DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

" Note that the metric filter is different from a log insights query, where the experience is interactive and provides immediate search results for the user to investigate. No automatic action can be invoked from an insights query. Metric filters, on the other hand, will generate metric data in the form of a time series. This lets you create alarms that integrate into your ITSM processes, execute AWS Lambda functions, or even create anomaly detection models. "

Amazon GuardDuty provides built-in, fully managed threat detection for AWS accounts and workloads, including automatic detection of cryptocurrency mining activity, compromised EC2 instances, command-and-control traffic patterns, and anomalous behaviors. GuardDuty includes multiple threat identifiers such as EC2:CryptoCurrencyActivity.BitcoinToolDetected and EC2:UnauthorizedAccess.CryptoMining. Because this capability is native and requires no custom detection logic, it provides the lowest development and operational overhead compared to alternatives.

When GuardDuty generates a finding, it publishes the event automatically to Amazon EventBridge. The DevOps engineer can create an EventBridge rule that matches the specific mining-related finding types. The target of the rule is an AWS Lambda function that parses instance details from the finding and calls TerminateInstances on the affected EC2 instance.

This enables real-time automated remediation without needing recurring scans, log parsing, or complex data queries.

Options A and B require building custom detection pipelines and maintaining periodic Lambda polling, increasing long-term complexity. Option D (Security Hub) aggregates findings but still relies on GuardDuty for detection, adding unnecessary overhead.

Therefore, GuardDuty + EventBridge + Lambda termination is the easiest, quickest, and most AWS-recommended solution following incident-response best practices.

When using the awslogs log driver with ECS on EC2, the ECS agent running on the container instance uses the instance’s IAM role (container instance role or task execution role, depending on configuration) to write logs to CloudWatch Logs. The policy already grants logs:CreateLogGroup , logs:CreateLogStream , and logs:PutLogEvents , which are the required CloudWatch Logs actions. However, for the role to be usable by ECS, the role’s trust policy must allow the appropriate service principal to assume it.

In this question, the error message indicates “missing permission” during ECS task deployment. If the IAM role is not trusted by the ECS service (for example, ecs-tasks.amazonaws.com for a task execution role or the proper principal for container instances), ECS cannot assume that role and therefore cannot use the granted CloudWatch permissions, causing deployment failures.

Option A addresses this by adding a trust relationship so that Amazon ECS can assume the IAM role. Options B and C mutate the permissions but do not fix the underlying problem: the missing trust. Option D incorrectly attempts to trust CloudWatch, which does not assume roles in this context.

Thus, adding a trust policy that establishes ECS as a trusted service is the correct fix.