AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 1201–1275

Options A and C are correct. The error suggests the build environment cannot authenticate or reach ECR. Adding ECR permissions to the IAM role allows pulling images.

Configuring VPC endpoints allows the build to reach ECR privately without NAT. Option B is unnecessary if the build already has a VPC. Option D is for public access, but the repository is private.

Option E is about KMS, not related.

Option D is correct because the base-directory is set to 'build' but the build command 'npm run build' likely outputs to a different directory (e.g., 'dist'). Option A is wrong because the install phase runs npm install. Option B is wrong because runtime version is valid.

Option C is wrong because '**/*' matches all files.

Option B is correct because the deployment group is configured in CodeDeploy, and if the pipeline's deploy stage references a deployment group that does not exist, it will fail. Option A is wrong because IAM roles would cause a different error. Option C is wrong because insufficient capacity would cause a deployment error, not a missing group.

Option D is wrong because the application name would also cause a different error.

Aurora Global Database provides cross-region replication with sub-second RPO and failover in minutes. Option A is wrong because RDS Multi-AZ is single-region. Option B is wrong because DynamoDB global tables have sub-second RPO but may not meet RTO.

Option D is wrong because read replicas have higher RPO.

Option B is correct because if the Lambda function is throttled, API Gateway will wait for a response and eventually time out. Option A is wrong because the logs are being produced. Option C is wrong because the function execution is fast.

Option D is wrong because the timeout is adequate.

Options A and B are correct. Option A: Using a VPC with a NAT gateway does not reduce pulls. Option C: CodeArtifact can cache images, reducing pulls from Docker Hub.

Option D: CodeBuild local caching can cache layers, reducing pulls. Option E: ECR is a registry, not a cache for Docker Hub.

Option D is correct because if the CodeDeploy agent is not installed or not running on the EC2 instances, the instances will not report as healthy, causing the deployment to fail with the given error. Option A is incorrect because CodeDeploy does not require the instances to be behind a load balancer. Option B is incorrect because CodeCommit permissions do not affect the deploy stage.

Option C is incorrect because CodeBuild artifacts not being stored in S3 would cause a build failure, not a deploy failure.

Option C is correct because you can publish slow query logs to CloudWatch Logs, create a metric filter to count occurrences, and set an alarm on that metric. Option A is wrong because RDS Events do not include slow query counts. Option B is wrong because Enhanced Monitoring does not include slow query logs.

Option D is wrong because CloudTrail does not capture database queries.

Git filter-branch can rewrite history to remove the file from all commits. However, AWS recommends using the AWS CLI's git-secrets or the AWS CodeCommit console's 'delete repository' option. But the most secure and straightforward approach is to use git filter-branch to purge the file and then force push.

Option A is wrong because simply reverting the commit leaves the keys in history. Option B is wrong because deleting the file and committing does not remove history. Option D is wrong because AWS does not provide a built-in command to remove a file from history.

Option C is correct. By default, ALB distributes traffic evenly across AZs, but cross-zone load balancing must be enabled to distribute traffic evenly across all instances regardless of AZ. Option A is wrong because ALB already distributes traffic across AZs.

Option B is wrong because Route 53 is not needed for internal distribution. Option D is wrong because target group health checks are already enabled.

Option D is correct because readiness probes detect when a pod is not ready to serve traffic and remove it from the service endpoints quickly. The ALB ingress controller respects readiness probes. Option A is incorrect because liveness probes restart pods but do not remove them from service immediately.

Option B is incorrect because increasing the health check interval would make the situation worse. Option C is incorrect because pod anti-affinity affects scheduling, not traffic routing.

Option A (multi-AZ task placement) and Option D (circuit breaker pattern) are correct. Multi-AZ placement spreads tasks across Availability Zones to tolerate AZ failures. Circuit breaker pattern prevents cascading failures.

Option B is wrong because increasing memory does not improve resilience. Option C is wrong because using the same subnet reduces resilience. Option E is wrong because scheduled scaling does not handle unexpected spikes.

Option D is correct because AWS X-Ray provides end-to-end tracing to pinpoint latency issues in distributed applications. Option A is wrong because CloudWatch Logs Insights alone does not trace requests across services. Option B is wrong because Prometheus metrics are aggregated and may not correlate individual requests.

Option C is wrong because CloudWatch Synthetics canaries test endpoints but cannot trace internal service calls.

Option B is correct because CloudTrail captures CloudFormation API calls (CreateStack, UpdateStack, DeleteStack) and CloudWatch Events can trigger SNS notifications based on those API calls. Option A is wrong because Config rules evaluate resource compliance, not API events. Option C is wrong because S3 event notifications are for S3 objects.

Option D is wrong because Lambda alone cannot capture who made the change without CloudTrail integration.

Option B is correct because by default, CodeBuild does not fetch pull request references from forked repositories for security reasons. The build project must be configured to allow pull request builds from forked repositories. Option A is wrong because the error is about fetching, not about file not found.

Option C is wrong because the buildspec is being executed, so it is valid. Option D is wrong because the error is about fetching, not about insufficient permissions.

Options A and D are correct. Multi-AZ provides automatic failover to a standby in a different AZ. Automated backups with point-in-time recovery allow restoring to a specific time.

Option B is incorrect because read replicas do not provide automatic failover. Option C is incorrect because cross-region replication is for regional DR, not immediate failover. Option E is incorrect because deletion protection prevents accidental deletion but does not help with failure.

Option C is correct because Lambda can parse the commit and trigger the appropriate pipeline. Option A is wrong because it builds everything. Option B is wrong because it requires multiple repos.

Option D is wrong because it still builds all.

Option C is correct because Systems Manager Patch Manager supports patch baselines and maintenance windows, and can be used with State Manager to schedule patching. By creating separate patching schedules for test and production, patches can be tested first. Option A is wrong because Patch Manager does not automatically install patches without a maintenance window.

Option B is wrong because Run Command is manual. Option D is wrong because Automation is not designed for patching.

B, C, and E are correct. Cross-Region read replica provides near-real-time replication (low RPO) and can be promoted quickly (low RTO). Automated backups are replicated to another Region and can be restored, but RTO may exceed 15 minutes.

Option A is wrong because manual snapshots cannot achieve <1 minute RPO. Option D is wrong because Multi-AZ protects within a Region only.

Option A is correct because the Lambda rotation function needs permissions to read and update the secret. Option C is correct because using a separate user for rotation allows the old credentials to remain valid during rotation. Option E is correct because CloudWatch alarms can detect rotation failures.

Option B is wrong because the rotation function should have network access to the database, but using a VPC endpoint is not required; the function can be in a VPC. Option D is wrong because disabling rotation for old secrets would break the rotation process.

Option D is correct because ElastiCache Redis supports encryption in transit using TLS, which must be enabled at cluster creation. Option A is wrong because VPC peering does not encrypt traffic. Option B is wrong because NACLs do not encrypt.

Option C is wrong because the application must use TLS, but the cluster must also be configured to support it.

Cross-account access requires both a bucket policy in Account A granting access to the user in Account B and an IAM user policy in Account B allowing the user to access the bucket. Option A is wrong because only bucket policy is insufficient. Option C is wrong because only IAM policy is insufficient.

Option D is wrong because ACLs are legacy and not recommended.

Option C is correct. With DAX enabled, the application reads from DAX, so the relevant latency metric is the DAX cache hit latency. Option A is incorrect because DynamoDB read latency does not reflect DAX caching.

Option B is incorrect because DynamoDB consumed read capacity is not a latency metric. Option D is incorrect because DAX cache hit count is a count, not a latency measure.

Option C (run a custom recipe using 'Execute Recipes' on the instances) is correct because it applies the updated cookbook without replacing instances. Option A is wrong because cloning creates a new stack, not updating existing instances. Option B is wrong because updating the stack configuration does not trigger cookbook execution.

Option D is wrong because it updates the layer, but does not run the updated cookbook automatically.

Option C is correct because having a single pipeline with a parallel action for unit tests and then a serial integration test stage is the simplest and most straightforward design. Option A is incorrect because it suggests separate pipelines, which would require complex coordination. Option B is incorrect because a serial stage for unit tests would increase overall time.

Option D is incorrect because CodeBuild does not have built-in fan-out/fan-in; the pipeline provides that.

Option C is correct because CodeBuild needs security group rules that allow outbound traffic to the RDS instance and the RDS security group must allow inbound traffic from CodeBuild. Option A is wrong because NAT gateway is for internet access, not for database connectivity within VPC. Option B is wrong because VPC endpoints are for AWS services, not for RDS connectivity.

Option D is wrong because IAM roles do not control network connectivity.

Option C is correct because without a health check, CodeDeploy doesn't know when to register. Option A is wrong because ELB health checks are separate. Option B is wrong because original instances are deregistered after.

Option D is wrong because CodeDeploy does registration.

Option A (CodeBuild) is correct because it can run custom security scanning tools. Option D (Amazon Inspector) is correct because it can be integrated as a test action to scan for vulnerabilities. Option B (CodeDeploy) is for deployment, not scanning.

Option C (GuardDuty) is for threat detection in the AWS environment, not code scanning. Option E (Detective) is for analyzing security findings, not scanning code.

Options A, C, and D are correct. Option A: Enable termination protection to prevent stack deletion. Option C: Set DeletionPolicy to Retain on the RDS instance so it is not deleted.

Option D: Use a StackPolicy to protect resources from updates. Option B is incorrect because stack policy does not prevent deletion. Option E is incorrect because nested stacks do not provide protection.

Option A is correct because CloudTrail Insights identifies unusual API activity like role assumption anomalies. Option B is wrong because CloudWatch Logs filters would require manual setup. Option C is wrong because S3 event notifications are for object-level events.

Option D is wrong because VPC Flow Logs track network traffic, not API calls.

Option A is correct because RDS Proxy pools and shares database connections, reducing the number of connections to the database. Option D is correct because configuring the database with appropriate max_connections and using Auto Scaling (e.g., Aurora Auto Scaling) helps handle spikes. Option E is correct because using a connection pool sidecar (e.g., PgBouncer) in the EKS pods adds connection pooling at the application level.

Option B (direct connections) would increase load. Option C (ElastiCache) is for caching, not connection management.

Option D is correct because AWS Systems Manager Run Command uses a push-based model to execute commands and manage configuration on instances. Option A (OpsWorks) is pull-based. Option B (CloudFormation) is for infrastructure, not configuration.

Option C (CodeCommit) is a source control service.

Option D is correct because distributing instances across multiple AZs ensures that failure of one AZ does not affect the entire application, and using a multi-AZ deployment with proper Auto Scaling group configuration is a best practice for high availability. Option A is wrong because increasing instance size does not mitigate AZ failure. Option B is wrong because a single AZ still presents a single point of failure.

Option C is wrong because using a larger AMI does not help with resilience.

Option A is correct because the route table must have a route to the NAT gateway. Option B is correct because the security group must allow outbound traffic (e.g., HTTPS). Option C is wrong because the internet gateway is attached to the VPC, not the subnet.

Option D is wrong because public IP is not needed for instances in private subnet using NAT. Option E is wrong because the NAT gateway is in a public subnet, but the instance is in private; the instance does not have a public IP.

Options A, C, and D are correct. After deployment, an integration test stage validates the deployment. A manual approval stage allows review before promotion.

Additional testing (e.g., load test) can be added. Option B is wrong because a separate deployment to a different environment is not necessary. Option E is wrong because rolling back is not a testing step.

Option A is needed to build and push the image. Option D is needed to update the ECS service. Option B is for secrets retrieval, but not essential for the pipeline flow.

Option C is for static analysis, not required. Option E is for load testing, not required.

Option D is correct because the storage resolution parameter allows metrics to be stored at a higher resolution (1 second) which can be retrieved faster. Option A is wrong because the CloudWatch agent is not needed for custom API calls. Option B is wrong because increasing the PutMetricData frequency may cause throttling.

Option C is wrong because CloudWatch Logs does not replace custom metrics.

CloudWatch Anomaly Detection creates a model of expected metric behavior and alerts on anomalies. CloudWatch alarms can then trigger actions. Option A and D are correct.

Option B is incorrect because AWS Config is for configuration compliance. Option C is incorrect because AWS CloudTrail is for API auditing. Option E is incorrect because Amazon GuardDuty is for security threats.

To enforce encryption in transit, the ALB target group should use HTTPS protocol, which requires the instances to present a certificate. Option A is wrong because HTTP does not encrypt traffic. Option B is wrong because the TLS termination should be at the ALB, not re-encrypted.

Option D is wrong because security groups do not enforce encryption.

Option A and Option C are correct. Amazon SNS can send notifications, and CloudWatch Events (now Amazon EventBridge) can capture Auto Scaling lifecycle events and trigger SNS. Option B (CloudTrail) logs API calls but does not directly trigger notifications.

Option D (Lambda) can be used but is not required; SNS alone is sufficient. Option E (Config) records configuration changes but is not the primary choice for real-time notifications.

Option B is correct because if the application caches the secret, it will not pick up the new password after rotation, leading to connection errors. Option A is incorrect because RDS automatic password rotation is not a feature; Secrets Manager handles rotation. Option C is incorrect because KMS permissions are needed to decrypt the secret, but if the application could access the secret initially, it likely has permissions.

Option D is incorrect because Lambda function concurrency is unlikely to cause connection errors; it would affect the rotation process itself.

Option B is correct because the condition 'IsProd' is false when Environment is 'dev', so the DeletionPolicy evaluates to 'Delete', meaning the bucket will be deleted when the stack is deleted. Option A is wrong because the DeletionPolicy is set to Delete. Option C is wrong because the condition is evaluated at stack creation and deletion.

Option D is wrong because the bucket is deleted.

Option D is correct because increasing the visibility timeout allows the function more time to process, and using a DLQ ensures that messages that repeatedly fail are captured. Option A is wrong because decreasing visibility timeout would cause messages to reappear sooner. Option B is wrong because reducing reserved concurrency would cause throttling.

Option C is wrong because splitting the batch does not address the timeout.

Option B is correct because CodePipeline can be configured with a source action that uses the 'Amazon S3' (via CodeCommit webhook) or directly with CodeCommit as the source provider, and a cloudwatch event rule is automatically created to trigger the pipeline on changes to the specified branch. Option A is wrong because manual approval is not needed for automatic triggering. Option C is wrong because CodeBuild can be triggered independently, but the pipeline itself needs a source trigger.

Option D is wrong because S3 events are not used for CodeCommit.

Option B is correct because using a dynamic stack name based on the branch name or a unique identifier ensures each pipeline execution creates a separate stack, avoiding name conflicts. Option A is wrong because deleting the stack before creation may cause downtime. Option C is wrong because CloudFormation does not support stack name overrides; a new name must be used.

Option D is wrong because hardcoding a different stack name per branch is not scalable.

Option C is correct because caching dependencies in a S3 bucket allows subsequent builds to reuse them. Option A is wrong because upgrading instance type may not help if the bottleneck is network. Option B is wrong because parallel builds don't reduce single build time.

Option D is wrong because multiple build environments don't reduce time.

Option C is correct because CodePipeline supports manual approval actions that can be inserted between stages. Option A is wrong because CodeCommit approval rules only apply to code merges, not pipeline execution. Option B is wrong because IAM policies cannot create approval gates in the pipeline.

Option D is wrong because CodeBuild does not have native approval capabilities.

Option A is correct: the policy is missing s3:PutObject on the bucket itself (not just the objects). Option B is not relevant. Option C is not relevant.

Option D is not relevant.

Option B is correct because the error message indicates that the runtime 'nodejs18.x' is not supported. Option A is wrong because the error is about runtime, not S3 access. Option C is wrong because the error is specific to Lambda runtime, not IAM.

Option D is wrong because the error is about an invalid parameter, not a timeout.

B and E are correct. Storing session data externally (ElastiCache) makes instances stateless. Enabling sticky sessions is not needed if state is external; however, the question asks for statelessness, so removing stickiness is correct.

Option A is wrong because stickiness contradicts statelessness. Option C is wrong because in-memory storage is the problem. Option D is wrong because it doesn't address session state.

Option B is correct because the high memory utilization (above 80%) is likely causing performance degradation. Increasing the memory limit for the task definition will allow the container to handle more load. Option A is wrong because CPU is not the bottleneck.

Option C is wrong because scaling the ALB does not address the container's resource limits. Option D is wrong because increasing the desired count without fixing the memory limit may not help if each task is memory-constrained.

Option C is correct because the DeletionPolicy: Retain ensures the bucket is not deleted when the stack is deleted. Option A is wrong because the bucket is retained. Option B is wrong because the bucket exists.

Option D is wrong because the stack deletion succeeds, but the bucket remains.

Amazon Inspector can be integrated as a test action in CodePipeline to scan for vulnerabilities. GuardDuty is a threat detection service, not a scanning tool for code or containers. Config evaluates resource configurations.

Trusted Advisor provides best practice checks, not vulnerability scanning.

Option D is correct because a circuit breaker automatically detects deployment failures and rolls back. Option A is wrong because ECS service auto recovery is for underlying infrastructure. Option B is wrong because managed scaling adjusts desired count, not rollback.

Option C is wrong because CloudWatch alarms can trigger rollback but are not automatic within ECS itself.

Options A, C, and E are correct. Independent pipelines, automated testing, and blue/green deployments are key. Option B is wrong because a monolith pipeline contradicts microservices.

Option D is wrong because manual gates slow down deployment.

S3 Versioning keeps all versions, allowing recovery from deletes and overwrites. Option B is wrong because MFA Delete is an additional protection but not the primary. Option C is wrong because bucket policies control access.

Option D is wrong because replication is for cross-region copies.

A: The pipeline needs an IAM role to assume in the target account. C: The target account must trust the pipeline account to allow role assumption. D: The pipeline service role must have permission to assume the target role.

B is not required because the pipeline can be in the source account. E is not required because the pipeline uses the assumed role, not the target account's pipeline.