nerdexam
Amazon

DOP-C02 · Question #202

A company has multiple development teams in different business units that work in a shared single AWS account. All Amazon EC2 resources that are created in the account must include tags that specify…

The correct answer is D. Create an Amazon EventBridge rule that uses Amazon EC2 as the event source. Configure the. To tag new EC2 instances within the first hour of creation, an Amazon EventBridge rule should be configured to directly capture EC2 creation events from CloudTrail and invoke the Lambda function.

Submitted by satoshi_tk· Mar 6, 2026Configuration Management and IaC

Question

A company has multiple development teams in different business units that work in a shared single AWS account. All Amazon EC2 resources that are created in the account must include tags that specify who created the resources. The tagging must occur within the first hour of resource creation. A DevOps engineer needs to add tags to the created resources that include the user ID that created the resource and the cost center ID. The DevOps engineer configures an AWS Lambda function with the cost center mappings to tag the resources. The DevOps engineer also sets up AWS CloudTrail in the AWS account. An Amazon S3 bucket stores the CloudTrail event logs. Which solution will meet the tagging requirements?

Options

  • ACreate an S3 event notification on the S3 bucket to invoke the Lambda function for
  • BEnable server access logging on the S3 bucket. Create an S3 event notification on the S3 bucket
  • CCreate a recurring hourly Amazon EventBridge scheduled rule that invokes the Lambda function.
  • DCreate an Amazon EventBridge rule that uses Amazon EC2 as the event source. Configure the

How the community answered

(50 responses)
  • A
    20% (10)
  • B
    4% (2)
  • C
    10% (5)
  • D
    66% (33)

Why each option

To tag new EC2 instances within the first hour of creation, an Amazon EventBridge rule should be configured to directly capture EC2 creation events from CloudTrail and invoke the Lambda function.

ACreate an S3 event notification on the S3 bucket to invoke the Lambda function for

S3 event notifications trigger when CloudTrail log files are *written* to the S3 bucket, which can have a significant delay and is not real-time for individual API calls, making it difficult to guarantee tagging within the first hour.

BEnable server access logging on the S3 bucket. Create an S3 event notification on the S3 bucket

Enabling server access logging on the S3 bucket is for S3 access events, not CloudTrail events, and using S3 event notifications for CloudTrail logs still suffers from delays, failing the 'within the first hour' requirement.

CCreate a recurring hourly Amazon EventBridge scheduled rule that invokes the Lambda function.

A recurring hourly Amazon EventBridge scheduled rule would only run periodically, not immediately upon instance creation, meaning some resources might not be tagged until well after the first hour.

DCreate an Amazon EventBridge rule that uses Amazon EC2 as the event source. Configure theCorrect

An Amazon EventBridge rule can directly monitor CloudTrail management events, such as `RunInstances`, and trigger the Lambda function immediately upon EC2 instance creation, allowing for tagging within the specified one-hour window.

Concept tested: Real-time event-driven automation for resource tagging

Source: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-events-from-cloudtrail.html

Topics

#AWS EventBridge#Automated Tagging#Event-driven Architecture#AWS Lambda

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DOP-C02 Practice