DOP-C02 Security and Compliance Practice Question
A company's security policy requires that all EC2 instances must be launched with an IAM role that provides least privilege access. A DevOps engineer needs to enforce this across the organization. Which approach is MOST effective?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM policy that denies ec2:RunInstances unless the instance is launched with the required IAM role, and attach it to all users
Attaching an IAM policy to all users that denies ec2:RunInstances unless the instance is launched with the required IAM role directly enforces the requirement. Option A (SCP denying if not the approved role) is incorrect because SCPs cannot check for a specific role attachment at launch time; they only control permissions at the account level. Option B (SCP denying unless instance profile attached) only requires any instance profile, not specifically the approved one. Option C (AWS Config + Lambda) is reactive and can have delays, so it is less effective than a preventive IAM policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an SCP that denies ec2:RunInstances if the specified IAM role is not the approved role
Why it's wrong here
SCP cannot check the role being attached; it can only check if an instance profile is present.
- ✗
Create a service control policy (SCP) that denies the ec2:RunInstances action unless an instance profile is attached
Why it's wrong here
SCP can deny launch without instance profile, but cannot enforce a specific role.
- ✗
Use AWS Config to detect instances without the required role and terminate them via Lambda
Why it's wrong here
Reactive, not preventive.
- ✓
Create an IAM policy that denies ec2:RunInstances unless the instance is launched with the required IAM role, and attach it to all users
Why this is correct
IAM policies can use condition keys like iam:PassedToService to enforce specific roles.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.