Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

The most operationally efficient answer is to use Systems Manager Default Host Management Configuration. This feature is designed specifically to make EC2 instances become Systems Manager managed instances automatically without manually attaching an IAM instance profile to every instance. AWS states that Default Host Management Configuration manages EC2 instances automatically as managed instances and uses a default IAM role for the account and Region. It also requires IMDSv2, which the scenario already satisfies. Option A correctly creates the Systems Manager trusted role, attaches AmazonSSMManagedEC2InstanceDefaultPolicy, and configures the SSM service setting. Options B and D add AWS Config remediation complexity, and C uses Patch Manager incorrectly because SSM Agent is already installed and the requirement is automatic Systems Manager management.

================

This is a classic AWS Organizations governance design:

Restrict Regions and allowed services across all accounts

The correct Organizations mechanism for account-wide guardrails is a Service Control Policy (SCP) .

SCPs set the maximum permissions that accounts/OUs can use, making them the right tool to enforce “only these Regions” and “only these services” consistently across the org.

Authentication from Active Directory + consistent job-function roles in every account

With AD as the identity source, the standard approach is federation to AWS using an IAM identity provider (SAML) and role assumption based on job function.

AWS CloudFormation StackSets is the operationally efficient way to deploy identical IAM roles/policies into multiple accounts/OUs so job-function permissions are consistent everywhere.

The roles’ trust policies can be configured to allow federated identities (from the AD-backed IdP) to assume the correct job role in each account.

Why the other options don’t fit:

A “OU with group policies” isn’t an AWS Organizations control mechanism for restricting Regions/services. The AWS-native control for this is SCPs , not “group policies.”

B Permissions boundaries are useful to limit what an IAM principal/role can do within an account , but they are not the org-wide enforcement mechanism for “all accounts must stay in these Regions / use only these services.” That’s what SCPs do.

C AWS RAM is for sharing resources (like subnets, Transit Gateway, etc.), not for “sharing roles” across accounts as a governance baseline. Also, the question emphasizes identical permissions in each account, which is best achieved by provisioning roles in each account (StackSets), not attempting to “share” roles.

To enable cross-account backup, the company needs to grant permissions to both the backup vault and the KMS key in the destination account. The backup vault access policy in the destination account must allow the primary account to copy backups into the vault. The key policy of the KMS key in the destination account must allow the primary account to use the key to encrypt and decrypt the backups. These steps are described in the AWS documentation12. Therefore, the correct answer is A and E.

1: Creating backup copies across AWS accounts - AWS Backup

2: Using AWS Backup with AWS Organizations - AWS Backup