasing visibility timeout only helps if messages are being processed but not deleted in time, which isn't the issue here. E: Lambda throttles occur when concurrent executions are limited, not due to function timeout. Increasing timeout doesn't address concurrency limits or cold starts.

Correct Answer: B. Con gure the ec2-instance-pro le-attached AWS Con g managed rule with a trigger type of con guration changes. Con gure an automatic remediation action that invokes an AWS Systems Manager Automation runbook to attach the default instance pro le to the EC2 instances.

Why B is correct: The ec2-instance-profile-attached AWS Config managed rule continuously monitors EC2 instances and checks if they have instance profiles attached. Using a trigger type of configuration changes ensures the rule evaluates whenever instances are launched or modified. The automatic remediation action with Systems Manager Automation can immediately attach the default instance profile to non-compliant instances. This solution handles both existing instances and future launches automatically. Why other options are wrong: A: RunInstances API calls occur when instances are launched, but this doesn't address existing running instances without profiles. It's also reactive rather than continuous monitoring. C: StartInstances API calls only occur when stopped instances are started, not when new instances are launched. This misses the primary use case. D: The iam-role-managed-policy-check rule checks IAM role policies, not whether EC2 instances have instance profiles attached. It's the wrong Config rule for this requirement.

Correct Answer: A. Use an AWS Serverless Application Model (AWS SAM) template to de ne the serverless application. Use AWS CodeDeploy to deploy the Lambda functions with the Canary10Percent15Minutes Deployment Preference Type. Use Amazon CloudWatch alarms to monitor the health of the functions.

Why A is correct: AWS SAM integrates seamlessly with CodeDeploy for Lambda deployments. The Canary10Percent15Minutes deployment preference gradually shifts traffic (10% initially, then 100% after 15 minutes if no issues occur). CloudWatch alarms can monitor function health (errors, duration, throttles), and if alarms trigger, CodeDeploy automatically rolls back the deployment. This provides safe, gradual deployment with automated rollback, minimizing customer impact. Why other options are wrong: B: Manual approval actions don't reduce customer impact of unsuccessful deployments—they only add human review, which slows down deployment and doesn't provide automatic rollback or gradual traffic shifting. C: While you can use the RoutingConfig property for traffic shifting, this approach requires manual CloudFormation stack updates and doesn't provide CodeDeploy's integrated monitoring and automatic rollback capabilities. D: Testing with sample payloads doesn't validate production behavior. Manual alias updates and monitoring alarms don't provide the automated, gradual traffic shifting that canary deployments offer.

Correct Answer: C. Publish the application artifacts to an Amazon S3 bucket and create a VPC endpoint for S3. Assign an IAM instance pro le to the EC2 instances so they can read the application artifacts from the S3 bucket.

Why C is correct: Publishing artifacts to S3 and creating a VPC endpoint for S3 allows EC2 instances in private subnets to access S3 without internet access. The VPC endpoint provides a private connection to S3 within the VPC. Assigning an IAM instance profile gives the instances permissions to read from the S3 bucket. This fully complies with the no-internet-access requirement while allowing artifact retrieval. Why other options are wrong: A: Using Elastic IP addresses and then disassociating them still provides internet access during installation, violating the security requirement. B: NAT gateway provides internet access for private subnets, which violates the "no access to the internet" requirement. D: Allowing outbound traffic to an artifact repository (assuming it's internet-based) still violates the no-internet-access rule. Additionally, temporarily allowing and then removing security group rules is operationally complex and error-prone.