Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

The requirement is classic attribute-based access control (ABAC) : users should only access EC2 resources whose resource tag matches the user’s department attribute coming from IAM Identity Center (mapped into a principal/session tag like aws:PrincipalTag/department).

For EC2 resource authorization using tags, the correct pattern is to compare the EC2 resource tag condition key ec2:ResourceTag/department to the principal tag ${aws:PrincipalTag/department} . That is exactly what Option C does.

Why the other options are wrong:

A only checks that the tag key exists (aws:TagKeys) and does not enforce a match between user department and instance department.

B uses aws:ResourceTag/... rather than the EC2-specific tag key typically used for EC2 authorization decisions in EC2 actions (ec2:ResourceTag/...).

D restricts access to resources tagged as d1/d2/d3 but does not ensure the user can only access their own department.

The requirements clearly indicate the need for modern CodePipeline capabilities , strict execution ordering, Git tag–based triggers, and loose coupling between pipelines. CodePipeline V2 introduces execution modes such as QUEUED and SUPERSEDED , along with native support for advanced trigger filtering when using AWS CodeConnections.

The requirement that the pipeline must wait for the previous run to finish directly maps to QUEUED mode , which ensures that pipeline executions run sequentially rather than replacing in-progress executions. SUPERSEDED mode would cancel the running execution, which violates the requirement.

Triggering the pipeline when new Git tags are pushed is supported through CodePipeline V2 trigger filters using refs/tags/*. Branch-based triggers would not satisfy this condition.

Finally, the requirement that an existing deployment pipeline runs in response to new container images is best met using Amazon EventBridge , which natively emits events for ECR image push actions . EventBridge allows decoupled, event-driven orchestration between pipelines without tight dependencies or custom scripting. This is the AWS-recommended approach for pipeline-to-pipeline coordination.

Options C and D rely on CodePipeline V1 , which lacks modern trigger filtering and execution control. Option B incorrectly uses SUPERSEDED mode and branch-based triggers.

Therefore, Option A correctly combines CodePipeline V2 , QUEUED execution mode , tag-based triggers , and EventBridge-driven pipeline chaining , meeting all requirements with best practices and minimal operational complexity.