AWS Certified DevOps Engineer - Professional DOP-C02 — Question 220

• AUse AWS CloudFormation StackSets to deploy the CloudFormation stacks in all AWS accounts.
• BCreate an SCP that has a Deny statement for the ec2:* action with a condition of "aws:RequestTag/isolation": false.
• CAttach the SCP to the root of the organization.
• DCreate an AWS CloudFormation template that creates an EC2 instance role that has no IAM policies attached. Configure the template to have a security group that has an explicit Deny rule on all traffic. Use the CloudFormation template to create an AWS Lambda function that attaches the IAM role to instances. Configure the Lambda function to add a network ACL. Set up an Amazon EventBridge rule to invoke the Lambda function when a specific tag is applied to a compromised EC2 instance.
• ECreate an AWS CloudFormation template that creates an EC2 instance role that has no IAM policies attached. Configure the template to have a security group that has no inbound rules or outbound rules. Use the CloudFormation template to create an AWS Lambda function that attaches the IAM role to instances. Configure the Lambda function to replace any existing security groups with the new security group. Set up an Amazon EventBridge rule to invoke the Lambda function when a specific tag is applied to a compromised EC2 instance.

Select 2 answers to reveal the result.