Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

AWS Organizations is a service that helps to manage multiple AWS accounts. AWS Control Tower is a service that makes it easy to set up and govern secure, compliant multi-account AWS environments. Account Factory for Terraform (AFT) is an AWS Control Tower feature that provisions new accounts using Terraform templates. To provision new accounts with the Enterprise Support plan, the DevOps engineer can set the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration. This flag enables the Enterprise Support plan for newly provisioned accounts.

AWS Control Tower provides an integrated governance framework that combines both preventive controls, implemented as Service Control Policies at the OU level, and detective controls, implemented as AWS Config rules applied across all enrolled accounts. Control Tower automatically applies these guardrails to all accounts in enrolled OUs. When new accounts are provisioned through Account Factory, they are automatically enrolled in the assigned OU and receive all applicable preventive and detective controls immediately without manual intervention. Option A uses only SCPs, covering only preventive controls without built-in detective capabilities. Option C requires manually updating stack sets when new accounts are created and does not provide preventive controls via SCPs. Option D provides only detective controls through Config rules with no preventive guardrails. Control Tower is the only option that natively handles both control types and automatically governs newly created accounts.

================

Failed interactive logins such as ConsoleLogin are part of CloudTrail management events , not data events. The most direct, low-overhead design is to stream management events to CloudWatch Logs , then create a metric filter that matches failed ConsoleLogin events (for example, $.eventName = " ConsoleLogin " and $.responseElements.ConsoleLogin = " Failure " or $.errorMessage ). That metric is then used as the basis for a CloudWatch alarm . When the alarm threshold (e.g., N failures in a period) is breached, the alarm triggers and sends a notification to the already created SNS topic, which alerts the security team.

Option A follows this recommended pattern: CloudTrail → CloudWatch Logs → Metric Filter → Alarm → SNS. It is fully managed, near real-time, and requires minimal custom logic.

Option B uses Athena with EventBridge to periodically query CloudTrail logs in S3. This introduces more moving parts, more configuration, higher latency, and more operational overhead.

Options C and D incorrectly reference CloudTrail data events and S3 event notifications, which are not the right mechanisms to detect ConsoleLogin failures. Console logins are not S3 events, and using data events would miss these management actions.

Therefore, Option A is the correct and simplest solution.