Amazon Exam DOP-C01 Topic 12 Question 88 Discussion

Actual exam question for Amazon's DOP-C01 exam

Question #: 88
Topic #: 12

A company requires its internal business teams to launch resources through pre-approved AWS CloudFormation templates only. The security team requires automated monitoring when resources drift from their expected state.

Which strategy should be used to meet these requirements?

AAllow users to deploy Cloud Formation stacks using a CloudFormation service role only. Use CloudFormation drift detection to detect when resources have drifted from their expected state.

BAllow users to deploy CloudFormation stacks using a CloudFormation service role only. Use AWS Config rules to detect when resources have drifted from their expected state.

CAllow users to deploy CloudFormation stacks using AWS Service Catalog only Enforce the use of a launch constraint Use AWS Config rules to detect when resources have drifted from their expected state.

DAllow users to deploy CloudFormation stacks using AWS Service Catalog only Enforce the use of a template constraint Use Amazon EventBridge (Amazon CloudWatch Events) notifications to detect when resources have drifted from their expected state.

Show Suggested Answer

Suggested Answer: B

by Sylvia at Mar 15, 2024, 05:57 PM

Limited Time Offer

25%

Off

Get Premium DOP-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Mee

11 days ago

Ooh, good catch! I'd say the template constraint is probably the way to go, since it allows you to enforce the use of a specific CloudFormation template. That way, you know the resources are being deployed exactly as expected.

upvoted 0 times

...

Valentin

12 days ago

Yeah, those options definitely seem like the way to go. I'm curious about the difference between using a launch constraint versus a template constraint though. Gotta make sure we're picking the right one.

upvoted 0 times

...

Denae

13 days ago

Exactly! And the use of AWS Config rules or Amazon EventBridge notifications to detect drift is a nice touch. Covers all the bases.

upvoted 0 times

...

Nieves

14 days ago

Haha, nice try, but I don't think the security team is going to go for that. They're pretty serious about this stuff, you know? Better to play by the rules and avoid any unwanted surprises down the line.

upvoted 0 times

...