Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

Running unit tests in the build phase and aborting on failure (OnFailure=ABORT) prevents deployment if tests fail.

AWS CDK assertions module provides programmatic unit tests against synthesized templates (Option D).

The --rollback flag relates to CloudFormation stack rollback, not test gating.

The --require-approval flag controls manual approvals, not test outcomes.

cdk diff checks for changes but is not a unit test and may not catch logical errors.

To ensure that CloudTrail cannot be disabled in any member account, the control must be enforced above the individual accounts, at the organization level , and must not be overridable by local administrators. AWS Service Control Policies (SCPs) provide exactly this capability: they define permission guardrails that apply to all IAM users, roles, and even the root user in accounts within an AWS Organizations OU.

By applying an SCP that explicitly denies cloudtrail:StopLogging and cloudtrail:DeleteTrail , the organization prevents any principal in the affected accounts from disabling logging or deleting the trails, regardless of their IAM permissions. This provides strong, centralized enforcement of audit logging.

Option B uses IAM policies in each account. Local administrators with sufficient privileges could modify or detach those policies, defeating the control. Option C only sends notifications and does not prevent the action. Option D with AWS Config auto-remediation still allows a window where CloudTrail is disabled and also can be disabled or modified itself.

Therefore, the most robust and least bypassable approach is to use an SCP at the OU level to deny CloudTrail stop and delete actions.

The condition is deterministic: maximum CPU utilization must be below 2% for the previous 24 one-hour periods. That requires a static threshold, not anomaly detection. Anomaly detection learns a normal band from historical behavior, which is useful for unusual patterns but not for a fixed business definition of “idle.” CloudWatch alarms use “Datapoints to Alarm” as an M-out-of-N evaluation model, so 24 out of 24 means all 24 hourly datapoints must breach the threshold. AWS also documents idle-instance alarm examples based on CPU utilization staying below a threshold for 24 consecutive periods. Option D would alarm if only one hour was below 2%, which is far too sensitive. Options A and C use the wrong threshold type.

================