Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 220 discussion

What a weirdly worded question. I tend to agree with A & E. We need to isolate an EC2 that has a certain tag.

The B + C means no actions allowed on the tagged EC2 for all accounts in Organizations, but the asking was the needs of the isolation(implying the network isolation) on the tagged EC2; hence, A + E is a good option here..

vote for AE

I go for AE isolating the instance should be mean block traffic

This CloudFormation template creates the necessary resources: An EC2 instance role with no IAM policies, ensuring the instance cannot perform any actions. A security group with no inbound or outbound rules, effectively isolating the instance from all network traffic. A Lambda function that will be triggered by an EventBridge rule when a specific tag is applied to an EC2 instance. This function will attach the isolated security group to the compromised instance, ensuring it is isolated from any network communication. Combining these steps will provide an automated and consistent approach to isolate compromised EC2 instances across all AWS accounts in the organization.

BD is wrong isolating the instance doesn't mean "don't touch it" with aws actions but to block traffic from and to it

BC for me

BC for me

ill go with AE

CE for me. Option D is wrong because we can not use Security Group for an explicit deny rule. Option B is quite misleading with the resourceTagIsolation set to False instead of True.

in my opinion it could not be AE because we would need a mechanism to apply this template to the right EC2 - I would vote for BC

A,E for me