DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

For pull through cache repositories, Amazon ECR now supports repository creation templates that can be applied to a registry prefix, such as /external. These templates define default settings, including encryption configuration with a specific KMS key, tag immutability, scan on push, and more. When new cache repositories are auto-created under that prefix, they inherit the template settings automatically.

In this scenario, existing external cache repositories are noncompliant because they use SSE-S3. The company can delete those repositories (removing the noncompliant caches) and configure an ECR repository creation template for the /external prefix that specifies the required customer managed KMS key. As new images are pulled, ECR recreates the cache repositories under that prefix with KMS encryption using the specified key, guaranteeing compliance going forward.

Option A (AWS Config) would only detect noncompliance after creation and cannot enforce encryption at creation time. Option C (SCP) cannot directly control repository encryption properties. Option D misuses EventBridge; KMS cannot be a “target” that retroactively encrypts repositories.

Therefore, using an ECR repository creation template with the desired KMS key is the correct, automatic, and secure solution.

Activate Amazon Macie on the Production S3 Bucket:

Macie can identify and protect sensitive data such as PII.

Create a Step Functions state machine to automate data discovery and redaction before copying it to the development environment.

Example Step Functions state machine:

{

"Comment": "Anonymize PII and copy data",

"StartAt": "MacieDiscoveryJob",

"States": {

"MacieDiscoveryJob": {

"Type": "Task",

"Resource": "arn:aws:states:::macie:startClassificationJob",

"End": true

}

}

}

Create a Development Environment from CloudFormation Template:

Deploy the development environment in a new account using the existing CloudFormation template.

Schedule an EventBridge rule to start the Step Functions state machine on a weekly basis.

EventBridge rule example:

{

"ScheduleExpression": "rate(7 days)",

"StateMachineArn": "arn:aws:states:::stateMachine:AnonymizeAndCopyData"

}

By using Macie for data anonymization and Step Functions for automation, you ensure PII is properly handled before data transfer between environments.

S3 RTC ensures ≤15-min replication SLA.

Multi-Region Access Point (MRAP) simplifies active-passive replication access.

SubmitMultiRegionAccessPointRoutes API manages routing changes during failover.This configuration follows AWS DR best practices for S3 active/passive architectures.