Pass Amazon AWS Certified DevOps Engineer - Professional DOP-C02 Exam in First Attempt Guaranteed!

Automate drift detection, alerting and approved reconciliation for critical stacks. This is suitable for another situation: A production IAM role grants expanded privileges despite the approved CloudFormation template declaring limited access. In this case, engineers instead need the paired investigation (Review principal type, authentication context and sensitive IAM policy conditions.) and design change (Enforce MFA through suitable identity provider or IAM session conditions.). These two steps address: Human operators access high-risk account settings without multifactor authentication, even though a company policy mandates it.

Require approved permissions boundaries for created roles and deny removal or bypass. This is suitable for another situation: A platform group allows developers to create application IAM roles, but one developer creates a new role granting AdministratorAccess. In this case, engineers instead need the paired investigation (Review principal type, authentication context and sensitive IAM policy conditions.) and design change (Enforce MFA through suitable identity provider or IAM session conditions.). These two steps address: Human operators access high-risk account settings without multifactor authentication, even though a company policy mandates it.

Implement safe Secrets Manager rotation and compatible runtime secret refresh. This is suitable for another situation: Multiple application instances embed a database password that is rotated manually, causing widespread outages after each change. In this case, engineers instead need the paired investigation (Review principal type, authentication context and sensitive IAM policy conditions.) and design change (Enforce MFA through suitable identity provider or IAM session conditions.). These two steps address: Human operators access high-risk account settings without multifactor authentication, even though a company policy mandates it.

Trace pipeline stages, approval authorization, test outputs and required change windows. This instead addresses a different case: A critical payments service is automatically promoted from a successful staging build directly into production without business acceptance. For the stated situation (An ECS task starts successfully but is continually removed from service because its target group health check targets a nonexistent path.), the better investigation is: Inspect ALB target-group path, task port, security group rules and service events. The deciding distinction is: Task deployment health checks must reflect the live application's endpoint and readiness behavior.

Inspect published version ARNs, alias routing and rollback manifest. This instead addresses a different case: A Lambda release is invoked through an alias but the deployment pipeline overwrites the prior version identifier in its rollback records. For the stated situation (An ECS task starts successfully but is continually removed from service because its target group health check targets a nonexistent path.), the better investigation is: Inspect ALB target-group path, task port, security group rules and service events. The deciding distinction is: Task deployment health checks must reflect the live application's endpoint and readiness behavior.

Inspect pipeline variables, execution role permissions and organization-level Region conditions. This instead addresses a different case: A deployment pipeline has approvals for one Region but a wrong parameter lets the same artifact create resources in an unapproved jurisdiction. For the stated situation (An ECS task starts successfully but is continually removed from service because its target group health check targets a nonexistent path.), the better investigation is: Inspect ALB target-group path, task port, security group rules and service events. The deciding distinction is: Task deployment health checks must reflect the live application's endpoint and readiness behavior.

New test account resources are assessed and noncompliant configurations reported. This instead addresses a different case: AWS Organizations account vending creates accounts without Config rules checking EBS encryption and S3 protection. For the stated situation (A CloudFormation-managed security group was changed directly in the console, and the next stack update behaves differently from the approved template.), the better verification is: A repeat drift check reports consistent properties and a controlled change trail. The deciding distinction is: Infrastructure drift should be detected and reconciled through controlled IaC changes.

A newly added test account receives the approved stack and OU removal behavior follows policy. This instead addresses a different case: A central platform team needs to roll out an approved Config rule to newly joined accounts across multiple Regions without manual role creation each time. For the stated situation (A CloudFormation-managed security group was changed directly in the console, and the next stack update behaves differently from the approved template.), the better verification is: A repeat drift check reports consistent properties and a controlled change trail. The deciding distinction is: Infrastructure drift should be detected and reconciled through controlled IaC changes.

A new test environment provisions the function and trigger without console-only steps. This instead addresses a different case: Developers manually create Lambda permissions and API Gateway integrations after deploying a packaged application, causing environment differences. For the stated situation (A CloudFormation-managed security group was changed directly in the console, and the next stack update behaves differently from the approved template.), the better verification is: A repeat drift check reports consistent properties and a controlled change trail. The deciding distinction is: Infrastructure drift should be detected and reconciled through controlled IaC changes.

Record commit metadata and promote images by immutable digest through the release pipeline. This instead addresses a different case: An on-call engineer cannot tell which Git commit generated the container image running in a production ECS service. For the stated situation (A deployment retrieves ZIP bundles from a common S3 prefix where operators can replace a file without updating the approved release record.), the better engineering action is: Deploy pinned S3 object versions or digests after controlled artifact publication. The deciding distinction is: Artifact integrity should be verified against immutable signed or hashed release metadata.

Route dependencies through approved CodeArtifact repositories with controlled upstream access. This instead addresses a different case: A CodeBuild project downloads packages from unrestricted public registries even though an internal vetted package repository is required. For the stated situation (A deployment retrieves ZIP bundles from a common S3 prefix where operators can replace a file without updating the approved release record.), the better engineering action is: Deploy pinned S3 object versions or digests after controlled artifact publication. The deciding distinction is: Artifact integrity should be verified against immutable signed or hashed release metadata.

Use dependency lockfiles and deterministic build inputs with immutable package storage. This instead addresses a different case: Two identical source commits produce different Lambda packages because the build downloads the newest transitive dependencies each day. For the stated situation (A deployment retrieves ZIP bundles from a common S3 prefix where operators can replace a file without updating the approved release record.), the better engineering action is: Deploy pinned S3 object versions or digests after controlled artifact publication. The deciding distinction is: Artifact integrity should be verified against immutable signed or hashed release metadata.

Schema migration tests must account for temporarily coexisting application versions. This instead addresses a different case: A new release adds a non-null column while old application instances still write rows during a blue/green deployment. For the stated situation (A service passes one-user functional tests yet violates its 99th percentile latency target at peak checkout demand.), the better principle is: Performance acceptance must use representative concurrency and measured service-level thresholds. The deciding distinction is: Performance acceptance must use representative concurrency and measured service-level thresholds.

End-to-end application acceptance should validate critical customer transactions and dependencies. This instead addresses a different case: After a deployment, the homepage returns HTTP 200 while checkout is broken for authenticated customers. For the stated situation (A service passes one-user functional tests yet violates its 99th percentile latency target at peak checkout demand.), the better principle is: Performance acceptance must use representative concurrency and measured service-level thresholds. The deciding distinction is: Performance acceptance must use representative concurrency and measured service-level thresholds.

Artifact integrity should be verified against immutable signed or hashed release metadata. This instead addresses a different case: A deployment retrieves ZIP bundles from a common S3 prefix where operators can replace a file without updating the approved release record. For the stated situation (A service passes one-user functional tests yet violates its 99th percentile latency target at peak checkout demand.), the better principle is: Performance acceptance must use representative concurrency and measured service-level thresholds. The deciding distinction is: Performance acceptance must use representative concurrency and measured service-level thresholds.

Inspect load balancer access log settings, S3 policy, Region and delivery status. This instead addresses a different case: An ALB intermittently rejects requests, but access logs are absent because the configured S3 bucket policy denies delivery. For the stated situation (API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops.), the better investigation is: Inspect tracing activation, propagation headers, service map and correlated request IDs. The deciding distinction is: Distributed tracing requires propagation of trace context and compatible instrumentation.

Inspect subscription filters, destination ARN, Lambda/Kinesis processing and delivery errors. This instead addresses a different case: CloudWatch Logs receives application errors but the incident analytics system never sees them because the log stream is not forwarded. For the stated situation (API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops.), the better investigation is: Inspect tracing activation, propagation headers, service map and correlated request IDs. The deciding distinction is: Distributed tracing requires propagation of trace context and compatible instrumentation.

Review AWS Config resource timeline and recorded CloudTrail changes for the period. This instead addresses a different case: A tagged production S3 bucket is currently private, but auditors need to know whether it was public during a past incident window. For the stated situation (API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops.), the better investigation is: Inspect tracing activation, propagation headers, service map and correlated request IDs. The deciding distinction is: Distributed tracing requires propagation of trace context and compatible instrumentation.

Inspect provisioning workflow, organization rules, configuration recorders and baselines. This instead addresses a different case: AWS Organizations account vending creates accounts without Config rules checking EBS encryption and S3 protection. For the stated situation (A company provisions AWS accounts manually and regularly forgets baseline logging and governance settings.), the better investigation is: Inspect Control Tower landing zone, Account Factory templates and detective guardrails. The deciding distinction is: Account vending should create standardized governed accounts through an approved landing-zone process.

Examine event identifiers, retry behavior, transactional storage and duplicate records. This instead addresses a different case: An S3 ObjectCreated event invokes a Lambda that retries a billing update after a transient error and charges the same customer twice. For the stated situation (A company provisions AWS accounts manually and regularly forgets baseline logging and governance settings.), the better investigation is: Inspect Control Tower landing zone, Account Factory templates and detective guardrails. The deciding distinction is: Account vending should create standardized governed accounts through an approved landing-zone process.

Review source and destination OUs, StackSets auto-deployment and SCP effective controls. This instead addresses a different case: A team moves an account to a new OU and expects an existing StackSets-managed baseline to remain unchanged without review. For the stated situation (A company provisions AWS accounts manually and regularly forgets baseline logging and governance settings.), the better investigation is: Inspect Control Tower landing zone, Account Factory templates and detective guardrails. The deciding distinction is: Account vending should create standardized governed accounts through an approved landing-zone process.

Instrument affected services and analyze slow traces to isolate the expensive dependency. This is suitable for another situation: An application has slow checkout requests only when external credit checks are called, but aggregate ALB metrics cannot locate the dependency. In this case, engineers instead need the paired investigation (Review CodeDeploy deployment group alarms, target health and service error signals.) and design change (Associate deployment-specific health alarms and enable appropriate automated rollback.). These two steps address: A new ECS task definition produces errors after traffic shift, but the deployment continues to completion because alarms are not associated with the release.

Inspect AWS Health event source, EventBridge rules, targets and account aggregation. This is suitable for another situation: A regional AWS Health event indicates maintenance of a service used by five accounts, but no on-call team receives it. In this case, engineers instead need the paired investigation (Review CodeDeploy deployment group alarms, target health and service error signals.) and design change (Associate deployment-specific health alarms and enable appropriate automated rollback.). These two steps address: A new ECS task definition produces errors after traffic shift, but the deployment continues to completion because alarms are not associated with the release.

Set queue age alarms and controlled poison-message routing to a DLQ. This is suitable for another situation: A queue's depth remains modest but its oldest message waits 40 minutes because one poison message repeatedly fails processing. In this case, engineers instead need the paired investigation (Review CodeDeploy deployment group alarms, target health and service error signals.) and design change (Associate deployment-specific health alarms and enable appropriate automated rollback.). These two steps address: A new ECS task definition produces errors after traffic shift, but the deployment continues to completion because alarms are not associated with the release.

Capacity failures require examining availability zones, allocation strategy and quotas. This instead addresses a different case: An Auto Scaling group repeatedly fails to launch enough instances in one AZ despite other AZs having capacity. For the stated situation (Following an AWS service impairment, application timeouts increase in one Region but operators repeatedly redeploy healthy code.), the better principle is: Root cause analysis should correlate AWS Health events with application, network and deployment telemetry. The deciding distinction is: Root cause analysis should correlate AWS Health events with application, network and deployment telemetry.

Container deployment failures may result from registry authentication and network access rather than code. This instead addresses a different case: New ECS tasks repeatedly remain PENDING with CannotPullContainerError even though the application binary is correct. For the stated situation (Following an AWS service impairment, application timeouts increase in one Region but operators repeatedly redeploy healthy code.), the better principle is: Root cause analysis should correlate AWS Health events with application, network and deployment telemetry. The deciding distinction is: Root cause analysis should correlate AWS Health events with application, network and deployment telemetry.

External event ingress must authenticate and deduplicate repeated delivery attempts. This instead addresses a different case: A partner sends the same signed webhook three times after a network timeout, and an AWS ingestion function creates three fulfillment jobs. For the stated situation (Following an AWS service impairment, application timeouts increase in one Region but operators repeatedly redeploy healthy code.), the better principle is: Root cause analysis should correlate AWS Health events with application, network and deployment telemetry. The deciding distinction is: Root cause analysis should correlate AWS Health events with application, network and deployment telemetry.

Review CloudTrail change events, Config rule status, approval records and owner. This is suitable for another situation: Operations edits a firewall security group to add temporary unrestricted access but forgets to remove it after an emergency. In this case, engineers instead need the paired investigation (Inspect EventBridge event patterns, sample AWS event payloads and Lambda invocations.) and design change (Create selective event patterns matching only approved incident conditions.). These two steps address: A security automation rule currently runs for every CloudTrail event, flooding a response Lambda with unrelated calls.

Review delivery guarantees, subscriptions, DLQs and consumer coupling. This is suitable for another situation: One order-created event needs to inform billing, fulfillment and analytics independently, but a direct Lambda chain loses downstream events when one service is unavailable. In this case, engineers instead need the paired investigation (Inspect EventBridge event patterns, sample AWS event payloads and Lambda invocations.) and design change (Create selective event patterns matching only approved incident conditions.). These two steps address: A security automation rule currently runs for every CloudTrail event, flooding a response Lambda with unrelated calls.

Use stable device partition keys where ordering is required, with monitored throughput. This is suitable for another situation: A telemetry consumer requires per-device ordering but producers assign random partition keys and observations arrive out of sequence. In this case, engineers instead need the paired investigation (Inspect EventBridge event patterns, sample AWS event payloads and Lambda invocations.) and design change (Create selective event patterns matching only approved incident conditions.). These two steps address: A security automation rule currently runs for every CloudTrail event, flooding a response Lambda with unrelated calls.

Inspect Lambda concurrent executions, throttles, payment API quotas and latency. This instead addresses a different case: A public API invokes Lambda and saturates an external payment service when automatic concurrency grows after a marketing event. For the stated situation (An EC2 Auto Scaling policy sees high CPU during boot and launches many extra instances before new nodes can serve traffic.), the better investigation is: Inspect instance warmup, health readiness, scaling events and CPU trends. The deciding distinction is: Scaling policies must account for instance startup and warmup behavior.

Inspect bucket versioning, Object Lock governance or compliance mode, policies and retention. This instead addresses a different case: A regulated dataset is protected by S3 copies, but the only operator can permanently delete versions during an incident. For the stated situation (An EC2 Auto Scaling policy sees high CPU during boot and launches many extra instances before new nodes can serve traffic.), the better investigation is: Inspect instance warmup, health readiness, scaling events and CPU trends. The deciding distinction is: Scaling policies must account for instance startup and warmup behavior.

Inspect partition key distribution, throttled requests and access patterns. This instead addresses a different case: A DynamoDB table has substantial unused provisioned capacity but requests to one partition key still throttle under burst load. For the stated situation (An EC2 Auto Scaling policy sees high CPU during boot and launches many extra instances before new nodes can serve traffic.), the better investigation is: Inspect instance warmup, health readiness, scaling events and CPU trends. The deciding distinction is: Scaling policies must account for instance startup and warmup behavior.