Amazon DOP-C02 Exam Dumps

The requirement is to create automation that deletes unattached EBS volumes that have been unattached for 14 days. To do this, the DevOps engineer needs to use the following steps:

Create an Amazon CloudWatch Events rule to execute an AWS Lambda function daily. CloudWatch Events is a service that enables event-driven architectures by delivering events from various sources to targets. Lambda is a service that lets you run code without provisioning or managing servers. By creating a CloudWatch Events rule that executes a Lambda function daily, the DevOps engineer can schedule a recurring task to check and delete unattached EBS volumes.

The Lambda function should find unattached EBS volumes and tag them with the current date, and delete unattached volumes that have tags with dates that are more than 14 days old. The Lambda function can use the EC2 API to list and filter unattached EBS volumes based on their state and tags. The function can then tag each unattached volume with the current date using the create-tags command. The function can also compare the tag value with the current date and delete any unattached volume that has been tagged more than 14 days ago using the delete-volume command.

ECR pull-through cache caches images from upstream repositories for resilience.

Private repo with basic scanning ensures vulnerability detection on pushed images.

Enabling pull-through caching on a private repo combines caching and vulnerability scanning seamlessly.

Public repos do not support pull-through caching of upstream images.

Replication rules are for multi-Region replication, not upstream caching.

References:

Amazon ECR Pull Through Cache

Amazon ECR Image Scanning

Option B is the only choice that directly satisfies both requirements:

Continuously evaluate the account-level S3 Block Public Access setting

AWS Config is designed to record configuration state and evaluate resources/settings against rules over time.

A Config rule (managed rule) can check whether the account-level ''S3 Block Public Access'' settings are configured as required (i.e., blocking public access).

Automatically revert drift (auto-remediate) if someone changes the setting later

AWS Config Remediation can automatically trigger an AWS Systems Manager Automation runbook when the rule becomes NON_COMPLIANT.

Using an SSM Automation document/runbook that sets S3 account-level Block Public Access back to the required ''blocked'' configuration ensures that any future change is corrected automatically, restoring compliance without manual intervention.

Why the other options don't fully meet the requirement:

A (Security Hub): Security Hub primarily aggregates findings and checks controls. While it can integrate with automation, AWS Config is the standard service for configuration drift detection + automatic remediation loops for account-level posture settings. Security Hub is not the most direct ''detect config drift and auto-fix'' mechanism for an account setting in the way Config remediation is.

C (SCP): An SCP can restrict API actions, but it doesn't ''revert'' a changed S3 Block Public Access configuration; it only prevents/limits what actions can be called. Also, ''deny S3 actions from outside the account'' is not the same as enforcing Block Public Access settings at the account level.

To allow only creation/configuration of service-linked roles, you need a way to tightly scope what IAM actions the developer can perform. The most AWS-appropriate mechanism for ''delegate limited IAM admin'' is a role with a permissions boundary:

A permissions boundary sets the maximum permissions the role (and any roles it creates, depending on design) can ever have. This is a standard pattern to safely delegate IAM tasks without granting broad IAM administration.

You can define the role's policy + boundary so the developer can call only the APIs required for service-linked roles (for example actions like creating service-linked roles and passing only allowed AWS service principals), while preventing general role/policy creation outside that scope.

Why the others don't meet ''service-linked roles only'':

A is vague (''common services'') and cross-account access doesn't inherently restrict to only service-linked roles. It's also more operational overhead than needed for a single dev account use case.

B PowerUserAccess is far too broad and does not restrict to service-linked roles.