DOP-C02 Incident and Event Response Practice Question
A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?
⚠ Common exam trap
A common mix-up: candidates confuse AWS Config's ability to evaluate resource configurations (like IAM role session duration) with CloudTrail's event logging or IAM Access Analyzer's policy analysis, leading them to choose options that detect creation events rather than continuously assess the current state of all roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.
AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use IAM Access Analyzer to validate the roles against a policy template.
Why it's wrong here
IAM Access Analyzer validates IAM policies against syntax, security best practices, and policy templates, and it identifies external access by analyzing resource policies. However, it does not inspect role properties such as MaxSessionDuration; the session duration setting lives in the role's trust policy or as a discrete attribute of the role, not within a policy statement. Thus, Access Analyzer cannot report on session duration compliance for roles.
- ✓
Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.
Why this is correct
The AWS Config managed rule iam-role-max-session-duration evaluates every IAM role in the account, comparing each role's MaxSessionDuration setting against the rule's maxSessionDuration parameter. This rule is triggered proactively on configuration changes and periodically, so it detects both existing and newly modified roles, flagging any role whose allowed session duration exceeds the defined threshold as noncompliant. It integrates with AWS Organizations and can be remediated automatically or through Config conformance packs.
- ✗
Run AWS Trusted Advisor and check the IAM report for roles with long session durations.
Why it's wrong here
AWS Trusted Advisor does not offer a check for IAM role session duration limits; its IAM-related checks cover password policy, MFA status, and unused credentials. The IAM credential report similarly reports on access keys, password last used, and MFA devices, but not on role session durations. Therefore, Trusted Advisor would not identify roles with long session durations, and no such 'IAM report' for role sessions exists.
- ✗
Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.
Why it's wrong here
While AWS CloudTrail logs CreateRole events, the role's max session duration is a parameter in the API request, and extracting it via a metric filter is brittle because CloudTrail logs events, not resource configurations. A metric filter would only trigger on future role creation, missing pre-existing roles and subsequent UpdateAssumeRolePolicy or UpdateRole modifications. It also requires building a custom CloudWatch alarm for each event, which does not provide continuous compliance evaluation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.