Pass Amazon AWS Certified DevOps Engineer - Professional DOP-C02 Exam in First Attempt Guaranteed!

Inspect key usage, aliases, pending deletion, backup dependencies and retention policy. This instead addresses a different case: An automated cleanup tool schedules deletion of a KMS key that encrypts backups needed to satisfy long retention. For the stated situation (An application has s3:GetObject permission but cannot read encrypted objects after a KMS key policy update.), the better investigation is: Inspect KMS key policy, IAM Decrypt grant, encryption context and bucket policy. The deciding distinction is: Access to SSE-KMS objects requires suitable S3 and KMS authorization.

Inspect module defaults, S3 public access settings and Config findings. This instead addresses a different case: New project buckets frequently become publicly readable because an IaC module omits S3 Block Public Access. For the stated situation (An application has s3:GetObject permission but cannot read encrypted objects after a KMS key policy update.), the better investigation is: Inspect KMS key policy, IAM Decrypt grant, encryption context and bucket policy. The deciding distinction is: Access to SSE-KMS objects requires suitable S3 and KMS authorization.

Inspect Inspector scanning coverage, asset inventory, findings and patch deployment. This instead addresses a different case: A new AMI enters production with an outdated system package, but the organization runs vulnerability assessments only once annually. For the stated situation (An application has s3:GetObject permission but cannot read encrypted objects after a KMS key policy update.), the better investigation is: Inspect KMS key policy, IAM Decrypt grant, encryption context and bucket policy. The deciding distinction is: Access to SSE-KMS objects requires suitable S3 and KMS authorization.

Inspect Deployment maxUnavailable, probes, replica counts and pod disruption budgets. This instead addresses a different case: An EKS rolling deployment scales down all API pods at once, causing requests to fail despite multiple nodes. For the stated situation (Production EC2 Auto Scaling launches instances from an AMI built manually months earlier with inconsistent patch levels.), the better investigation is: Review AMI build recipe, update schedule, patch evidence and launch template versions. The deciding distinction is: Infrastructure images should be rebuilt and validated through a repeatable automated process.

Inspect package manager configuration, external connections and CodeArtifact permissions. This instead addresses a different case: A CodeBuild project downloads packages from unrestricted public registries even though an internal vetted package repository is required. For the stated situation (Production EC2 Auto Scaling launches instances from an AMI built manually months earlier with inconsistent patch levels.), the better investigation is: Review AMI build recipe, update schedule, patch evidence and launch template versions. The deciding distinction is: Infrastructure images should be rebuilt and validated through a repeatable automated process.

Review function package contents, layer versions, supported runtimes and release links. This instead addresses a different case: An application repeatedly packages a huge unchanged runtime dependency into every Lambda release, increasing rollout time and inconsistent versions. For the stated situation (Production EC2 Auto Scaling launches instances from an AMI built manually months earlier with inconsistent patch levels.), the better investigation is: Review AMI build recipe, update schedule, patch evidence and launch template versions. The deciding distinction is: Infrastructure images should be rebuilt and validated through a repeatable automated process.

Mark production successful when the deployment API returns success regardless of application health. This instead addresses a different case: A production delivery pipeline remains green after a deployment even though health checks fail during post-deploy traffic. For the stated situation (A critical payments service is automatically promoted from a successful staging build directly into production without business acceptance.), the better unsafe assumption to reject is: Treat a successful unit-test job as the sole authorization to change regulated production. The deciding distinction is: Production promotion can require an explicit accountable approval without breaking automation.

Allow anonymous arbitrary package downloads because the resulting binary is signed. This instead addresses a different case: A CodeBuild project downloads packages from unrestricted public registries even though an internal vetted package repository is required. For the stated situation (A critical payments service is automatically promoted from a successful staging build directly into production without business acceptance.), the better unsafe assumption to reject is: Treat a successful unit-test job as the sole authorization to change regulated production. The deciding distinction is: Production promotion can require an explicit accountable approval without breaking automation.

Base64-encode the password in the repository and call it encrypted. This instead addresses a different case: A build job reads a database password directly from a committed buildspec environment variable. For the stated situation (A critical payments service is automatically promoted from a successful staging build directly into production without business acceptance.), the better unsafe assumption to reject is: Treat a successful unit-test job as the sole authorization to change regulated production. The deciding distinction is: Production promotion can require an explicit accountable approval without breaking automation.

Review trust policy principal, external ID use, STS records and least-privilege permissions. This instead addresses a different case: A deployment service assumes a role in a third-party account, but the trust policy permits any AWS principal in the partner account. For the stated situation (Human operators access high-risk account settings without multifactor authentication, even though a company policy mandates it.), the better investigation is: Review principal type, authentication context and sensitive IAM policy conditions. The deciding distinction is: High-impact human administrative access should require MFA and strong federation controls.

Inspect module defaults, S3 public access settings and Config findings. This instead addresses a different case: New project buckets frequently become publicly readable because an IaC module omits S3 Block Public Access. For the stated situation (Human operators access high-risk account settings without multifactor authentication, even though a company policy mandates it.), the better investigation is: Review principal type, authentication context and sensitive IAM policy conditions. The deciding distinction is: High-impact human administrative access should require MFA and strong federation controls.

Inspect instance profile, IAM actions, key storage and CloudTrail usage. This instead addresses a different case: An EC2 application stores a permanent IAM access key in a local configuration file to upload reports to S3. For the stated situation (Human operators access high-risk account settings without multifactor authentication, even though a company policy mandates it.), the better investigation is: Review principal type, authentication context and sensitive IAM policy conditions. The deciding distinction is: High-impact human administrative access should require MFA and strong federation controls.

Conclude that EC2 CPU must be the bottleneck without inspecting request tracing. This instead addresses a different case: An application has slow checkout requests only when external credit checks are called, but aggregate ALB metrics cannot locate the dependency. For the stated situation (A high-severity payment error alarm stays green when the application stops publishing error metrics during an outage.), the better unsafe assumption to reject is: Always treat missing data as not breaching regardless of business service risk. The deciding distinction is: Missing metric data needs treatment consistent with the failure mode and alarm semantics.

Disable all component alarms without preserving root-cause visibility. This instead addresses a different case: Five related alarms page the same team simultaneously for a single database outage, overwhelming responders. For the stated situation (A high-severity payment error alarm stays green when the application stops publishing error metrics during an outage.), the better unsafe assumption to reject is: Always treat missing data as not breaching regardless of business service risk. The deciding distinction is: Missing metric data needs treatment consistent with the failure mode and alarm semantics.

Search only recent Event History and assume it retains every event indefinitely. This instead addresses a different case: The platform team needs to analyze months of historical organization CloudTrail records across accounts to detect policy changes. For the stated situation (A high-severity payment error alarm stays green when the application stops publishing error metrics during an outage.), the better unsafe assumption to reject is: Always treat missing data as not breaching regardless of business service risk. The deciding distinction is: Missing metric data needs treatment consistent with the failure mode and alarm semantics.

Review AMI build recipe, update schedule, patch evidence and launch template versions. This instead addresses a different case: Production EC2 Auto Scaling launches instances from an AMI built manually months earlier with inconsistent patch levels. For the stated situation (A delivery pipeline in a tooling account must deploy CloudFormation into isolated production accounts without storing long-term access keys.), the better investigation is: Inspect pipeline service role, target role trust policy, STS permissions and artifact access. The deciding distinction is: Cross-account delivery should assume narrowly scoped roles in each target account.

Inspect build provenance, repository commit IDs, image digests and ECS task definition revisions. This instead addresses a different case: An on-call engineer cannot tell which Git commit generated the container image running in a production ECS service. For the stated situation (A delivery pipeline in a tooling account must deploy CloudFormation into isolated production accounts without storing long-term access keys.), the better investigation is: Inspect pipeline service role, target role trust policy, STS permissions and artifact access. The deciding distinction is: Cross-account delivery should assume narrowly scoped roles in each target account.

Inspect consumer contract tests, deployment sequencing and service version dependencies. This instead addresses a different case: A customer checkout API and its consumer contract must change together, but independent pipelines deploy incompatible revisions without a compatibility gate. For the stated situation (A delivery pipeline in a tooling account must deploy CloudFormation into isolated production accounts without storing long-term access keys.), the better investigation is: Inspect pipeline service role, target role trust policy, STS permissions and artifact access. The deciding distinction is: Cross-account delivery should assume narrowly scoped roles in each target account.

The ALB continues presenting a renewed trusted certificate without downtime. This instead addresses a different case: A production ALB certificate renewal stalls because the required DNS validation CNAME was deleted. For the stated situation (A shared ECS deployment role can update any workload in the account despite developers owning separate applications.), the better verification is: One application team can deploy its own service and is denied another team's service. The deciding distinction is: Attribute-based access can constrain operations to approved resource ownership when tags are trustworthy.

Normal sessions cannot modify critical settings and emergency elevation expires as configured. This instead addresses a different case: Production operators use permanently attached administrator policies to fix rare outages instead of using approved on-demand access. For the stated situation (A shared ECS deployment role can update any workload in the account despite developers owning separate applications.), the better verification is: One application team can deploy its own service and is denied another team's service. The deciding distinction is: Attribute-based access can constrain operations to approved resource ownership when tags are trustworthy.

A long approval wait does not cause the later deployment to use expired credentials. This instead addresses a different case: A pipeline uses STS credentials to deploy a stack, but those credentials expire during a long manual approval pause and the deployment later fails. For the stated situation (A shared ECS deployment role can update any workload in the account despite developers owning separate applications.), the better verification is: One application team can deploy its own service and is denied another team's service. The deciding distinction is: Attribute-based access can constrain operations to approved resource ownership when tags are trustworthy.

Container deployment failures may result from registry authentication and network access rather than code. This instead addresses a different case: New ECS tasks repeatedly remain PENDING with CannotPullContainerError even though the application binary is correct. For the stated situation (A pipeline fails at CodeBuild DOWNLOAD_SOURCE with AccessDenied after a KMS key policy change.), the better principle is: Pipeline stage errors must be traced to the actual denied action and role boundary. The deciding distinction is: Pipeline stage errors must be traced to the actual denied action and role boundary.

Failure investigation should use CloudFormation stack events and supported recovery operations. This instead addresses a different case: A production stack enters UPDATE_ROLLBACK_FAILED after a deleted external resource cannot be restored. For the stated situation (A pipeline fails at CodeBuild DOWNLOAD_SOURCE with AccessDenied after a KMS key policy change.), the better principle is: Pipeline stage errors must be traced to the actual denied action and role boundary. The deciding distinction is: Pipeline stage errors must be traced to the actual denied action and role boundary.

External event ingress must authenticate and deduplicate repeated delivery attempts. This instead addresses a different case: A partner sends the same signed webhook three times after a network timeout, and an AWS ingestion function creates three fulfillment jobs. For the stated situation (A pipeline fails at CodeBuild DOWNLOAD_SOURCE with AccessDenied after a KMS key policy change.), the better principle is: Pipeline stage errors must be traced to the actual denied action and role boundary. The deciding distinction is: Pipeline stage errors must be traced to the actual denied action and role boundary.

Cross-account resource access requires compatible identity permissions and resource-side authorization. This instead addresses a different case: A Lambda role has s3:GetObject but gets AccessDenied reading a bucket in another account. For the stated situation (An EC2 application stores a permanent IAM access key in a local configuration file to upload reports to S3.), the better principle is: AWS compute workloads should generally use IAM roles and temporary instance profile credentials. The deciding distinction is: AWS compute workloads should generally use IAM roles and temporary instance profile credentials.

Temporary credential lifetime and retrieval must match execution and approval workflow timing. This instead addresses a different case: A pipeline uses STS credentials to deploy a stack, but those credentials expire during a long manual approval pause and the deployment later fails. For the stated situation (An EC2 application stores a permanent IAM access key in a local configuration file to upload reports to S3.), the better principle is: AWS compute workloads should generally use IAM roles and temporary instance profile credentials. The deciding distinction is: AWS compute workloads should generally use IAM roles and temporary instance profile credentials.

NACLs are stateless and require explicit return-path allowances; security groups are stateful. This instead addresses a different case: A service needs stateful application access, but network engineers rely on one stateless NACL inbound allow rule and response traffic is blocked. For the stated situation (An EC2 application stores a permanent IAM access key in a local configuration file to upload reports to S3.), the better principle is: AWS compute workloads should generally use IAM roles and temporary instance profile credentials. The deciding distinction is: AWS compute workloads should generally use IAM roles and temporary instance profile credentials.

Update the construct to enforce Block Public Access and appropriate encryption by default. This instead addresses a different case: A reusable AWS CDK construct creates S3 buckets with public access enabled unless individual teams remember to override the setting. For the stated situation (Security Hub findings remain isolated in 40 member accounts and security operations cannot reliably track enterprise-wide exposure.), the better engineering action is: Configure central Security Hub administration and cross-Region aggregation as appropriate. The deciding distinction is: Multi-account security governance needs centralized delegated administration and aggregated visibility.

Replace persistent shared keys with approved cross-account roles and short-lived credentials. This instead addresses a different case: A central deployment role uses a shared user access key to write objects to member-account buckets. For the stated situation (Security Hub findings remain isolated in 40 member accounts and security operations cannot reliably track enterprise-wide exposure.), the better engineering action is: Configure central Security Hub administration and cross-Region aggregation as appropriate. The deciding distinction is: Multi-account security governance needs centralized delegated administration and aggregated visibility.

Provide explicit least-privilege IAM permissions while retaining appropriate SCP limits. This instead addresses a different case: A team attaches an AWS Organizations SCP allowing S3 access and assumes member-account workloads now have permission to list all buckets. For the stated situation (Security Hub findings remain isolated in 40 member accounts and security operations cannot reliably track enterprise-wide exposure.), the better engineering action is: Configure central Security Hub administration and cross-Region aggregation as appropriate. The deciding distinction is: Multi-account security governance needs centralized delegated administration and aggregated visibility.

A test run affects only approved instances and stops within the configured error threshold. This instead addresses a different case: A fleet automation document runs shell commands as root across all tagged instances with no peer review or limit on execution concurrency. For the stated situation (A Lambda cleans abandoned development stacks nightly but occasionally deletes shared production KMS keys due to an imprecise tag query.), the better verification is: An intentionally mislabelled shared resource is excluded and cleanup actions remain auditable. The deciding distinction is: Automated resource cleanup must constrain target scope and irreversible actions.

A removed employee loses intended account access without searching for duplicate IAM users. This instead addresses a different case: An enterprise manually creates duplicate IAM users in dozens of accounts for employees, creating slow offboarding. For the stated situation (A Lambda cleans abandoned development stacks nightly but occasionally deletes shared production KMS keys due to an imprecise tag query.), the better verification is: An intentionally mislabelled shared resource is excluded and cleanup actions remain auditable. The deciding distinction is: Automated resource cleanup must constrain target scope and irreversible actions.

A prohibited test configuration is detected, corrected or escalated, and logged. This instead addresses a different case: An application team repeatedly disables approved EBS encryption defaults and security reviews detect the drift weeks later. For the stated situation (A Lambda cleans abandoned development stacks nightly but occasionally deletes shared production KMS keys due to an imprecise tag query.), the better verification is: An intentionally mislabelled shared resource is excluded and cleanup actions remain auditable. The deciding distinction is: Automated resource cleanup must constrain target scope and irreversible actions.