Task Statement 2.2: Deploy Automation to Create, Onboard, and Secure AWS Accounts in a Multi-Account or multi-Region Environment. DOP-C02 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How can GuardDuty findings be integrated with AWS Security Hub?

   • AYou need to use AWS Lambda to forward findings to Security Hub
   • BGuardDuty findings cannot be integrated with Security Hub
   • CGuardDuty automatically sends findings to Security Hub when both are enabled
   • DYou must manually export findings to S3 and import them into Security Hub
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A company is designing its AWS environment and wants to follow AWS best practices for account structure. Which of the following is a primary benefit of using a multi-account strategy with separate accounts for different functions or business units?

   • AIt provides a single consolidated bill for all accounts without any additional setup.
   • BIt automatically replicates all resources across accounts for high availability.
   • CIt isolates workloads and limits the blast radius of security incidents or operational errors.
   • DIt eliminates the need for IAM roles and policies within each account.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a key benefit of using Infrastructure as Code (IaC) for account provisioning?

   • AIt automatically scales resources based on demand
   • BIt ensures that accounts are created with consistent, repeatable configurations
   • CIt provides real-time security monitoring for all accounts
   • DIt eliminates the need for any manual configuration
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a multi-account AWS Organization and wants to implement a comprehensive compliance monitoring solution. They need to detect non-compliant resources, aggregate findings, and provide a single dashboard for security and compliance teams. They also want to automate remediation for certain non-compliant resources. Which combination of services should they use?

   • AAmazon GuardDuty, Amazon Detective, and AWS Config.
   • BAWS CloudTrail, Amazon CloudWatch, and AWS Lambda.
   • CAWS Service Catalog, AWS Control Tower, and AWS Config.
   • DAWS Config with Config rules, AWS Security Hub, and AWS Systems Manager Automation documents.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is using AWS Control Tower to manage a multi-account environment. They need to provision a new account for a project that requires a custom VPC configuration and specific IAM roles that are not part of the standard baseline. They want to automate the provisioning process as much as possible. What is the most effective approach?

   • AUse AWS Organizations to create the account and then run a Terraform script from a central management instance.
   • BCreate a custom CloudFormation template for the VPC and IAM roles, and add it as a product in the Service Catalog portfolio associated with Account Factory.
   • CUse the Account Factory to provision the account, then manually create the VPC and IAM roles.
   • DUse the AWS Control Tower API to create the account and then use AWS Config to apply the custom VPC and IAM roles.
   Reveal Solution Discussion Select an answer first