Task Statement 2.2: Deploy Automation to Create, Onboard, and Secure AWS Accounts in a Multi-Account or multi-Region Environment. DOP-C02 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of a Service Control Policy (SCP) in AWS Organizations?

   • ATo manage the lifecycle of IAM users in member accounts
   • BTo automatically approve all IAM policy changes in member accounts
   • CTo provide a backup of IAM policies in the organization
   • DTo define the maximum permissions that accounts in an OU can grant to their IAM principals
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has enabled Amazon GuardDuty in multiple accounts. They want to ensure that findings from all accounts are visible in a central Security Hub console. What is the most efficient way to achieve this?

   • AManually enable Security Hub in each account and configure each account to send findings to the central account via Amazon EventBridge.
   • BUse AWS Config aggregators to collect GuardDuty findings from all accounts.
   • CEnable Security Hub in the central account and use the AWS Organizations integration to automatically enable Security Hub in all accounts and aggregate findings.
   • DCreate a cross-account IAM role that allows the central account to read GuardDuty findings from all accounts.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is investigating a potential security incident that involves suspicious API calls from an EC2 instance in one account and related findings in another account. They need to understand the full scope of the activity. Which AWS service should they use to correlate and analyze the data?

   • AAWS Security Hub
   • BAmazon GuardDuty
   • CAmazon Detective
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company uses AWS Control Tower and needs to automate the creation of new accounts with a standardized baseline, including VPCs, IAM roles, and AWS Config rules. They want to use Infrastructure as Code. What is the most appropriate way to achieve this?

   • AUse AWS Organizations to create the account and then run a Terraform script from a central management instance.
   • BCreate a CloudFormation template that defines the baseline resources and use it as a Service Catalog product in the Account Factory.
   • CCreate a new account using the AWS CLI and then use AWS Config to apply the baseline resources.
   • DUse the Control Tower Account Factory to provision accounts and then manually apply the baseline resources in each account.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In AWS Service Catalog, what is a 'portfolio'?

   • AA group of IAM users with similar permissions
   • BA set of AWS accounts managed together
   • CA collection of products that are made available to users
   • DA collection of security rules for resources
   Reveal Solution Discussion Select an answer first