DOP-C02 - Configuration Management and Infrastructure as Code (17% of the exam) - Section 2.6

Deploy automated configuration and remediation using AWS Config rules, AWS Systems Manager Automation runbooks and Amazon EC2 Image Builder for golden images.

Enforce configuration standards with AWS Config rules and trigger Systems Manager Automation runbooks for automatic remediation when a rule finds a non-compliant resource. Use Amazon EC2 Image Builder to bake hardened, pre-configured golden images that reduce per-instance configuration drift.

AWS Config rulesSystems Manager AutomationAmazon EC2 Image BuilderAutomatic remediation

Practice question for this objective

Free sampleConfiguration Management and Infrastructure as Codemedium

A security team must guarantee that every "Amazon S3" bucket across a busy account always has default encryption enabled, and that any bucket created or changed to a non-compliant state is corrected automatically without an engineer being paged. They already record resource configuration centrally and want the detection and the fix to be managed AWS features rather than custom code. Which combination BEST satisfies this continuous compliance requirement?

AUse an "AWS Config" managed rule to evaluate bucket encryption and attach an "AWS Systems Manager" Automation document as the remediation action to re-enable encryption automatically. Correct
BSchedule an "AWS Lambda" function that lists every bucket, checks its encryption setting and re-applies the encryption configuration whenever it finds a bucket without it.
CCreate an "Amazon GuardDuty" detector so that buckets lacking default encryption raise a finding that the security team can review and remediate during their next sweep.
DEnable "AWS CloudTrail" and build an "Amazon EventBridge" rule that emails the team whenever a bucket is created so they can confirm encryption is switched on.

Pair an AWS Config rule with a Systems Manager Automation remediation to continuously detect and auto-correct non-compliant resource configurations. AWS Config rules evaluate resource configurations against a desired state and mark resources compliant or non-compliant as changes are recorded; associating an automatic remediation backed by a Systems Manager Automation document lets Config invoke a managed runbook that restores the desired setting, giving a closed detect-and-correct loop built entirely from managed services rather than custom code.

Why A is correct: An AWS Config rule continuously evaluates whether each bucket is encrypted and flags non-compliant ones, and an attached Systems Manager Automation remediation runs a managed runbook to fix them automatically, which is the managed detect-and-correct loop required.

Why B is wrong: A hand-written Lambda can detect and fix the issue but it is custom code the team must build, test and maintain, which contradicts the stated preference for managed AWS features doing the work.

Why C is wrong: GuardDuty detects threats from logs and behaviour rather than evaluating configuration compliance, and it only produces findings for humans to action, so it neither reliably detects missing encryption nor fixes it automatically.

Why D is wrong: An event-driven email notifies a human at creation time but does not continuously evaluate existing buckets or automatically restore encryption, so the compliance state still depends on manual action.

See more DOP-C02 practice questions, answers explained.

Exam traps in Configuration Management and Infrastructure as Code

Answers that look right on this material and are not. Each one is a distractor from a different question in the DOP-C02 bank for this domain.

Schedule an "AWS CodeBuild" project that launches an instance, runs patching commands, captures an image and then terminates the instance on each monthly run.
Why it is wrong: CodeBuild can orchestrate the steps, but the team must hand-write and maintain the build and imaging logic, which reintroduces the maintained-script burden the requirement is trying to remove.
Configure an "Amazon EventBridge" rule on the Config compliance change event that invokes an "AWS Lambda" function written by the team to call the S3 API and re-enable versioning.
Why it is wrong: An EventBridge-plus-Lambda pattern can re-enable versioning, but it requires the team to write, test and maintain the function code, which contradicts the stated goal of reusing a managed action with no custom code.
Author the rules in a "CloudFormation" template and run a pipeline that assumes a role to deploy a stack into each member account, re-running the pipeline whenever a new account appears.
Why it is wrong: A per-account stack pipeline can install the rules, but it must be re-run for every new account and maintained over time, so it carries the manual overhead the requirement explicitly wants to avoid.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.