DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

AWS Config offers a managed rule called CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK to detect stack drift automatically.

Creating an SNS topic and subscribing the DevOps lead enables simple notification without custom Lambda functions.

An EventBridge rule that triggers on NON_COMPLIANT status (when drift is detected) can send alerts directly to SNS. Option B adds complexity by requiring custom rules and Lambda. Option C incorrectly triggers on COMPLIANT, not NON_COMPLIANT. Option D needs a Lambda for email, while SNS can send email directly. Hence, Option A offers the least operational effort.

To restrict direct access to API Gateway, add a custom header in the CloudFront distribution origin request and use a Lambda authorizer in API Gateway to validate that header. Only requests routed through CloudFront will include this header. This is the AWS-recommended pattern in “Secure your APIs behind CloudFront using custom headers and Lambda authorizers.”

Comprehensive and Detailed Explanation From Exact Extract of DevOps Engineer documents only:

The correct answer is B because AWS Config can continuously evaluate the account-level S3 Block Public Access configuration by using a managed rule. When the configuration becomes noncompliant, AWS Config can trigger automatic remediation through an AWS Systems Manager Automation runbook to restore the required settings.

This solution directly satisfies both requirements:

Detect changes to account-level S3 public access settings.

Automatically revert those changes so that all public access is blocked again.

Why the other options are incorrect:

A. Security Hub is primarily for aggregated security findings and controls visibility. It is not the most direct or standard service for continuous configuration evaluation with automatic remediation of this specific setting.

C. An SCP can restrict permissions, but it does not automatically detect and revert changes to S3 Block Public Access settings.

D. Amazon Macie is for discovering and protecting sensitive data, not for continuously enforcing and remediating S3 Block Public Access account settings.