Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

The question focuses on detecting supply chain attacks that bypass CI/CD controls and result in malicious runtime behavior in the deployed serverless application. This requires runtime threat detection , not just static scanning or infrastructure validation.

Amazon GuardDuty is AWS’s managed threat detection service. GuardDuty now includes Lambda Protection , which analyzes Lambda function behavior, including network calls, IAM API usage, and other signals to detect compromised functions, crypto-mining, data exfiltration, and other malicious activity. GuardDuty automatically ingests CloudTrail, VPC Flow Logs (if enabled), and other telemetry without requiring code changes or agents. Findings are published and can be routed to Amazon EventBridge for near real-time notifications or automated remediation.

Option A (AWS WAF) only inspects HTTP requests to API Gateway and is focused on known bad patterns, not deeper behavioral anomalies. Option C (CloudFormation Guard) is focused on infrastructure-as-code validation in the pipeline, which explicitly does not help once malicious code is deployed. Option D (Network Firewall with Emerging Threats rules) protects VPC traffic, but serverless components like Lambda and API Gateway may not all traverse that firewall, and it is not targeted at function-level behavior.

Hence, enabling GuardDuty with Lambda Protection and using EventBridge notifications is the correct solution.

The requirement is to retry the replication process, not to manually copy the object with PutObject. S3 Batch Replication is built for replicating existing objects and can filter objects by replication status. AWS documentation states that Batch Replication can include objects with ObjectReplicationStatus set to FAILED to retry objects that previously failed replication. S3 Replication metrics also allow S3 Event Notifications when objects fail to replicate to a destination Region. Therefore, Lambda should react to the failed-replication notification and start an S3 Batch Operations Batch Replication job for the failed object. Options A, B, and C manually copy the object, which is not the same as retrying native S3 replication and can mishandle replication semantics, metadata, encryption, ownership, or status tracking.

================

When setting the flag authenticated-read in the command line, the owner gets FULL_CONTROL. The AuthenticatedUsers group (Anyone with an AWS account) gets READ access. Reference: