DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Organizations SCP and AWS CloudTrail

  Why it's wrong here

  AWS Organizations SCPs apply at the account boundary and can restrict which EC2 actions are permitted, but they cannot enforce a specific AMI ID because the AMI ID is not a condition key supported by ec2:RunInstances. CloudTrail only records API activity after the fact, so this combination provides audit visibility but no prevention or corrective action for launches using disallowed AMIs.

• ✓

  AWS Config rule to check AMI ID and AWS Systems Manager Automation to remediate non-compliant instances

  Why this is correct

  AWS Config evaluates launched instances against a managed rule such as approved-ami-by-id, which checks whether the instance’s AMI ID is in an allowed list. When an instance is non-compliant, Config can automatically invoke an AWS Systems Manager Automation document (for example, to stop or terminate the instance), providing a self-healing enforcement loop. This is the recommended pattern for reactive enforcement where the desired AMI cannot be blocked at the API level by IAM or SCP policies.

• ✗

  AWS Lambda and Amazon SNS

  Why it's wrong here

  Lambda and SNS can trigger notifications when an EC2 instance is launched, but they lack the ability to enforce a specific AMI at launch time or block non-compliant instances; AWS Config with a managed rule or Service Control Policies (SCPs) would be required to prevent or remediate unauthorised AMIs. This combination is tempting because it could be used to send alerts about non-compliant launches, which would be a correct choice for a monitoring-and-notify scenario rather than an enforcement requirement.

• ✗

  AWS CloudTrail and Amazon CloudWatch Events

  Why it's wrong here

  AWS CloudTrail captures RunInstances API calls as events, and Amazon CloudWatch Events (now EventBridge) can trigger rules based on those events, such as sending notifications or invoking a Lambda function. However, this combination only observes and reacts—it cannot modify the launched instance or change its AMI, and it offers no built-in policy to prevent non-compliant launches. Additional services like AWS Config and Systems Manager Automation would be needed to detect and remediate the violation, so this is purely a monitoring solution.

Go deeper

Related to this question