What is the primary purpose of Amazon Detective?

To block malicious IP addresses

To provide a backup of security logs

To automatically remediate security issues

To analyze and investigate security findings by correlating data from multiple sources

A security team wants to enable AWS Security Hub in a multi-account environment and ensure that findings from all accounts are aggregated in a central account. They also want to enable Amazon GuardDuty in all accounts. What is the most efficient way to do this?

Manually enable Security Hub and GuardDuty in each account.

Enable Security Hub in the central account and use the AWS Organizations integration to automatically enable Security Hub and GuardDuty in all accounts.

Use AWS Control Tower to enable Security Hub and GuardDuty in all accounts.

Use AWS Config to enable Security Hub and GuardDuty in all accounts.

What is the primary purpose of AWS Control Tower's landing zone?

To host a company's public website with high availability

To provide a pre-configured, multi-account environment that follows AWS best practices

To provide a single sign-on portal for all AWS accounts

To automatically migrate on-premises workloads to AWS

A company has an AWS Organization with multiple accounts. They want to ensure that no account can disable AWS CloudTrail or delete CloudTrail trails. Which SCP should they attach to the root OU?

Deny the cloudtrail:DescribeTrails and cloudtrail:GetTrailStatus actions for all resources.

Deny the cloudtrail:CreateTrail and cloudtrail:StartLogging actions for all resources.

Deny the cloudtrail:PutEventSelectors and cloudtrail:UpdateTrail actions for all resources.

Deny the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions for all resources.

AWSCertified DevOps Engineer - Professional

Domain 2Objective 2

Task Statement 2.2: Deploy Automation to Create, Onboard, and Secure AWS Accounts in a Multi-Account or multi-Region Environment. DOP-C02 Practice Questions (Page 6)

Part of the Content Domain 2: Configuration Management and IaC domain, which accounts for 17% of the DOP-C02 exam. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

12concepts

17%of the exam

12 Concepts in This Objective

AWS account structures and best practices
AWS Organizations for account management
AWS Control Tower for account provisioning
Automating account provisioning and configuration
IAM for multi-account access
Service Control Policies (SCPs)
Governance and security controls at scale
AWS Config for compliance and auditing
AWS Security Hub for centralized security
Amazon GuardDuty for threat detection
Amazon Detective for security investigation
AWS Service Catalog for standardized provisioning

Questions 26–30

26foundation · easy
What is the primary purpose of Amazon Detective?
Select an answer first
27application · medium
A security team wants to enable AWS Security Hub in a multi-account environment and ensure that findings from all accounts are aggregated in a central account. They also want to enable Amazon GuardDuty in all accounts. What is the most efficient way to do this?
Select an answer first
28foundation · easy
What is the primary purpose of AWS Control Tower's landing zone?
Select an answer first
29application · medium
A company wants to allow its developers to provision standardized Amazon S3 buckets and EC2 instances, but only from a pre-approved set of configurations. They want to enforce this without giving developers full access to AWS services. Which AWS service should they use?
Select an answer first
30application · medium
A company has an AWS Organization with multiple accounts. They want to ensure that no account can disable AWS CloudTrail or delete CloudTrail trails. Which SCP should they attach to the root OU?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DOP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “DOP-C02” is a trademark of its owner, used for identification only.