DOP-C02 practice question 12 of 35

A company uses Amazon RDS for all databases in Its AWS accounts The company uses AWS Control Tower to build a landing zone that has an audit and…

Full set: 449 questions
A company uses Amazon RDS for all databases in Its AWS accounts The company uses AWS Control Tower to build a landing zone that has an audit and logging account All databases must be encrypted at rest for compliance reasons. The company's security engineer needs to receive notification about any noncompliant databases that are in the company's accounts Which solution will meet these requirements with the MOST operational efficiency?
Answer options
A: Use AWS Control Tower to activate the optional detective control (guardrail) to determine whether the RDS storage is encrypted Create an Amazon Simple Notification Service (Amazon SNS) topic in the company's audit account. Create an Amazon EventBridge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer's email address to the SNS topic Correct answer
B: Use AWS Cloud Formation StackSets to deploy AWS Lambda functions to every account. Write the Lambda function code to determine whether the RDS storage is encrypted in the account the function is deployed to Send the findings as an Amazon CloudWatch metric to the management account Create an Amazon Simple Notification Service (Amazon SNS) topic. Create a CloudWatch alarm that notifies the SNS topic when metric thresholds are met. Subscribe the security engineer's email address to the SNS topic.
C: Create a custom AWS Config rule in every account to determine whether the RDS storage is encrypted Create an Amazon Simple Notification Service (Amazon SNS) topic in the audit account Create an Amazon EventBridge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer's email address to the SNS topic
D: Launch an Amazon EC2 instance. Run an hourly cron job by using the AWS CLI to determine whether the RDS storage is encrypted in each AWS account Store the results in an RDS database. Notify the security engineer by sending email messages from the EC2 instance when noncompliance is detected
Correct Answer:
A. Use AWS Control Tower to activate the optional detective control (guardrail) to determine whether the RDS storage is encrypted Create an Amazon Simple Notification Service (Amazon SNS) topic in the company's audit account. Create an Amazon EventBridge rule to filter noncompliant events from the AWS Control Tower control (guardrail) to notify the SNS topic. Subscribe the security engineer's email address to the SNS topic
Explanation

Activate AWS Control Tower Guardrail: Use AWS Control Tower to activate a detective guardrail that checks whether RDS storage is encrypted. Create SNS Topic for Notifications: Set up an Amazon Simple Notification Service (SNS) topic in the audit account to receive notifications about non-compliant databases. Create EventBridge Rule to Filter Non-compliant Events: Create an Amazon EventBridge rule that filters events related to the guardrail's findings on non- compliant RDS instances. Configure the rule to send notifications to the SNS topic when non-compliant events are detected. Subscribe Security Engineer's Email to SNS Topic: Subscribe the security engineer's email address to the SNS topic to receive notifications when non- compliant databases are detected. By using AWS Control Tower to activate a detective guardrail and setting up SNS notifications for non- compliant events, the company can efficiently monitor and ensure that all RDS databases are encrypted at rest.
Reference: AWS Control Tower Guardrails Amazon SNS Amazon EventBridge

Keep practicing

Take the free DOP-C02 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other DOP-C02 practice questions

Scroll to Top