DOP-C02 Security and Compliance Practice Question
A company has a multi-account AWS environment managed by AWS Organizations. The DevOps team uses AWS CloudFormation StackSets to deploy a standard VPC across all member accounts. The security team has noticed that in some accounts, the VPC is being modified after deployment, allowing inbound SSH access from the internet. The team wants to automatically detect and remediate these changes. The current setup includes: AWS Config enabled in all accounts with a rule that checks for unrestricted SSH access; an SNS topic in the management account that receives compliance change notifications; and a Lambda function in the management account that can remediate by updating the security group rules. However, the remediation is not working consistently. What is the most likely reason, and what is the best solution?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function's IAM role does not have permissions to modify security groups in member accounts.
The Lambda function in the management account needs cross-account permissions to modify security groups in member accounts. The most likely issue is that the Lambda function's IAM role does not have the required permissions. The best solution is to use AWS Config conformance packs with remediation actions deployed to each member account, allowing local remediation. Option A is incorrect because the Config rule itself detects the changes. Option C is incorrect because the SNS topic can deliver messages cross-account with proper permissions, but the remediation fails due to the Lambda role's lack of permissions. Option D is incorrect because StackSets are for initial deployment, not for ongoing compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The AWS Config rule is not evaluating correctly in member accounts.
Why it's wrong here
The AWS Config rule is not the source of the failure because the scenario states that the rule is actively detecting the non-compliant security group changes. If the rule were misconfigured or not evaluating in member accounts, it would fail to detect the drift entirely, never invoking the remediation Lambda function. Since the detection is occurring and the Lambda is being triggered, the evaluation pipeline is functioning correctly; the problem lies downstream in the remediation step.
- ✓
The Lambda function's IAM role does not have permissions to modify security groups in member accounts.
Why this is correct
Remediation actions in AWS Config require the Lambda function to have an IAM role that is assumable in every member account where the rule runs. When using the AWS-provided remediation action 'AWS-ConfigureSecurityGroupChanges' or a custom Lambda function, that role must include permissions such as ec2:AuthorizeSecurityGroupIngress, ec2:RevokeSecurityGroupIngress, and similar actions scoped to the target security groups. Without those permissions, the Lambda execution fails with an AccessDenied error even though the event was delivered and the function started. This is the most direct cause of the failure because the rule is detecting and triggering correctly, but the remediation cannot modify the resources.
- ✗
The SNS topic is not delivering messages to the Lambda function due to cross-account access issues.
Why it's wrong here
The SNS topic is not the bottleneck because AWS Config can send notifications cross-account if the SNS topic policy includes a statement that allows the AWS Config service principal (or the specific account's Config service) to publish messages. Additionally, if the Lambda function is subscribed to the SNS topic, the topic's access policy must grant sns:Subscribe and the Lambda's resource policy must allow invocation by SNS. The scenario does not indicate any missing policy statements or failed deliveries; if the Lambda was never triggered, you would see no logs in CloudWatch, but here the remediation is attempted and fails. Therefore, the cross-account delivery mechanism is functioning and the issue is isolated to the remediation permissions.
- ✗
CloudFormation StackSets is overriding the changes, causing a race condition.
Why it's wrong here
CloudFormation StackSets is not causing a race condition because StackSets does not automatically remediate or revert drift in existing resources. StackSets is designed to deploy and manage CloudFormation stacks across accounts and regions, but it only applies changes when you update the stack set or its instances; it does not continuously monitor or override changes made directly to resources after deployment. If the security group modifications are being reverted, that would be a separate resource policy or manual process, not StackSets. The failure described is about remediation not succeeding, not about changes being undone, so a race condition with StackSets is not applicable.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,339 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.