DOP-C02 practice question: CloudTrail, Access Analyzer, Inspector and auditing (2 of 2)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An insurance firm runs 80 AWS accounts through AWS Organizations. The security team wants to find resources such as S3 buckets and IAM roles that are shared outside the organization, and it wants to remove permissions that roles have never used.
Findings must come from configuration analysis in each account, without the team writing its own analyzer, and the results should be reviewable in one place for the whole organization. The security team reviews the findings each week and needs them grouped by account.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Create an IAM Access Analyzer analyzer at the organization level, so that it reports resources that grant access to principals outside the organization.
BB. Turn on Amazon Inspector in every account and review its findings for resources that are shared outside the organization, since Inspector covers resource exposure.
CC. Create an AWS Config rule that marks any IAM role with broad permissions as noncompliant, and let the rule remove those permissions automatically when it detects them.
DD. Create an IAM Access Analyzer unused access analyzer for the organization, so that the team sees roles, users and permissions that have not been used within the tracking period and can remove them.
EE. Create a GuardDuty detector in every account and send its findings for all IAM roles to the security team, since GuardDuty reports each unused role it observes.
B. Wrong: Inspector assesses vulnerabilities and network exposure for certain resources, but it does not analyze resource-based sharing with external principals. The requirement is about access sharing, which Inspector does not cover. Learn more: What is Amazon Inspector? (opens in a new tab)
D. Right: Correct. An unused access analyzer continuously monitors the IAM roles and users across the organization and reports unused roles, access keys and permissions. The findings give the team a reviewable list to reduce. Learn more: IAM Access Analyzer findings (opens in a new tab)
An organization-level IAM Access Analyzer external access analyzer reports resources shared outside the organization, and its unused access findings list roles and permissions that have not been used in the tracking period. Both run without a custom analyzer and report centrally. Inspector and GuardDuty assess other risks, and a broad-permissions rule does not identify unused access.
Want more on CloudTrail, Access Analyzer, Inspector and auditing? The 5 full-length practice sets have 10 more CloudTrail, Access Analyzer, Inspector and auditing questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →