DOP-C02 · Question #209
A company is reviewing its IAM policies. One policy written by the DevOps engineer has been flagged as too permissive. The policy is used by an AWS Lambda function that issues a stop command to Amazon
Sign in or unlock DOP-C02 to reveal the answer and full explanation for question #209. The question stem and answer options stay visible for context.
Question
A company is reviewing its IAM policies. One policy written by the DevOps engineer has been flagged as too permissive. The policy is used by an AWS Lambda function that issues a stop command to Amazon EC2 instances tagged with Environment: NonProduction over the weekend. The current policy is:
What changes should the engineer make to achieve a policy of least permission? (Choose three.)
Options
- AAdd the following conditional expression:
- BChange "Resource": ""to "Resource": "arn:aws:ec2:::instance/"
- CAdd the following conditional expression:
- DAdd the following conditional expression:
- EChange "Action": "ec2:*"to "Action": "ec2:StopInstances"
- FAdd the following conditional expression:
Unlock DOP-C02 to see the answer
You've previewed enough free DOP-C02 questions. Unlock DOP-C02 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.