AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 76–150

Lambda automatically publishes invocations, duration, and error metrics to CloudWatch. You can create a CloudWatch alarm with a math expression that divides the ErrorCount by the Invocations metric to calculate the error rate, then set a threshold of 5% over a 5-minute period. This requires minimal effort as the metrics are built-in.

Option A is incorrect because CloudTrail logs API calls to Lambda, not function execution metrics. Option B is incorrect because Lambda Insights is an optional feature for detailed performance monitoring, but it is not required for basic metrics and alarms. Option C is incorrect because while Lambda logs are sent to CloudWatch Logs, using Logs Insights to query error rates is more complex than using the pre-existing CloudWatch metrics; moreover, creating alarms on log events requires additional configuration and is not as straightforward as using metric math on the standard ErrorCount metric.

You can configure CloudWatch alarms to publish to an SNS topic and use SNS subscription filter policies to route only critical notifications, thereby reducing noise. Option C is correct because CloudWatch composite alarms allow you to combine multiple alarms into a single alarm that triggers only when specific conditions (e.g., AND/OR logic) are met, consolidating alerts for the same underlying issue. Option B is incorrect because CloudWatch Evidently is used for running experiments and feature flags, not for alert consolidation.

Option D is incorrect because CloudWatch Logs Insights is a tool for querying log data, not for combining alarms. Option E is incorrect because AWS Config rules are designed to evaluate resource compliance, not to suppress alarms.

Custom Chef recipes associated with lifecycle events in AWS OpsWorks allow running Chef recipes automatically on instance lifecycle events such as Setup, Configure, Deploy, Undeploy, and Shutdown. This is the correct feature for automating package installation on all instances in a layer. Option A is incorrect because AWS CodeDeploy AppSpec file is used for CodeDeploy deployments, not OpsWorks.

Option B is incorrect because AWS CloudFormation custom resources are used to extend CloudFormation templates, not for OpsWorks automation. Option D is incorrect because AWS Systems Manager Run Command is a separate service for managing instances, not OpsWorks.

The issue is that the custom cookbook is stored in a private S3 bucket. For new instances to access the cookbook during the Setup lifecycle event, the instance must have the necessary IAM permissions to read from that S3 bucket. The instance profile attached to the OpsWorks stack's instances must include a policy that grants s3:GetObject for the cookbook's S3 bucket.

Without these permissions, the instance cannot download the cookbook, so the recipe never runs. Therefore, the engineer should ensure that the instance profile has permissions to read from the S3 bucket. Option A is incorrect because the Setup lifecycle event is appropriate for deploying configuration files when the instance is being set up; moving to Configure would run later and might not achieve the same result.

Option B is incorrect because the issue is not about the recipe being in default.rb; the cookbook is correctly associated, and the recipe is assigned to the layer lifecycle event directly, not necessarily via default.rb. Option C is incorrect because updating the cookbook version would not address the access permissions issue.

(launch RDS in a private subnet) and Option D (enable encryption at rest using AWS KMS) are correct best practices for securing an Amazon RDS database. Launching in a private subnet ensures the database is not directly accessible from the internet, enhancing security. Encryption at rest protects data stored on disk.

Option A is incorrect because enabling public accessibility increases exposure to attacks. Option B is incorrect because using a single Availability Zone does not enhance security and may reduce availability. Option E is incorrect because direct IAM user access to the database is not a standard practice; RDS uses database authentication, though IAM database authentication can be used, it's not a direct IAM user access and is not a best practice for all scenarios.

Auto Scaling groups can send lifecycle notifications directly to Amazon SNS topics, enabling real-time notifications via email, SMS, or Lambda functions. Option A is wrong because the GroupTotalInstances metric is a CloudWatch metric that reflects the total number of instances, but it does not provide real-time lifecycle event notifications; CloudWatch alarms would only alert based on threshold breaches. Option B is wrong because AWS Config rules evaluate resource configurations and compliance, not real-time instance launch/terminate events.

Option C is wrong because AWS CloudTrail records API calls for auditing and governance, but it does not provide real-time event-driven notifications.

A Service Control Policy (SCP) can deny the cloudtrail:DeleteTrail and cloudtrail:StopLogging actions across all accounts in the organization, effectively preventing member accounts from disabling CloudTrail or deleting logs. Option A is incorrect because requiring all accounts to use the same trail does not prevent them from disabling or deleting that trail; they could still perform those actions. Option C is incorrect because IAM policies within each account are managed by the account administrator and can be overridden, so they are not a reliable control.

Option D is incorrect because while logging to a centralized bucket helps protect logs, it does not prevent member accounts from disabling CloudTrail or deleting the trail itself in their own account; member accounts may still have permissions to modify or delete the trail.

Using a customer-managed KMS key to encrypt the Lambda function's environment variables satisfies the encryption at rest requirement. Option C is correct because configuring the Lambda function to be VPC-enabled and setting up a VPC endpoint for Lambda restricts invocation to within the specific VPC. Option B is incorrect because encrypting CloudWatch Logs does not encrypt the Lambda environment variables.

Option D is incorrect because assigning an IAM execution role with KMS permissions is necessary but not sufficient; the encryption is enabled by configuring KMS on the function. Option E is incorrect because resource-based policies cannot restrict invocation to VPC origin alone; VPC configuration and endpoints are required.

CloudWatch Logs Insights can query Lambda log groups and use the `stats` command to compute arbitrary percentiles, such as p75, from the 'Duration' field in Lambda logs. This allows the operations team to identify functions exceeding the 75th percentile latency. Option A is incorrect because AWS X-Ray traces requests and provides latency distributions, but it does not directly compute custom percentiles from logs.

Option B is incorrect because CloudWatch metrics for Lambda's 'Duration' metric only support fixed percentiles (e.g., p50, p90, p99) and do not allow custom percentiles like p75. Option C is incorrect because CloudWatch dashboards can display percentile widgets, but they rely on metrics with precomputed percentiles and cannot calculate new percentiles from raw log data.

(Configure an SNS topic) and Option C (Create a CloudWatch alarm) are correct. To receive notifications when CPU utilization exceeds 90% for 5 consecutive minutes, you need a CloudWatch alarm that monitors the CPUUtilization metric with the specified threshold and evaluation period. The alarm must be configured to send notifications to an SNS topic, which then delivers the message to subscribed email addresses.

Option A (Enable detailed monitoring) is not required because the evaluation period is 5 minutes, and basic monitoring (5-minute intervals) is sufficient. Option D (Create a CloudWatch Logs metric filter) is for log data, not EC2 metrics. Option E (Create a CloudWatch dashboard) is for visualization, not notification.

To be notified immediately when an IAM user creates a new access key, the most efficient approach is to use Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic. CloudTrail records the 'CreateAccessKey' API call as an event. An EventBridge rule can be configured to match this specific event pattern and send the event to an SNS topic, which can then send notifications via email, SMS, etc.

This provides real-time notification without additional services. Option A (CloudWatch Logs with metric filter and alarm) requires sending CloudTrail logs to CloudWatch Logs, which adds latency and complexity; it is not as direct as EventBridge. Option B (AWS Config with Lambda) is not designed for real-time event notification.

Option C (EventBridge with Lambda and SES) adds unnecessary Lambda processing since SNS can directly send email when subscribed to the topic.

Reducing the batch size decreases the number of records processed per invocation, lowering the write load on DynamoDB. Note that enabling the parallelization factor per shard increases the number of concurrent invocations per shard, which could actually increase write pressure; therefore, if used, it must be accompanied by sufficient write capacity. Option C is correct because configuring the event source mapping to retry failed records ensures that records are not lost; the Lambda function can retry after throttling errors, supporting exactly-once semantics.

Option E is correct because increasing the DynamoDB table's maximum write capacity auto scaling limit allows the table to scale to higher WCUs during bursts, reducing ProvisionedThroughputExceededExceptions. Option B is incorrect because the error is due to write capacity, not read capacity; increasing RCUs does not help. Option D is incorrect because increasing reserved concurrency would increase the number of concurrent Lambda invocations, potentially increasing writes and worsening throttling.

S3 Standard storage class automatically replicates data across at least three Availability Zones within an AWS Region, ensuring resilience against the loss of an entire AZ. Option B is incorrect because cross-Region replication replicates data to a different AWS Region, which provides geographic resilience but not specifically AZ resilience within the same Region. Option C is incorrect because S3 Versioning helps protect against accidental deletion or overwrite by preserving previous versions, but it does not provide data replication across AZs.

Option D is incorrect because S3 One Zone-IA stores data in a single AZ, which would not withstand the loss of that AZ.

VPC Flow Logs can capture and analyze traffic to identify dropped packets between the EC2 and RDS instances. Option B is correct because even though the default NACL allows all traffic, the private subnet's NACL may have been modified; checking its inbound/outbound rules for the database port is essential. Option C is correct because the RDS security group must explicitly allow inbound traffic on the database port (e.g., 3306) from the EC2 security group.

Option D is incorrect because DNS resolution is not directly related to connectivity between the two instances; the issue is at the network/security level. Option E is incorrect because security groups only have allow rules, not deny rules; if the RDS security group already allows the EC2 security group, no deny rules exist.

CodeDeploy deployment logs contain detailed information about the deployment process, including any errors or failed steps that could impact performance. Option B is correct because application logs on the new EC2 instances can reveal errors, misconfigurations, or resource contention that may have caused the spike. Option E is correct because comparing CloudWatch metrics (e.g., CPU utilization, latency, request count) before and after the deployment helps pinpoint changes that correlate with the performance issue.

Option C is wrong because reviewing the deployment group configuration—which defines how deployments occur (e.g., traffic routing, instance selection)—is unlikely to directly identify the root cause of a performance spike; it is more relevant for deployment strategy issues. Option D is wrong because AWS CloudTrail records API calls for auditing and security, not application performance; unauthorized API calls are unlikely to cause a transient performance spike during deployment.

Lambda@Edge runs code at CloudFront edge locations, enabling custom processing like URL rewriting or content adaptation based on user location, which can optimize delivery. Option D is correct because selecting a CloudFront price class that includes additional edge locations (e.g., Price Class All) reduces the physical distance to users, improving load times. Option B is incorrect because ElastiCache is a database cache and does not directly enhance CloudFront distribution speed.

Option C is incorrect because a Network Load Balancer operates at Layer 4 and does not cache or accelerate content. Option E is incorrect because S3 Transfer Acceleration accelerates uploads to S3, not content delivery to end users.

Setting the CloudWatch Logs retention policy on the log group to 90 days ensures logs are retained for operational analysis and then automatically expire (deleted) after 90 days. Option E is correct because to archive logs to Amazon S3 for compliance, you must use a CloudWatch Logs export task to export logs to S3 before the retention period expires. Option B is incorrect because an S3 lifecycle policy applies to objects already in S3, not to logs in CloudWatch.

Option C is incorrect because subscription filters can stream logs in real time to destinations like Lambda or Kinesis, but not directly to S3 for archival. Option D is incorrect because CloudWatch Logs does not have a lifecycle policy to transition logs directly to S3; export is required.

Options C and D are correct. D: Creating an RDS cross-Region read replica in the DR region allows the replica to be promoted to the primary database with minimal data loss, meeting the 15-minute RPO. C: Configuring Amazon Route 53 with health checks and failover routing enables automatic traffic redirection to the DR region within the 1-hour RTO.

Option A is wrong because copying AMIs and RDS snapshots every 15 minutes would require launching EC2 instances and restoring the database from snapshots, which can exceed the 1-hour RTO. Option B is wrong because manually pre-provisioning resources with CloudFormation does not provide the automated failover needed to meet the RTO. Option E is wrong because S3 cross-Region replication does not address the EC2 and RDS components of the application.

Amazon CloudWatch (Option D) is the correct service for monitoring Amazon RDS performance metrics such as CPU utilization, memory, and disk I/O. CloudWatch provides built-in metrics for RDS, allows creation of custom dashboards to visualize these metrics, and supports setting alarms for proactive notifications. Option A (AWS X-Ray) is used for tracing and analyzing requests through applications, not for infrastructure metrics.

Option B (Amazon VPC Flow Logs) captures IP traffic information for network troubleshooting, not database performance. Option C (AWS CloudTrail) logs API calls for auditing, not performance monitoring. Therefore, CloudWatch is the appropriate choice for this use case.

Options A, B, and E are correct. AWS X-Ray (Option A) provides distributed tracing to trace requests across microservices. Amazon CloudWatch Container Insights (Option E) collects, aggregates, and summarizes metrics and logs from containerized applications on EKS.

AWS CloudWatch ServiceLens (Option B) unifies CloudWatch metrics and logs with X-Ray traces to provide a single view for observability. Option C (AWS CloudTrail) is for auditing API calls, not application performance. Option D (Amazon Managed Service for Prometheus) is a separate monitoring service but is not part of the native AWS observability stack as described; the combination of X-Ray, Container Insights, and ServiceLens provides a complete solution.

The correct steps are A, C, and E. Option A creates a CloudWatch alarm on the CPUUtilization metric with a period of 300 seconds (5 minutes) and threshold 90%, which directly meets the requirement of exceeding 90% for 5 minutes. Option C creates an alarm on the StatusCheckFailed metric to notify when EC2 status checks fail.

Option E creates an SNS topic and subscribes the team's email, which is necessary to receive notifications from the alarms. Option B is incorrect because a period of 60 seconds with 5 evaluation periods would trigger after 5 minutes only if each 1-minute period is above threshold, but the simpler and intended solution is a single period of 300 seconds. Option D is incorrect because composite alarms are not required; separate alarms for different conditions are standard practice.

CloudFormation natively supports the AWS::ElasticBeanstalk::Environment resource, allowing you to define and manage the Elastic Beanstalk environment and its underlying resources directly within a CloudFormation stack. Option A is incorrect because a custom resource backed by Lambda is unnecessary when a native resource type exists for Elastic Beanstalk environments. Option B is incorrect because the CloudFormation import feature is used to bring existing resources under stack management, but it is not the primary approach for creating new environments as part of an IaC workflow.

Option C is incorrect because while you can export an existing Elastic Beanstalk environment configuration to a CloudFormation template from the console, this is a one-time export and does not provide the same level of integration and repeatability as defining the resource directly in the template.

The most likely cause is that the RDS instance was created without encryption enabled. In CloudFormation, encryption at rest for RDS requires the StorageEncrypted property to be set to true. Even if the KmsKeyId parameter is specified, if StorageEncrypted is not true, encryption is not enabled and the key ID is ignored.

Once an RDS instance is created without encryption, it cannot be enabled later. Option A correctly identifies this. Option B is less likely because cross-region KMS keys are possible but would require explicit cross-region references; the key ID being correct suggests it is in the same region.

Option C is irrelevant because if the IAM role lacked KMS permissions, the stack creation would fail rather than produce an unencrypted instance. Option D is unrelated; KMS key policies are global and not constrained by VPCs.

Options A and B are correct. A warm standby with RDS Multi-AZ across regions ensures a standby database is ready and can be promoted quickly, meeting the 1-hour RTO. A pilot light with RDS cross-region automated backups provides replication with a 15-minute RPO; a small environment is running, allowing faster failover than a full pilot light.

Option C is wrong because RDS read replicas do not support automatic failover; manual promotion can take longer than 1 hour. Option D is wrong because Multi-AZ in the same region does not protect against region failure. Option E is wrong because hourly snapshots meet RPO but restoring from snapshots typically exceeds the 1-hour RTO.

Deploying the application in a second AWS Region and using Route 53 with failover routing protects against a regional failure by redirecting traffic to the healthy region. Option A is incorrect because placing all instances in a single Availability Zone reduces availability and does not protect against regional failure. Option B is incorrect because EC2 Dedicated Hosts provide dedicated physical servers for licensing or compliance requirements, not regional resilience.

Option C is incorrect because increasing the minimum size of the Auto Scaling group only affects capacity within the current region and does not mitigate a regional outage.

Correct: B and E. Option B ensures that the desired number of EC2 instances is maintained, providing automatic scaling and fault tolerance. Option E deploys the application across multiple Availability Zones, which protects against an AZ failure.

Option A (CloudFront) enhances content delivery but does not directly ensure high availability of the web application. Option C (Multi-AZ RDS with read replicas) improves read performance and provides disaster recovery, but write availability depends on the primary instance. Option D (backups in a different region) is for disaster recovery, not for immediate availability.

Enabling multi-factor authentication (MFA) adds an extra layer of security beyond a password, which is especially important for privileged users. Option E is correct because IAM roles provide temporary credentials for applications, eliminating the need to store long-term access keys and reducing security risks. Option A is incorrect because access keys should not be shared; each user should have their own keys and they should be rotated regularly.

Option B is incorrect because storing IAM user passwords in a shared document violates security best practices and increases the risk of unauthorized access. Option D is incorrect because using the root user for daily administrative tasks is dangerous; the root user should be used only for limited, high-privilege tasks, and otherwise should be protected with MFA and not used for routine operations.

The alarm is configured to evaluate 'HTTPCode_Target_5XX_Count' over 5 consecutive periods of 1 minute, meaning it requires 5 minutes of data above the threshold to trigger. The spike lasted 10 minutes, which should have met this condition. However, if the alarm's period is set to 5 minutes instead of 1 minute, the alarm would evaluate 5 consecutive periods of 5 minutes each, requiring 25 minutes of sustained errors.

A 10-minute spike would not be enough to trigger the alarm. Therefore, option C is correct. Option A is incorrect because ALB metrics are published at 1-minute granularity.

Option B is incorrect because ALB sends metrics to CloudWatch Metrics, not CloudWatch Logs. Option D is incorrect because the metric 'HTTPCode_Target_5XX_Count' is in the correct namespace (AWS/ApplicationELB) and is specific to target groups.

To contain the incident, immediate actions should focus on isolating the instance and revoking its permissions to prevent further damage. Stopping the instance (C) preserves its state for later forensics while halting current malicious activity. Updating the security group (D) blocks all network traffic to and from the instance, cutting off communication.

Removing the IAM role (E) revokes the instance's access to S3 and DynamoDB, preventing data exfiltration or unauthorized actions. Terminating the instance (A) is not recommended because it destroys volatile data and evidence, hindering investigation. Creating an AMI (B) is a forensic step that should be done after containment; it does not immediately stop the compromise.

AWS CloudTrail records API calls made in your account, including deployment actions such as those from CodeDeploy, CloudFormation, or Elastic Beanstalk. It provides event history for troubleshooting failed deployments by showing who made what call and when. AWS Config tracks configuration changes to AWS resources, including deployment-related changes.

It can show the state of resources before and after a deployment, helping identify misconfigurations that caused the failure. The other options are incorrect: AWS Trusted Advisor offers best-practice checks and cost optimization recommendations, not deployment event logging. AWS Service Catalog manages approved IT services and product portfolios, not deployment events.

Amazon Inspector is a vulnerability assessment service for security, not deployment troubleshooting.

State Manager associations are created at a specific time and target instances that exist at that time. New instances launched after the association creation will not automatically be targeted unless the association is configured with a schedule or the 'Apply only at next update' option. The association is set to run only at launch, but the association itself must be applied to the instance at launch time.

If the association was created before the new instances, it won't apply to them unless it is updated. Option B is wrong because the association can target instances by tags; tagging is not the issue. Option C is wrong because the problem is not about the script failing; the association is not running on new instances.

Option D is wrong because the S3 bucket policy would affect the ability to store logs, but the association status would show error, not missing status.

To mitigate 'ProvisionedThroughputExceededException' errors when a Lambda function is triggered by DynamoDB Streams, two actions are effective. Option D: Increase the DynamoDB table's write capacity to handle the write demand from the stream processing. Option E: Reduce the batch size for the DynamoDB stream event source mapping to lower the number of writes per invocation, reducing the chance of exceeding throughput.

Option A is wrong because Lambda reserved concurrency controls how many concurrent executions Lambda can run, but the issue is DynamoDB throttling, not Lambda capacity. Option B is wrong because disabling DynamoDB Streams would stop the trigger entirely, which is not a mitigation. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads, not writes, and does not affect write throughput.

Options A and B are correct. AWS Systems Manager Parameter Store can store database credentials as SecureString parameters, and you can implement automatic rotation using a custom AWS Lambda function. AWS Secrets Manager provides built-in automatic rotation for supported databases (e.g., Amazon RDS, Amazon Redshift) without requiring custom code.

Option C (AWS CloudFormation) is an infrastructure-as-code service and does not manage or rotate credentials. Option D (AWS KMS) is a key management service that encrypts data but does not handle credential rotation. Option E (AWS IAM) manages access permissions and roles, not database credentials.

S3 Select allows querying only the necessary data from S3, reducing the amount of data the Lambda function must download and process. This directly addresses the timeout issue by minimizing the data handled, requiring no major architectural changes. Option B is wrong because switching to Node.js does not remove the 15-minute Lambda timeout.

Option C is wrong because increasing memory does not extend the maximum execution time. Option D is wrong because streaming the file does not by itself reduce the total data to process; it only might start processing earlier, but the total processing time still may exceed the timeout.

Creating a CloudFront invalidation for the specific file paths forces the edge locations to fetch the updated content from the S3 origin immediately, ensuring users see the latest files. Option B is incorrect because changing the bucket policy to allow public access does not affect CloudFront's cache; it only controls direct access to the bucket. Option C is incorrect because reducing the TTL affects how long new content is cached but does not clear already-cached outdated content.

Option D is incorrect because deleting and recreating the distribution is an overly disruptive solution; a simple invalidation suffices.

The most likely cause is that the security group rule is using an outdated list of CloudFront IP ranges. CloudFront's IP ranges are dynamic and change over time; AWS publishes these ranges but they are not static. When a new range is added that is not in the security group rule, requests from those IPs are blocked, leading to 'Origin Connect Error' and intermittent 503 errors.

The correct approach is to use a custom header (e.g., X-Origin-Verify) from CloudFront and validate it at the ALB, rather than relying on IP-based security groups. Option A (WAF blocking) would typically result in 403 Forbidden, not 503. Option C (SSL certificate) would cause handshake failures with a different error.

Option D (idle timeout) would cause consistent timeout errors, not intermittent ones.

Creating an organization trail in the management account automatically applies to all accounts and delivers events to the specified S3 bucket. Option C is correct because AWS Config rules can detect non-compliant trails (e.g., trails not delivering to the central bucket) and trigger automatic remediation, such as disabling the non-compliant trail or applying a fix. Option E is correct because an SCP that denies 'cloudtrail:CreateTrail' and 'cloudtrail:UpdateTrail' prevents member accounts from creating or modifying their own trails, enforcing the use of the organization trail.

Option A is incorrect because manually disabling CloudTrail in each member account is not scalable and does not prevent future trails. Option D is incorrect because enabling CloudTrail on the centralized S3 bucket (server access logging) logs access to the bucket itself, but does not ensure that CloudTrail trails deliver events to that bucket; it is not a necessary step for centralizing trail logs.

The Deny statement explicitly denies `s3:PutObject` when encryption is not AES256 (`StringNotEquals "AES256"`). Since the upload request does not specify any encryption, the condition is true, and the Deny applies, overriding any Allow. Option A is incorrect because the Allow statement's condition (requiring AES256) is not satisfied, so it does not grant permission; however, the failure is due to the explicit Deny, not because Deny is evaluated first.

Option B is incorrect because the Allow condition is not met, and the CLI default (SSE-S3) is actually AES256, but the Deny still applies because no encryption headers are present. Option D is incorrect because the Deny condition is met (StringNotEquals AES256 is true when no encryption is specified).