[January-2024]New Braindump2go DOP-C02 PDF and DOP-C02 VCE Dumps(164-191)

Braindump2go Guarantee All Exams 100% Pass One Time!
Explanation:
https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/enable-amazon-guardduty-conditionally-by-usingaws-cloudformation-templates.html
QUESTION 175
A company has an AWS Control Tower landing zone. The company's DevOps team creates a workload OU. A
development OU and a production OU are nested under the workload OU. The company grants users full access to the
company's AWS accounts to deploy applications.
The DevOps team needs to allow only a specific management IAM role to manage the IAM roles and policies of any
AWS accounts in only the production OU.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an SCP that denies full access with a condition to exclude the management IAM role for
the organization root.
B. Ensure that the FullAWSAccess SCP is applied at the organization root.
C. Create an SCP that allows IAM related actions. Attach the SCP to the development OU.
D. Create an SCP that denies IAM related actions with a condition to exclude the management IAM
role. Attach the SCP to the workload OU.
E. Create an SCP that denies IAM related actions with a condition to exclude the management IAM
role. Attach the SCP to the production OU.
Answer: BE
QUESTION 176
A company hired a penetration tester to simulate an internal security breach. The tester performed port scans on the
company's Amazon EC2 instances. The company's security measures did not detect the port scans.
The company needs a solution that automatically provides notification when port scans are performed on EC2
instances. The company creates and subscribes to an Amazon Simple Notification Service (Amazon SNS) topic.
What should the company do next to meet the requirement?
A. Ensure that Amazon GuardDuty is enabled. Create an Amazon CloudWatch alarm for detected
EC2 and port scan findings. Connect the alarm to the SNS topic.
B. Ensure that Amazon Inspector is enabled. Create an Amazon EventBridge event for detected
network reachability findings that indicate port scans. Connect the event to the SNS topic.
C. Ensure that Amazon Inspector is enabled. Create an Amazon EventBridge event for detected
CVEs that cause open port vulnerabilities. Connect the event to the SNS topic.
D. Ensure that AWS CloudTrail is enabled. Create an AWS Lambda function to analyze the
CloudTrail logs for unusual amounts of traffic from an IP address range. Connect the Lambda
function to the SNS topic.
Answer: A
Explanation:
https://aws.amazon.com/blogs/security/amazon-inspector-assess-network-exposure-ec2-instances-aws-networkreachability-assessments/
QUESTION 177
A company runs applications in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster uses
an Application Load Balancer to route traffic to the applications that run in the cluster.
A new application that was migrated to the EKS cluster is performing poorly. All the other applications in the EKS
cluster maintain appropriate operation. The new application scales out horizontally to the preconfigured maximum
number of pods immediately upon deployment, before any user traffic routes to the web application.
Which solution will resolve the scaling behavior of the web application in the EKS cluster?
A. Implement the Horizontal Pod Autoscaler in the EKS cluster.
B. Implement the Vertical Pod Autoscaler in the EKS cluster.
C. Implement the Cluster Autoscaler.
DOP-C02 Exam Dumps DOP-C02 Exam Questions DOP-C02 PDF Dumps DOP-C02 VCE Dumps
https://www.braindump2go.com/dop-c02.html