DOP-C02 Incident and Event Response Practice Question
A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config and AWS Systems Manager Automation
AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance. EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail and Amazon EventBridge
Why it's wrong here
AWS CloudTrail is an audit service that records API activity but doesn't evaluate security group configurations against desired compliance standards. While EventBridge can route CloudTrail events to targets, it has no native remediation action; any corrective workflow would require an additional compute service like Lambda or Step Functions to interpret and modify SG rules, making this pair incomplete for automated remediation.
- ✗
Amazon GuardDuty and AWS Lambda
Why it's wrong here
Amazon GuardDuty is a threat detection service that analyzes findings from sources like VPC Flow Logs and DNS logs; it doesn't assess whether a security group's inbound rules violate corporate security policies. Lambda can execute remediation code, but without a Config rule or similar trigger, GuardDuty won't generate the necessary SG compliance findings, so the combination fails to detect the original non-compliant state. For SG configuration issues, GuardDuty is the wrong detective control.
- ✗
AWS Config and Amazon Simple Notification Service (SNS)
Why it's wrong here
AWS Config correctly detects SG rule violations via managed or custom rules, and it can send evaluation results to an SNS topic. However, SNS is a pub/sub notification service that only delivers messages to subscribers (e.g., email or chat) and cannot invoke a remediation workflow on its own; a human must manually act on the notification. For automated remediation, Config must be integrated with AWS Systems Manager Automation or another execution service, not just SNS.
- ✓
AWS Config and AWS Systems Manager Automation
Why this is correct
This pair provides end-to-end compliance: AWS Config continuously evaluates security group resources against rules like restricted-common-ports, and when an SG is non-compliant, Config's remediation action triggers an AWS Systems Manager Automation runbook (e.g., AWS-DisablePublicSecurityGroupIngress or a custom runbook). The Automation step performs the actual modification, such as revoking offending ingress rules, thus closing the loop. Config can remediate automatically via SSM Automation without manual intervention, making this the correct solution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.