Cert Master

DOP-C02 Domain 2: Configuration Management and Infrastructure as Code

Legal documents live in Amazon S3. Users set LegalHold=true on some objects. The company must delete objects older than 90 days that are not on legal hold. Uploading apps cannot be changed to add tags on PUT. Which TWO steps meet the requirements? (Select TWO.)

Multiple response — select two or more answers

Answer choices

  1. a. Bucket policy denying PutObject unless s3:RequestObjectTag/LegalHold is true or false.
  2. b. Lifecycle expiration after 90 days with no tag filter.
  3. c. S3 event notification on object creation invokes Lambda to set LegalHold=false when the tag is missing.
  4. d. Bucket policy denying DeleteObject when s3:ExistingObjectTag/LegalHold is true.
  5. e. Lifecycle rule with filter LegalHold=false that expires objects older than 90 days.

Architectural breakdown & explanation

Lambda defaults the tag so lifecycle can filter; expiration with LegalHold=false skips held documents.

Correct answer(s): c. S3 event notification on object creation invokes Lambda to set LegalHold=false when the tag is missing., e. Lifecycle rule with filter LegalHold=false that expires objects older than 90 days.

Exam domain: Domain 2: Configuration Management and Infrastructure as Code (17% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the AWS Certified DevOps Engineer – Professional bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications