What is the primary benefit of using AWS Secrets Manager for machine identity credentials?

It eliminates the need for IAM roles.

It allows you to store secrets in plain text for easy access.

It automates the rotation of secrets, reducing the risk of compromised credentials.

It provides a free service for storing secrets.

A company with 2,000 employees uses Okta as its corporate identity provider. The company is migrating to AWS and wants employees to access the AWS Management Console using their existing Okta credentials, without creating IAM users. They also want to enforce MFA for all console access. Which solution should they implement?

Create an IAM role for each department, then configure Okta to assume those roles via SAML. Instruct users to use the 'Switch Role' feature in the console.

Create an IAM identity provider for Okta, then configure IAM roles with a trust policy that allows the Okta audience. Use the AWS CLI with SAML-based federation to obtain temporary credentials.

Create IAM users for all 2,000 employees and attach a managed policy that requires MFA. Use the IAM console to manage access.

Set up AWS IAM Identity Center, connect Okta as the external identity provider, and assign users to permission sets. Configure MFA enforcement in Okta or IAM Identity Center.

What is the purpose of a service control policy (SCP) in AWS Organizations?

To manage the lifecycle of IAM users and roles.

To grant permissions to specific IAM users within an account.

To provide single sign-on for users across accounts.

To restrict the maximum permissions for all principals in an account or organizational unit.

How can an administrator enforce MFA for IAM users in AWS?

By using an SCP to require MFA for all users.

By creating a password policy that requires MFA.

By using an IAM policy that denies actions when MFA is not present.

By enabling MFA in the AWS account settings.

A company wants to federate its existing identity provider (IdP) with AWS to allow users to sign in with their corporate credentials. Which AWS feature is used to establish this federation?

IAM group with a permissions policy

IAM user with a password policy

IAM role with a trust policy for the IdP

AWSCertified DevOps Engineer - Professional

Domain 6Objective 1

Task Statement 6.1: Implement Techniques for Identity and Access Management at Scale. DOP-C02 Practice Questions (Page 5)

Part of the Content Domain 6: Security and Compliance domain, which accounts for 17% of the DOP-C02 exam. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 12–20 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

12concepts

17%of the exam

12 Concepts in This Objective

IAM entities for human and machine access
Identity-based vs. resource-based policies
Session policies
Identity federation with IAM Identity Center
IAM permissions boundaries
Organizational SCPs
Least privilege policy design
Role-based access control (RBAC)
Attribute-based access control (ABAC)
Automating credential rotation for machine identities
MFA enforcement for human and machine identities
AWS Security Token Service (STS) for temporary credentials

Questions 21–25

21foundation · easy
What is the primary benefit of using AWS Secrets Manager for machine identity credentials?
Select an answer first
22application · medium
A company with 2,000 employees uses Okta as its corporate identity provider. The company is migrating to AWS and wants employees to access the AWS Management Console using their existing Okta credentials, without creating IAM users. They also want to enforce MFA for all console access. Which solution should they implement?
Select an answer first
23foundation · easy
What is the purpose of a service control policy (SCP) in AWS Organizations?
Select an answer first
24foundation · easy
How can an administrator enforce MFA for IAM users in AWS?
Select an answer first
25foundation · easy
A company wants to federate its existing identity provider (IdP) with AWS to allow users to sign in with their corporate credentials. Which AWS feature is used to establish this federation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DOP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “DOP-C02” is a trademark of its owner, used for identification only.