DOP-C02 · Question #438
A company uses AWS CloudFormation to deploy application environments. A deployment failed due to manual modifications in stack resources. The DevOps engineer wants to detect manual modifications and…
The correct answer is A. Create an SNS topic and subscribe the DevOps lead via email. Create an AWS Config managed. AWS Config offers a managed rule called CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK to detect stack drift automatically. Creating an SNS topic and subscribing the DevOps lead enables simple notification without custom Lambda functions. An EventBridge rule that triggers on…
Question
A company uses AWS CloudFormation to deploy application environments. A deployment failed due to manual modifications in stack resources. The DevOps engineer wants to detect manual modifications and alert the DevOps lead with the least effort. Which solution meets these requirements?
Options
- ACreate an SNS topic and subscribe the DevOps lead via email. Create an AWS Config managed
- BTag all CloudFormation resources, create a custom AWS Config rule via SDK that flags manual
- CCreate an SNS topic, subscribe the DevOps lead, create a Config managed rule
- DCreate an AWS Config managed rule
How the community answered
(65 responses)- A72% (47)
- B15% (10)
- C5% (3)
- D8% (5)
Explanation
AWS Config offers a managed rule called CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK to detect stack drift automatically. Creating an SNS topic and subscribing the DevOps lead enables simple notification without custom Lambda functions. An EventBridge rule that triggers on NON_COMPLIANT status (when drift is detected) can send alerts directly to SNS. Option B adds complexity by requiring custom rules and Lambda. Option C incorrectly triggers on COMPLIANT, not NON_COMPLIANT. Option D needs a Lambda for email, while SNS can send Hence, Option A offers the least operational effort.
Topics
Community Discussion
No community discussion yet for this question.