AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 1726–1740

Option A is correct. User data scripts run as root, and the output is typically logged to /var/log/cloud-init-output.log on Linux instances. Option B is incorrect because CloudTrail does not capture user data execution logs.

Option C is incorrect because Systems Manager Run Command is not used to retrieve logs from user data. Option D is incorrect because CloudWatch Logs agent must be configured in the user data to send logs; it is not automatically enabled.

The correct answer is D. AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance.

EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.

Option B is correct because Route 53 failover routing policy with health checks on the ALB endpoint can automatically route traffic to a secondary endpoint when the primary is unhealthy. Option A is wrong because weighted routing distributes traffic based on weights, not failover. Option C is wrong because latency routing routes based on latency, not automatic failover.

Option D is wrong because geolocation routing routes based on geographic location, not failover.

Auto Scaling automatically replaces unhealthy instances. ELB health checks integration triggers replacement. Option A is wrong because EC2 Instance Recovery only recovers on the same host.

Option C is wrong because CloudFormation doesn't auto-replace. Option D is wrong because Systems Manager doesn't replace instances.

Option C is correct because AWS Config rule remediation actions can be configured to run an Automation document when a resource is non-compliant. Option A is wrong because CloudWatch Events alone cannot run remediation; it would need a target like Lambda. Option B is wrong because SNS notifications are just notifications, not remediation.

Option D is wrong because AWS Config does not directly trigger CodePipeline.

Option C is correct because if the Lambda function's execution role does not have permission to receive messages from SQS, it cannot process them, causing them to go to DLQ. Option A is wrong because SQS does not have a timeout that causes messages to go to DLQ; that's a Lambda function timeout. Option B is wrong because visibility timeout is set on the queue, not Lambda.

Option D is wrong because DLQ is not used for Lambda errors; it's used for messages that cannot be processed.

Option D is correct because adding appropriate indexes can reduce the number of rows scanned, thus reducing CPU usage. Option A is wrong because increasing instance size is a temporary fix. Option B is wrong because read replicas are for read traffic, not for reducing CPU on the primary.

Option C is wrong because increasing storage does not reduce CPU.

The pipeline stages are in different regions: Build in us-east-1, Deploy in us-west-2. CodePipeline does not support cross-region actions unless cross-region action is configured with proper artifact storage. The default pipeline runs in a single region.

Option B is correct.

Option D is correct because Elastic Beanstalk supports blue/green deployments by swapping CNAME records between two environments. Option A is wrong because Elastic Beanstalk does not natively use CodeDeploy for blue/green; it has its own swap method. Option B is wrong because updating the Auto Scaling group is not a blue/green approach.

Option C is wrong because updating the load balancer target group is more of a rolling update.

Option B is correct because distributing instances across multiple Availability Zones ensures high availability without over-provisioning. Option A is wrong because it only adds capacity in one zone. Option C is wrong because it is more expensive and complex.

Option D is wrong because it does not address availability zone failure.

Option A is correct because HTTPCode_Target_5XX_Count indicates server errors. Option B is correct because TargetResponseTime can indicate performance issues leading to errors. Option C is wrong because RequestCount is total requests, not errors.

Option D is wrong because HealthyHostCount is about host health, not application errors. Option E is wrong because HTTPCode_ELB_5XX_Count is for ALB itself, not targets.

Option A is correct because State Manager is used for configuration management. Option C is correct because Patch Manager manages patching. Option E is correct because Run Command executes commands remotely.

Option B is wrong because OpsCenter is for operational issues. Option D is wrong because Parameter Store is for secrets management, not configuration management per se.

Option C is correct because CodePipeline can use branch filtering in the source stage to trigger on specific branches, and the test stage can be configured to run for all branches. Option A is wrong because a single pipeline cannot have dynamic branch-based stages without multiple pipelines. Option B is wrong because separate pipelines per branch would duplicate effort.

Option D is wrong because Lambda triggers are not the standard way to implement branch-based logic; branch filtering is native.

Options B and C are correct. B: Using a change set allows reviewing proposed changes without applying them. C: StackSets with approval workflows are not standard; however, using a separate pipeline with a manual approval step in CodePipeline before executing the change set is a valid approach.

Option A is wrong because SCPs cannot control CloudFormation changes specifically. Option D is wrong because IAM policies can restrict who can update, but not provide an approval workflow. Option E is wrong because Config rules are detective, not preventive.