Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

Running unit tests in the build phase and aborting on failure (OnFailure=ABORT) prevents deployment if tests fail.

AWS CDK assertions module provides programmatic unit tests against synthesized templates (Option D).

The --rollback flag relates to CloudFormation stack rollback, not test gating.

The --require-approval flag controls manual approvals, not test outcomes.

cdk diff checks for changes but is not a unit test and may not catch logical errors.

Step 1: Understanding Lambda Permissions and AWS Config

The custom AWS Config rule evaluates resources and invokes an AWS Lambda function when a compliance check is triggered. For AWS Config to invoke the Lambda function, it requires permission to do so.

Issue: The Lambda function fails to execute because AWS Config doesn ' t have permission to invoke it.

Action: Modify the resource-based policy of the Lambda function to grant AWS Config permission to invoke the Lambda function.

Why: Without this permission, AWS Config cannot trigger the Lambda function, which is why the evaluation fails.

Service-managed StackSets are the correct low-overhead deployment model when AWS Organizations trusted access is enabled. CloudFormation creates and manages the required StackSet execution roles, so self-managed permissions are unnecessary. However, AWS explicitly states that service-managed StackSets do not deploy stacks to the organization management account, even if the management account is part of the organization or belongs to an OU. Therefore, targeting the root OU deploys to the member accounts, but the management account still needs a separate normal CloudFormation stack. Option B is the only answer that covers both the member accounts and the management account with the least operational overhead. Option A misses the management account, while C and D require unnecessary self-managed role administration.

================