Discuss Amazon DOP-C02 Exam Topic 1 Question 2

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.

The buildspec.yml file contains the following:

The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.

What steps should the DevOps engineer take to stop this?

AModify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only.

BConfigure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access.

CCreate an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal ''*''.

DModify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only.

Suggested Answer: D

Get Premium DOP-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Emeline 11 months ago

I disagree, modifying the post_build command is unnecessary.

Ashleigh 12 months ago

Option B sounds too complicated for just read access.

Dylan 12 months ago

Wait, anyone can download them? That's a huge security risk!

Margery 1 year ago

I think option C is the best choice here!

Vashti 1 year ago

Just set a bucket policy to restrict access.

Andra 1 year ago

I recall that allowing access to specific AWS accounts is crucial, so option C makes sense, but I wonder if the bucket policy alone would be enough without adjusting the ACL.

Hubert 1 year ago

I practiced a similar question where we had to manage S3 permissions, and I think option B could be a good approach too, but I'm not confident about the default ACL part.

Vanda 1 year ago

I'm not entirely sure, but I feel like modifying the post_build command in option D could also work. It seems like a good way to restrict access.

Mari 1 year ago

I remember studying S3 bucket policies, and I think option C might be the right choice since it explicitly denies access to everyone else.

Hana 1 year ago

Okay, I've got this. A usage record tracks the sum of usage for a selected data period, so the answer is A.

Tanja 1 year ago

This seems like a straightforward question about the purpose of information classification. I'll focus on understanding the key concepts like applying labels and structuring data based on sensitivity.

Myrtie 1 year ago

I'm a little confused by all the options here. I'll probably start with the Control Panel and see if I can find the System settings, as that seems like the most direct approach.

Amazon DOP-C02 Exam - Topic 1 Question 2 Discussion