Online Access Free Amazon.DOP-C02.v2025-11-21.q140 Practice Test (Page 2)

DOP-C02 Exam Question 1

A company recently created a new AWS Control Tower landing zone in a new organization in AWS Organizations. The landing zone must be able to demonstrate compliance with the Center tor Internet Security (CIS) Benchmarks tor AWS Foundations.
The company's security team wants to use AWS Security Hub to view compliance across all accounts Only the security team can be allowed to view aggregated Security Hub Findings. In addition specific users must be able to view findings from their own accounts within the organization All accounts must be enrolled m Security Hub after the accounts are created.
Which combination of steps will meet these requirements in the MOST automated way? (Select THREE.)

A.Turn on trusted access for Security Hub in the organization's management account. Create a new security account by using AWS Control Tower Configure the new security account as the delegated administrator account for Security Hub. In the new security account provide. Security Hub with the CIS Benchmarks for AWS Foundations standards.

B.Turn on trusted access for Security Hub in the organ ration's management account. From the management account, provide Security Hub with the CIS Benchmarks for AWS Foundations standards.

C.Create an AWS IAM identity Center (AWS Single Sign-On) permission set that includes the required permissions Use the CreateAccountAssignment API operation to associate the security team users with the permission set and with the delegated security account.

D.Create an SCP that explicitly denies any user who is not on the security team from accessing Security Hub.

E.In Security Hub, turn on automatic enablement.

F.In the organization's management account create an Amazon EventBridge rule that reacts to the CreateManagedAccount event Create an AWS Lambda function that uses the Security Hub CreateMembers API operation to add new accounts to Security Hub. Configure the EventBridge rule to invoke the Lambda function.

DOP-C02 Exam Question 2

A company has multiple accounts in an organization in AWS Organizations. The company's SecOps team needs to receive an Amazon Simple Notification Service (Amazon SNS) notification if any account in the organization turns off the Block Public Access feature on an Amazon S3 bucket. A DevOps engineer must implement this change without affecting the operation of any AWS accounts. The implementation must ensure that individual member accounts in the organization cannot turn off the notification.
Which solution will meet these requirements?

A.Designate an account to be the delegated Amazon GuardDuty administrator account. Turn on GuardDuty for all accounts across the organization. In the GuardDuty administrator account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. In the same account, create an Amazon EventBridge rule that uses an event pattern for GuardDuty findings and a target of the SNS topic.

B.Create an AWS CloudFormation template that creates an SNS topic and subscribes the SecOps team's email address to the SNS topic. In the template, include an Amazon EventBridge rule that uses an event pattern of CloudTrail activity for s3:PutBucketPublicAccessBlock and a target of the SNS topic. Deploy the stack to every account in the organization by using CloudFormation StackSets.

C.Turn on AWS Config across the organization. In the delegated administrator account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. Deploy a conformance pack that uses the s3-bucket-level-public-access-prohibited AWS Config managed rule in each account and uses an AWS Systems Manager document to publish an event to the SNS topic to notify the SecOps team.

D.Turn on Amazon Inspector across the organization. In the Amazon Inspector delegated administrator account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. In the same account, create an Amazon EventBridge rule that uses an event pattern for public network exposure of the S3 bucket and publishes an event to the SNS topic to notify the SecOps team.

DOP-C02 Exam Question 3

A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A development OU and a production OU are nested under the workload OU. The company grants users full access to the company's AWS accounts to deploy applications.
The DevOps team needs to allow only a specific management 1AM role to manage the 1AM roles and policies of any AWS accounts In only the production OU.
Which combination of steps will meet these requirements? {Select TWO.)

A.Create an SCP that denies full access with a condition to exclude the management 1AM role for the organization root.

B.Ensure that the FullAWSAccess SCP is applied at the organization root

C.Create an SCP that allows IAM related actions Attach the SCP to the development OU

D.Create an SCP that denies IAM related actions with a condition to exclude the management I AM role Attach the SCP to the workload OU

E.Create an SCP that denies IAM related actions with a condition to exclude the management 1AM role Attach the SCP to the production OU

DOP-C02 Exam Question 4

A DevOps engineer is planning to deploy a Ruby-based application to production. The application needs to interact with an Amazon RDS for MySQL database and should have automatic scaling and high availability. The stored data in the database is critical and should persist regardless of the state of the application stack.
The DevOps engineer needs to set up an automated deployment strategy for the application with automatic rollbacks. The solution also must alert the application team when a deployment fails.
Which combination of steps will meet these requirements? (Select THREE.)

A.Deploy the application on AWS Elastic Beanstalk. Deploy an Amazon RDS for MySQL DB instance as part of the Elastic Beanstalk configuration.

B.Deploy the application on AWS Elastic Beanstalk. Deploy a separate Amazon RDS for MySQL DB instance outside of Elastic Beanstalk.

C.Configure a notification email address that alerts the application team in the AWS Elastic Beanstalk configuration.

D.Configure an Amazon EventBridge rule to monitor AWS Health events. Use an Amazon Simple Notification Service (Amazon SNS) topic as a target to alert the application team.

E.Use the immutable deployment method to deploy new application versions.

F.Use the rolling deployment method to deploy new application versions.

DOP-C02 Exam Question 5

A company is running its ecommerce website on AWS. The website is currently hosted on a single Amazon EC2 instance in one Availability Zone. A MySQL database runs on the same EC2 instance. The company needs to eliminate single points of failure in the architecture to improve the website's availability and resilience. Which solution will meet these requirements with the LEAST configuration changes to the website?

A.Deploy the application by using AWS Fargate containers. Migrate the database to Amazon DynamoDB. Use Amazon API Gateway to route requests.

B.Migrate the application to AWS Lambda functions. Use Amazon S3 for static content hosting. Migrate the database to Amazon DocumentDB (with MongoDB compatibility).

C.Use AWS Elastic Beanstalk to deploy the application across multiple AWS Regions. Migrate the database to Amazon Redshift. Use Amazon ElastiCache for session management.

D.Deploy the application on EC2 instances across multiple Availability Zones. Put the EC2 instances into an Auto Scaling group behind an Application Load Balancer. Migrate the database to Amazon Aurora Multi-AZ. Use Amazon CloudFront for content delivery.

Other Version: 197Amazon.DOP-C02.v2026-07-25.q201; 635Amazon.DOP-C02.v2026-03-12.q166; 2216Amazon.DOP-C02.v2024-12-30.q117; 1671Amazon.DOP-C02.v2024-09-14.q103; 1473Amazon.DOP-C02.v2024-01-26.q82; 1245Amazon.DOP-C02.v2023-11-18.q59; 1179Amazon.DOP-C02.v2023-11-08.q77; 846Amazon.DOP-C02.v2023-08-28.q37; 931Amazon.DOP-C02.v2023-06-26.q32

Latest Upload: 231Amazon.SAA-C03.v2026-07-25.q425; 130SAP.C_S4PM.v2026-07-25.q43; 234Google.Professional-Data-Engineer.v2026-07-25.q215; 220Microsoft.AZ-104.v2026-07-25.q227; 197Amazon.DOP-C02.v2026-07-25.q201; 154EMC.NCP-AII.v2026-07-25.q60; 163CheckPoint.156-561.v2026-07-25.q83; 231Amazon.AIF-C01.v2026-07-24.q158; 164WGU.Applied-Algebra.v2026-07-24.q46; 161Oracle.1Z0-948.v2026-07-24.q60

DOP-C02 Exam Question 1

DOP-C02 Exam Question 2

DOP-C02 Exam Question 3

DOP-C02 Exam Question 4

DOP-C02 Exam Question 5

Download PDF File