Troubleshooting AWS Config Custom Rule NON_COMPLIANT Results
A company uses AWS Config to evaluate resource compliance. They have a custom AWS Config rule that checks whether EC2 instances have a specific tag. The rule is triggered by configuration changes. The DevOps engineer notices that the rule evaluation results show 'NON_COMPLIANT' for some instances that actually have the tag. Which TWO could be causes? (Choose TWO.)
Quick Answer
The answer is a bug in the Lambda function or an incorrect resource type configuration. When AWS Config custom rule evaluation results show NON_COMPLIANT for resources that actually meet the condition, the most common technical causes are a flawed evaluation logic in the custom Lambda function or the rule being scoped to a resource type that does not include EC2 instances, causing the rule to evaluate the wrong resource attributes. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this question tests your understanding of how custom rules interact with AWS Config’s evaluation triggers and resource scope—a frequent trap is assuming the rule is triggered correctly when it is actually misconfigured for the target resource type. Remember that change-triggered rules do not rely on CloudTrail or execution frequency, so focus on the Lambda code and the rule’s resource type scope. Memory tip: “Scope and Code” are the two places to check when tags exist but compliance fails.
⚠ Common exam trap
The trap is that candidates may focus on evaluation failures (like permission issues) causing 'Failed' status, but if the custom rule's default compliance is set to NON_COMPLIANT, a permission error results in NON_COMPLIANT. Also, resource type scoping errors lead to 'Not evaluated', not NON_COMPLIANT.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function that evaluates the rule has a logic error
A logic error in the Lambda function evaluating the custom rule can cause it to incorrectly mark compliant resources as NON_COMPLIANT, such as misinterpreting the tag key/value or case sensitivity. Option E is correct because if the AWS Config service role lacks permission to invoke the Lambda function, the evaluation fails. If the custom rule has a default compliance value of NON_COMPLIANT for evaluation failures, the resource will be marked NON_COMPLIANT even though the tag is present.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rule's maximum execution frequency is set to 24 hours
Why it's wrong here
Incorrect. A maximum execution frequency of 24 hours does not cause incorrect NON_COMPLIANT results; it only affects when periodic evaluations occur. Configuration changes still trigger evaluation immediately.
- ✓
The Lambda function that evaluates the rule has a logic error
Why this is correct
Correct. A logic error in the Lambda function can cause false NON_COMPLIANT results despite the tag being present.
- ✗
The rule is not being triggered by CloudTrail events
Why it's wrong here
Incorrect. The rule is triggered by configuration changes, not CloudTrail events. CloudTrail triggers are irrelevant to this scenario.
- ✗
The rule is configured to evaluate only for a specific resource type that does not include EC2
Why it's wrong here
Incorrect. If the rule is scoped to a resource type that excludes EC2, the rule would not evaluate EC2 instances at all, resulting in 'Not evaluated', not NON_COMPLIANT.
- ✓
The AWS Config service role does not have permission to invoke the Lambda function
Why this is correct
Correct. If the Config service role lacks permission to invoke the Lambda, the evaluation fails. If the rule's default compliance is NON_COMPLIANT, it shows as NON_COMPLIANT.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Config to evaluate compliance of their AWS resources. They have a custom rule that checks whether EC2 instances have a specific tag. They notice that the rule is not triggering on existing instances. What is a possible reason?
hard- ✓ A.The rule is not configured with a trigger type of 'Configuration changes' or 'Periodic'
- B.AWS Config does not support custom rules
- C.The Lambda function does not have permission to describe EC2 instances
- D.The EC2 instances are not in the resource types being recorded by AWS Config
Why A: AWS Config custom rules require a trigger type to evaluate resources. If a rule is not configured with either 'Configuration changes' (triggered when a resource changes) or 'Periodic' (triggered on a schedule), it will never evaluate resources, including existing instances. Without a trigger, the rule remains inactive and cannot perform compliance checks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.