A security team is concerned that a developer can unintentionally attach an Elastic IP address to an Amazon EC2 instance in production. No developer should be allowed to attach an Elastic IP address t

The correct answer is B. Attach an IAM policy to the developers' IAM group to deny associate-address permissions. Create. Explanation Option B is correct because it addresses both requirements simultaneously: attaching an IAM policy to the developers' IAM group prevents them from attaching Elastic IPs (proactive prevention), while creating an AWS Config rule monitors production instances and can tri

Submitted by javi_es· Mar 6, 2026Security & Compliance

Question

A security team is concerned that a developer can unintentionally attach an Elastic IP address to an Amazon EC2 instance in production. No developer should be allowed to attach an Elastic IP address to an instance. The security team must be notified if any production server has an Elastic IP address at any time. How can this task be automated?

Options

AUse Amazon Athena to query AWS CloudTrail logs to check for any associate-address attempts.
BAttach an IAM policy to the developers' IAM group to deny associate-address permissions. Create
CEnsure that all IAM groups associated with developers do not have associate-address
DCreate an AWS Config rule to check that all production instances have EC2 IAM roles that

How the community answered

(54 responses)

A
15% (8)
B
76% (41)
C
4% (2)
D
6% (3)

Explanation

Option B is correct because it addresses both requirements simultaneously: attaching an IAM policy to the developers' IAM group prevents them from attaching Elastic IPs (proactive prevention), while creating an AWS Config rule monitors production instances and can trigger SNS notifications to the security team if an Elastic IP is ever associated (reactive detection). This two-pronged approach fully satisfies the security requirements.

Why the distractors are wrong:

Option A (Amazon Athena querying CloudTrail logs) is a reactive, manual process - it doesn't prevent the action or provide automated real-time alerting, making it insufficient for continuous monitoring.
Option C is incomplete because simply ensuring developers lack the associate-address permission doesn't account for other principals (e.g., admins, automated scripts) who might accidentally attach an EIP, nor does it notify the security team.
Option D references EC2 IAM roles, which are unrelated to controlling or detecting Elastic IP associations - this is a distractor mixing up different AWS concepts.

Memory Tip

Think "Block + Watch" - the best security solutions both block unauthorized actions (IAM deny policy) and watch for violations (AWS Config + SNS). When you see a question requiring both prevention and notification, look for the answer that combines IAM restrictions with an AWS Config rule.

Topics

#IAM Policies#AWS Config#Security Controls#Compliance Monitoring

Community Discussion

No community discussion yet for this question.

Full DOP-C02 Practice