Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

To restrict access to S3 buckets so that only IAM principals from within the AWS Organization can access them, an SCP (Service Control Policy) with conditions using the aws:PrincipalAccount or preferably aws:PrincipalOrgID can be applied at the OU level.

SCPs restrict the maximum permissions for IAM entities in member accounts and can be used to enforce access control policies across accounts.

The aws:PrincipalAccount condition restricts access to principals from specific accounts, while aws:PrincipalOrgID restricts based on the organization ID.

IAM permissions boundaries (Option B) cannot be applied organization-wide and do not enforce restrictions across accounts.

AWS RAM (Option C) is for sharing resources but does not restrict S3 bucket access based on organizational principals.

There is no such thing as an RCP in AWS Organizations (Option D is invalid).

EKS control plane nodes are fully managed by AWS and are not accessible for configuration, SSH, SSM commands, or custom workloads. Therefore, any prefetching of container images must occur on the worker nodes (EC2 instances in the node groups) because those are the machines that pull and cache container images before running pods.

Option C is the only solution that aligns with AWS architecture:

It creates an IAM role allowing Systems Manager Run Command to execute on EC2 worker nodes.

It uses node group tags to target the correct nodes dynamically.

State Manager runs the prefetch script whenever triggered by the EventBridge automation — ensuring newly added nodes pre-pull images and reduce cold-start latency to seconds.

Options A and D are invalid because you cannot run Systems Manager commands on EKS control plane nodes; AWS manages them and does not expose them. Option B incorrectly targets node groups based on machine size, which does not provide reliable node identification or filtering.

Thus, Option C provides the correct, scalable, and supported method for prefetching images across all worker nodes.

To validate AWS CDK-defined infrastructure, use CDK Assertions (assertions module) to test synthesized CloudFormation templates (e.g., template.hasResourceProperties). Integrate testing into CodeBuild buildspec before deployment, setting OnFailure: ABORT so the pipeline halts if tests fail. This ensures safe continuous delivery following AWS CDK testing best practices.