DOP-C02 - Security and Compliance (17% of the exam) - Section 6.3

Apply automated security controls and guardrails with AWS Config, AWS Control Tower, service control policies and CloudFormation hooks and AWS CloudFormation Guard.

Apply preventive guardrails with service control policies and AWS CloudFormation Guard rules that block non-compliant resources before they are deployed. Use AWS Control Tower to set up a landing zone and AWS Config managed rules to continuously evaluate resources against detective controls.

AWS ConfigAWS Control TowerService control policiesAWS CloudFormation Guard

Practice question for this objective

Free sampleSecurity and Compliancemedium

An enterprise governs its multi-account environment with AWS Control Tower and is onboarding a new organisational unit for regulated workloads. Governance requires a hard block so accounts in that organisational unit can never launch resources outside two approved AWS Regions, and a continuous check that reports any account whose Amazon CloudWatch log groups lack a configured retention period without interrupting operations. The team wants to use the governance model Control Tower already provides rather than building separate tooling. Which TWO controls should they enable on the organisational unit? (Select TWO.)

AEnable a Control Tower preventive control backed by a service control policy that denies actions in any Region outside the two approved Regions, applied to the organisational unit so disallowed-Region activity is rejected. Correct
BWrite an AWS CloudFormation Guard rule set and run it as a pipeline stage so deployments into the organisational unit are rejected when they target a disallowed Region or omit a log retention period.
CConfigure an AWS Config conformance pack deployed directly through StackSets to the organisational unit and rely on it alone to both deny disallowed Regions and report any missing log retention.
DEnable a Control Tower detective control backed by an AWS Config rule that evaluates whether each account has a CloudWatch Logs retention period set and reports any non-compliant account on the dashboard without blocking work. Correct

Use an AWS Control Tower preventive control for a Region block and a detective control for log-retention drift reporting on the governed organisational unit. Control Tower preventive controls are enforced through service control policies, so a Region-deny control rejects activity outside approved Regions and cannot be evaded locally, while detective controls are implemented as AWS Config rules that continuously evaluate configuration such as CloudWatch Logs retention and surface non-compliant accounts on the dashboard without blocking work. Choosing the matching control type for each requirement is the key judgement.

Why A is correct: A Control Tower preventive control is implemented as a service control policy and denies actions in non-approved Regions across the organisational unit, delivering the hard Region block the regulator requires.

Why B is wrong: CloudFormation Guard only evaluates templates that pass through that pipeline, so it cannot block console or CLI actions in other Regions and is not part of the Control Tower governance model the team wants to reuse.

Why C is wrong: A conformance pack only evaluates and reports compliance, so it cannot deny disallowed-Region activity, and deploying it outside Control Tower bypasses the governance model the requirement asks the team to use.

Why D is correct: A Control Tower detective control uses an AWS Config rule to continuously evaluate log-retention configuration and flag drift on the dashboard, reporting non-compliance without interrupting operations as required.

See more DOP-C02 practice questions, answers explained.

Exam traps in Security and Compliance

Answers that look right on this material and are not. Each one is a distractor from a different question in the DOP-C02 bank for this domain.

A preventive control backed by a "service control policy" that denies the API calls which would shorten or remove CloudWatch log retention in the governed accounts.
Why it is wrong: A preventive control blocks the action outright, which is tempting for enforcement, but the requirement is to report drift without blocking operations, so a denying service control policy does more than asked and changes account behaviour.
Build the landing zone with hand-written "CloudFormation" StackSets that the team runs to create accounts and attach logging, an audit account, and guardrail policies for each new account.
Why it is wrong: StackSets can provision baselines across accounts, but the team must author and maintain the account-creation logic, the guardrail set, and the onboarding workflow themselves, which is the maintenance burden the requirement is trying to avoid.
Enable Amazon EBS encryption by default in each Region so newly created volumes are encrypted, and rely on this single account setting as the sole guardrail protecting every account across the whole organisation.
Why it is wrong: Default encryption helps new volumes but is a per-Region account setting a local administrator can switch off, so on its own it is neither organisation-enforced nor able to remediate existing non-compliant volumes.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.