Amazon Exam DOP-C02 Topic 3 Question 26 Discussion

Actual exam question for Amazon's DOP-C02 exam

Question #: 26
Topic #: 3

A company is reviewing its 1AM policies. One policy written by the DevOps engineer has been (lagged as too permissive. The policy is used by an AWS Lambda function that issues a stop command to Amazon EC2 instances tagged with Environment: NonProduccion over the weekend. The current policy is:

What changes should the engineer make to achieve a policy ot least permission? (Select THREE.)

AOption A

BOption B

COption C

DOption D

Show Suggested Answer

Suggested Answer: A, B, D

The engineer should make the following changes to achieve a policy of least permission:

A:Add a condition to ensure that the principal making the request is an AWS Lambda function. This ensures that only Lambda functions can execute this policy.

B:Narrow down the resources by specifying the ARN of EC2 instances instead of allowing all resources. This ensures that the policy only affects EC2 instances.

D:Add a condition to ensure that this policy only applies to EC2 instances tagged with ''Environment: NonProduction''. This ensures that production environments are not affected by this policy.

AWS Identity and Access Management (IAM) - AWS Documentation

Certified DevOps Engineer - Professional (DOP-C02) Study Guide(page 179)

by Yolando at May 31, 2024, 08:33 AM

Limited Time Offer

25%

Off

Get Premium DOP-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Diane

6 months ago

As an AWS security specialist, I'd recommend A, B, and D. Least privilege is the name of the game, and you don't want those 'NonProduccion' instances going rogue on the weekend!

upvoted 0 times

Catalina

5 months ago

I agree, least privilege is key. Let's make those changes to prevent any issues with the 'NonProduccion' instances.

upvoted 0 times

...

Karol

5 months ago

A, B, and D are definitely the way to go. We need to tighten up those permissions.

upvoted 0 times

...

Jeannine

6 months ago

Options A, B, and F look solid to me. Tightening up the resource conditions and reducing the allowed actions will really lock down that policy.

upvoted 0 times

...

Rikki

6 months ago

Haha, I'm gonna go with Options A, C, and E. Gotta keep those EC2 instances on their toes, right? 'NonProduccion' sounds like a party zone to me!

upvoted 0 times

Brandon

5 months ago

Definitely. Keeping things secure is key, even in the 'party zone'.

upvoted 0 times

...

Bambi

5 months ago

Yeah, I agree. NonProduccion does sound like a party zone. Better tighten up those policies.

upvoted 0 times

...

Raina

5 months ago

I think Options A, C, and E are the way to go. Can't have those instances slacking off!

upvoted 0 times

...

Micaela

6 months ago

I think Options A, B, and D would be the best choices here. Limiting the resource actions to only what's necessary is key for a least-privilege policy.

upvoted 0 times