DOP-C02 practice questions and answers

Correct answer: A — Switch the deployment group to CodeDeploy blue/green, provisioning a replacement Auto Scaling group and rerouting the load balancer once the new instances pass health checks.

Blue/green with CodeDeploy launches a parallel fleet, waits for health checks, then shifts the load balancer — capacity stays at 100% and rollback is a reroute back to the original instances, which takes minutes. AllAtOnce is faster but takes the whole fleet down at once and still needs a redeploy to undo. Adding capacity with OneAtATime keeps the same slow, in-place process. Instance refresh with a new AMI is a reasonable pattern but rolls forward gradually; undoing it means another full refresh.

Correct answer: A — Create an Amazon EventBridge rule for the ECR Image Action Successful event, filtered on the repository and image tag, with the pipeline as the target.

ECR emits image push events to EventBridge, and an event pattern can match the repository name and tag, starting the pipeline immediately. CodePipeline polling intervals are not user-tunable to seconds and polling is the pattern being replaced. Lifecycle policies expire old images; they do not invoke anything. A scheduled pipeline trades one form of polling for another.

Correct answer: A — Use one pipeline where the build stage produces a versioned artifact, later stages consume that same input artifact, and a manual approval action with an SNS topic gates the production stage.

Building once and promoting the same artifact through stages is what guarantees production runs the tested bits, and a manual approval action records who approved it and when in the pipeline execution history. Rebuilding for production — in a second pipeline or per stage — can produce a different artifact from the same commit because dependencies and base images move. Deploying to both environments in parallel means production gets untested code.

Correct answer: A, B — Install and configure the SSM Agent on all instances, define patch baselines with auto-approval delays, and run patching as a Systems Manager maintenance window task. · Use the AWS-RunPatchBaseline SSM document, which supports both Windows and Linux instances.

Patch Manager is the managed answer: the SSM Agent plus patch baselines with approval delays, executed on a maintenance window schedule, and compliance reported per instance. AWS-RunPatchBaseline is the current document and covers both operating systems, whereas AWS-ApplyPatchBaseline is the older Windows-only document. Driving SSH and WinRM from Lambda rebuilds the service badly, and CloudFormation has no patching feature — that option exists only as a distractor.

Correct answer: A — Enable the AWS Config required-tags managed rule scoped to the AWS::EC2::Volume resource type, with a remediation action that runs an SSM Automation runbook to apply the default tag.

Config continuously evaluates the resource type you scope the rule to, so a volume that is created untagged — or has its tag removed months later — becomes non-compliant and the attached remediation puts the tag back. An EventBridge rule on CreateVolume only ever sees creation, so a tag deleted afterwards goes unnoticed. Scoping the rule to instances checks the wrong resource type and misses unattached volumes. Trusted Advisor reports; it does not remediate.

Correct answer: A — Deploy an Aurora global database with a secondary cluster in ap-southeast-1, serve local reads there, and promote the secondary during a regional failure.

Aurora global database replicates with typical lag under a second using storage-level replication, serves low-latency reads from the secondary Region, and supports promotion of a secondary in minutes. Multi-AZ protects against an AZ failure, not a Region failure, and 15-minute snapshots blow the RPO. An Aurora cluster and its replicas live in one Region, so option C is not possible. DMS can replicate cross-Region but adds a pipeline to operate and does not give a managed one-step promotion.

Correct answer: A — Attach both a FARGATE and a FARGATE_SPOT capacity provider to the cluster and set a capacity provider strategy with a base on FARGATE and the remaining weight on FARGATE_SPOT, and handle the SIGTERM stop timeout in the task.

A capacity provider strategy with `base` on the On-Demand provider guarantees the baseline, and weights send the rest to Spot. ECS sends SIGTERM and honours the stop timeout when Spot capacity is reclaimed, so a task that handles the signal drains cleanly. Spot only leaves no guaranteed baseline. A raw Spot ASG without capacity providers gives ECS no way to balance the two pools. AWS Batch on On-Demand simply gives up the savings.

Correct answer: A — Instrument the services with the AWS Distro for OpenTelemetry, run it as a sidecar, and send traces to AWS X-Ray to get a service map and segment timings.

Distributed tracing is what breaks a single request into segments per service and downstream call; ADOT collects the traces and X-Ray renders the service map with timings, including AWS SDK calls and external HTTP calls. CPU metrics say nothing about where a request spent its time. ALB logs cover the edge request only, not internal hops. Flow logs are network metadata with no request context.

Correct answer: A — Memory and disk are guest-level metrics that the hypervisor cannot see; install the CloudWatch agent to publish them as custom metrics and alarm on those.

CloudWatch collects EC2 metrics from outside the instance, so it can see CPU, network and disk I/O at the device level but not what the operating system reports for memory or filesystem usage. The CloudWatch agent runs inside the instance and publishes those as custom metrics. Detailed monitoring only changes the resolution of existing metrics from five minutes to one. Instance Connect is an SSH access feature, and ASG group metrics describe the group, not the OS.

Correct answer: A — Set a retention policy on every log group, and for the compliance log group add a subscription filter or export to Amazon S3 with a lifecycle rule, querying it with Amazon Athena when needed.

Log groups default to Never expire, so setting retention is the direct fix for the storage bill, and moving the compliance data to S3 keeps 12 months at object-storage prices while staying queryable through Athena. Manual quarterly deletion is toil that will be forgotten. Lowering log levels helps ingestion cost but leaves three years of stored data. Writing files straight to S3 from the applications throws away live tailing, metric filters and alarms.

Correct answer: A — Enable the ECS deployment circuit breaker with rollback on the service.

The deployment circuit breaker watches how many tasks fail to reach a steady state during a rolling deployment, stops the deployment, and — when rollback is enabled — restores the last known good task definition without human involvement. A lower minimum healthy percent just replaces tasks faster with the same broken image. An alarm notifies but does not act. A longer grace period delays health checks, which would have made the outage last longer.

Correct answer: A — Set the Auto Scaling group's health check type to ELB and set a health check grace period long enough for application start-up.

By default an Auto Scaling group uses EC2 status checks, which pass while the operating system is fine and the application is dead. Switching the health check type to ELB makes the group act on the load balancer's view and replace the instance, with the grace period preventing new instances from being killed during start-up. Reboot actions on status check alarms address hardware and OS failures. Scale-in protection keeps bad instances alive. Raising the healthy threshold makes recovery slower, not faster.

Correct answer: A — Attach a service control policy to the organizational units that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail and denies actions outside the approved Regions using the aws:RequestedRegion condition.

SCPs set the maximum available permissions for member accounts, so an explicit deny applies even to account administrators and the root user — nothing inside the account can grant its way around it. IAM policies and permissions boundaries are managed within the account, so a local administrator can change them. Config rules detect after the fact and cannot prevent the action.

Correct answer: A — The KMS key policy must allow the deployment account principals to use the key (kms:Decrypt), and those principals need kms:Decrypt in their own IAM policies.

Reading an SSE-KMS object needs two grants: permission on the object from the bucket policy, and permission on the key. For cross-account use, both the key policy and the caller's IAM policy must allow kms:Decrypt — the key policy alone in one account is not enough. Requester Pays is about data transfer billing. Removing encryption defeats the control. Bucket ACLs are legacy and cannot grant KMS permissions.

Correct answer: A — Enable Amazon Inspector enhanced scanning on the ECR repository and add a pipeline stage that queries the scan findings for the pushed image digest and fails the build when a CRITICAL finding exists.

Enhanced scanning continuously scans images pushed to ECR, and a pipeline stage that reads the findings for the exact image digest turns the scan into an enforced gate — the deployment simply does not happen. Human review before an approval action is a process control that gets rushed. Scanning running production tasks finds the problem after it shipped. SCPs evaluate IAM request context and cannot inspect image contents.