Correct Answer: Apply an SCP with a 'Deny' effect for 'cloudtrail:DeleteTrail' at the Organization or OU level
SCPs are powerful guardrails that can restrict permissions for all accounts in an organization, including the root user....
Correct Answer
Apply an SCP with a 'Deny' effect for 'cloudtrail:DeleteTrail' at the Organization or OU level
Why This Answer Is Correct
SCPs are powerful guardrails that can restrict permissions for all accounts in an organization, including the root user.
This question evaluates your knowledge of Scenario Based — a core concept tested in AWS Certified DevOps Engineer – Professional (DOP-C02). Understanding Scenario Based is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Your team is using AWS CodePipeline to deploy a multi-account application. You want to ensure that a production deployment only occurs if a security scan (SAST) in the staging account passes. How can you implement this cross-account approval and gating mechanism?
An organization wants to implement 'Blue/Green' deployments for their Application Load Balancer-based ECS service. They want to use AWS CodeDeploy to automate the traffic shifting. Which deployment configuration should they use for a zero-downtime, safe transition?
To ensure that all CloudFormation templates deployed across an organization follow security best practices (e.g., no public S3 buckets), which feature of AWS CloudFormation should be used to intercept and validate resource creation?
Your organization wants to automate the patching of thousands of EC2 instances across multiple regions and accounts. They want to ensure that if a patch fails on more than 10% of the fleet, the process stops immediately. Which AWS Systems Manager feature handles this?
To implement a Canary deployment for an AWS Lambda function, you decide to use 'Lambda Aliases' and 'Traffic Shifting'. Which AWS service can automate this process and roll back if CloudWatch Alarms are triggered?