Pass Amazon AWS Certified DevOps Engineer - Professional DOP-C02 Exam in First Attempt Guaranteed!

Cross-account resource access requires compatible identity permissions and resource-side authorization. This instead addresses a different case: A Lambda role has s3:GetObject but gets AccessDenied reading a bucket in another account. For the stated situation (A platform group allows developers to create application IAM roles, but one developer creates a new role granting AdministratorAccess.), the better principle is: Delegated role creation should be constrained by a permission boundary and governing policies. The deciding distinction is: Delegated role creation should be constrained by a permission boundary and governing policies.

Audit evidence should be isolated from operators who perform high-risk changes. This instead addresses a different case: An administrator can modify production resources and delete the only CloudTrail delivery bucket objects using the same role. For the stated situation (A platform group allows developers to create application IAM roles, but one developer creates a new role granting AdministratorAccess.), the better principle is: Delegated role creation should be constrained by a permission boundary and governing policies. The deciding distinction is: Delegated role creation should be constrained by a permission boundary and governing policies.

Central federation can simplify attribution, temporary sessions and staff deprovisioning. This instead addresses a different case: Developers in 25 AWS accounts authenticate with individually created IAM users whose credentials remain active after termination. For the stated situation (A platform group allows developers to create application IAM roles, but one developer creates a new role granting AdministratorAccess.), the better principle is: Delegated role creation should be constrained by a permission boundary and governing policies. The deciding distinction is: Delegated role creation should be constrained by a permission boundary and governing policies.

Add an isolated integration stage with representative database access and verifiable test assertions. This instead addresses a different case: Unit tests pass but a newly deployed Lambda service cannot authenticate to the staging RDS database. For the stated situation (A build job reads a database password directly from a committed buildspec environment variable.), the better engineering action is: Move the credential to Secrets Manager or encrypted Parameter Store and grant narrowly scoped read permissions. The deciding distinction is: Build and deployment secrets should be retrieved through controlled secret stores and scoped identities.

Choose a pipeline execution mode or deployment lock appropriate to the shared environment. This instead addresses a different case: Two successive commits trigger deployments against the same production stack, and the earlier execution finishes after the newer release. For the stated situation (A build job reads a database password directly from a committed buildspec environment variable.), the better engineering action is: Move the credential to Secrets Manager or encrypted Parameter Store and grant narrowly scoped read permissions. The deciding distinction is: Build and deployment secrets should be retrieved through controlled secret stores and scoped identities.

Use appropriate source change triggers and path filters with explicit handling of shared dependencies. This instead addresses a different case: A monorepo contains infrastructure, mobile and billing folders, but every README edit launches all three expensive production pipelines. For the stated situation (A build job reads a database password directly from a committed buildspec environment variable.), the better engineering action is: Move the credential to Secrets Manager or encrypted Parameter Store and grant narrowly scoped read permissions. The deciding distinction is: Build and deployment secrets should be retrieved through controlled secret stores and scoped identities.

Review principal ARN, IAM allow, bucket policy, KMS policy and any explicit deny. This instead addresses a different case: A Lambda role has s3:GetObject but gets AccessDenied reading a bucket in another account. For the stated situation (A developer's administrator IAM policy still fails to launch an unapproved service because an OU SCP contains an explicit deny.), the better investigation is: Inspect inherited SCPs, IAM identity policy and the denied API condition. The deciding distinction is: Organization guardrails limit effective permissions regardless of broad account IAM Allow.

Inspect role-creation permissions, boundary attachment requirements and privilege escalation paths. This instead addresses a different case: A platform group allows developers to create application IAM roles, but one developer creates a new role granting AdministratorAccess. For the stated situation (A developer's administrator IAM policy still fails to launch an unapproved service because an OU SCP contains an explicit deny.), the better investigation is: Inspect inherited SCPs, IAM identity policy and the denied API condition. The deciding distinction is: Organization guardrails limit effective permissions regardless of broad account IAM Allow.

Review stack drift status, CloudTrail changes and IAM effective policy. This instead addresses a different case: A production IAM role grants expanded privileges despite the approved CloudFormation template declaring limited access. For the stated situation (A developer's administrator IAM policy still fails to launch an unapproved service because an OU SCP contains an explicit deny.), the better investigation is: Inspect inherited SCPs, IAM identity policy and the denied API condition. The deciding distinction is: Organization guardrails limit effective permissions regardless of broad account IAM Allow.

Review action region, artifact store configuration, KMS grants and destination execution permissions. This instead addresses a different case: A release pipeline runs in one Region but must deploy a serverless service to a second Region with artifacts available for that target. For the stated situation (An application repeatedly packages a huge unchanged runtime dependency into every Lambda release, increasing rollout time and inconsistent versions.), the better investigation is: Review function package contents, layer versions, supported runtimes and release links. The deciding distinction is: Shared dependencies should be versioned and referenced deliberately in serverless releases.

Review ECR tag mutability, digests, image lifecycle policies and build attestations. This instead addresses a different case: A container image tag is overwritten weekly, so audit teams cannot reproduce the exact build used for an earlier release. For the stated situation (An application repeatedly packages a huge unchanged runtime dependency into every Lambda release, increasing rollout time and inconsistent versions.), the better investigation is: Review function package contents, layer versions, supported runtimes and release links. The deciding distinction is: Shared dependencies should be versioned and referenced deliberately in serverless releases.

Review AMI build recipe, update schedule, patch evidence and launch template versions. This instead addresses a different case: Production EC2 Auto Scaling launches instances from an AMI built manually months earlier with inconsistent patch levels. For the stated situation (An application repeatedly packages a huge unchanged runtime dependency into every Lambda release, increasing rollout time and inconsistent versions.), the better investigation is: Review function package contents, layer versions, supported runtimes and release links. The deciding distinction is: Shared dependencies should be versioned and referenced deliberately in serverless releases.

Enable appropriately scoped VPC Flow Logs to a secure central destination. This instead addresses a different case: Security investigators cannot reconstruct a suspected data exfiltration path because VPC Flow Logs were never enabled for regulated subnets. For the stated situation (API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops.), the better engineering action is: Enable supported AWS X-Ray tracing or OpenTelemetry tracing and propagate context. The deciding distinction is: Distributed tracing requires propagation of trace context and compatible instrumentation.

Configure suitable scheduled or predictive scaling alongside reactive controls. This instead addresses a different case: A predictable daily traffic peak starts before the reactive Auto Scaling policy can launch sufficient EC2 instances. For the stated situation (API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops.), the better engineering action is: Enable supported AWS X-Ray tracing or OpenTelemetry tracing and propagate context. The deciding distinction is: Distributed tracing requires propagation of trace context and compatible instrumentation.

Configure a supported CloudWatch Logs subscription to the approved analytics pipeline. This instead addresses a different case: CloudWatch Logs receives application errors but the incident analytics system never sees them because the log stream is not forwarded. For the stated situation (API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops.), the better engineering action is: Enable supported AWS X-Ray tracing or OpenTelemetry tracing and propagate context. The deciding distinction is: Distributed tracing requires propagation of trace context and compatible instrumentation.

Review AWS Config resource timeline and recorded CloudTrail changes for the period. This is suitable for another situation: A tagged production S3 bucket is currently private, but auditors need to know whether it was public during a past incident window. In this case, engineers instead need the paired investigation (Inspect fields for status code, revision, trace ID and service name.) and design change (Query structured log events grouped by revision and error pattern using Logs Insights.). These two steps address: A burst of HTTP 500s appears in logs, but operators query raw text and cannot correlate failures by deployment revision.

Inspect Inspector finding resources, image digests, package versions and exposure. This is suitable for another situation: Amazon Inspector reports a critical package CVE on a small set of container images, but the security board assumes all images are affected. In this case, engineers instead need the paired investigation (Inspect fields for status code, revision, trace ID and service name.) and design change (Query structured log events grouped by revision and error pattern using Logs Insights.). These two steps address: A burst of HTTP 500s appears in logs, but operators query raw text and cannot correlate failures by deployment revision.

Configure CloudWatch agent collection of memory metrics and a justified alarm threshold. This is suitable for another situation: An EC2 application runs out of memory while CPU remains low, but CloudWatch dashboards contain only default EC2 CPU metrics. In this case, engineers instead need the paired investigation (Inspect fields for status code, revision, trace ID and service name.) and design change (Query structured log events grouped by revision and error pattern using Logs Insights.). These two steps address: A burst of HTTP 500s appears in logs, but operators query raw text and cannot correlate failures by deployment revision.

Examine event identifiers, retry behavior, transactional storage and duplicate records. This is suitable for another situation: An S3 ObjectCreated event invokes a Lambda that retries a billing update after a transient error and charges the same customer twice. In this case, engineers instead need the paired investigation (Inspect AWS Config evaluation, remediation role rights and affected resource types.) and design change (Configure a suitable AWS Config rule with controlled Systems Manager automation remediation.). These two steps address: An application team repeatedly disables approved EBS encryption defaults and security reviews detect the drift weeks later.

Measure task duration, timeouts, retry safety and progress checkpoints. This is suitable for another situation: A Lambda invoked for a multi-hour infrastructure migration times out before tasks finish and loses progress. In this case, engineers instead need the paired investigation (Inspect AWS Config evaluation, remediation role rights and affected resource types.) and design change (Configure a suitable AWS Config rule with controlled Systems Manager automation remediation.). These two steps address: An application team repeatedly disables approved EBS encryption defaults and security reviews detect the drift weeks later.

Inspect provisioning workflow, organization rules, configuration recorders and baselines. This is suitable for another situation: AWS Organizations account vending creates accounts without Config rules checking EBS encryption and S3 protection. In this case, engineers instead need the paired investigation (Inspect AWS Config evaluation, remediation role rights and affected resource types.) and design change (Configure a suitable AWS Config rule with controlled Systems Manager automation remediation.). These two steps address: An application team repeatedly disables approved EBS encryption defaults and security reviews detect the drift weeks later.

Infrastructure images should be rebuilt and validated through a repeatable automated process. This instead addresses a different case: Production EC2 Auto Scaling launches instances from an AMI built manually months earlier with inconsistent patch levels. For the stated situation (Deployment artifacts containing sensitive configuration are stored in an S3 bucket with broad read access and no enforced encryption policy.), the better principle is: Artifact storage needs controlled access, encryption and traceable retention. The deciding distinction is: Artifact storage needs controlled access, encryption and traceable retention.

Container provenance controls should verify publishers and immutable artifact digests. This instead addresses a different case: A registry contains internal and third-party images, and the deployment job cannot distinguish approved signed builds from untrusted tags. For the stated situation (Deployment artifacts containing sensitive configuration are stored in an S3 bucket with broad read access and no enforced encryption policy.), the better principle is: Artifact storage needs controlled access, encryption and traceable retention. The deciding distinction is: Artifact storage needs controlled access, encryption and traceable retention.

Delivery traceability needs immutable artifact identity linked to source and deployment records. This instead addresses a different case: An on-call engineer cannot tell which Git commit generated the container image running in a production ECS service. For the stated situation (Deployment artifacts containing sensitive configuration are stored in an S3 bucket with broad read access and no enforced encryption policy.), the better principle is: Artifact storage needs controlled access, encryption and traceable retention. The deciding distinction is: Artifact storage needs controlled access, encryption and traceable retention.

A member-account noncompliant test volume appears in the aggregated view. This instead addresses a different case: Governance wants one view of noncompliant encrypted volumes across every AWS Organization account and Region. For the stated situation (A production ALB certificate renewal stalls because the required DNS validation CNAME was deleted.), the better verification is: The ALB continues presenting a renewed trusted certificate without downtime. The deciding distinction is: Managed public certificate renewal depends on sustained validation prerequisites.

Permitted connection and return traffic succeed while prohibited access is denied. This instead addresses a different case: A service needs stateful application access, but network engineers rely on one stateless NACL inbound allow rule and response traffic is blocked. For the stated situation (A production ALB certificate renewal stalls because the required DNS validation CNAME was deleted.), the better verification is: The ALB continues presenting a renewed trusted certificate without downtime. The deciding distinction is: Managed public certificate renewal depends on sustained validation prerequisites.

The application reads approved encrypted objects but cannot decrypt unrelated keys. This instead addresses a different case: An application has s3:GetObject permission but cannot read encrypted objects after a KMS key policy update. For the stated situation (A production ALB certificate renewal stalls because the required DNS validation CNAME was deleted.), the better verification is: The ALB continues presenting a renewed trusted certificate without downtime. The deciding distinction is: Managed public certificate renewal depends on sustained validation prerequisites.

A rerun reads the source artifact successfully without unrestricted KMS access. This instead addresses a different case: A pipeline fails at CodeBuild DOWNLOAD_SOURCE with AccessDenied after a KMS key policy change. For the stated situation (AWS Config finds an EC2 instance without the approved monitoring agent, but the repair Lambda has permission to modify every resource in the account.), the better verification is: A test missing-agent instance is corrected while unrelated resources remain untouched. The deciding distinction is: Event-based remediation should be scoped to the affected resource and run with least privilege.

A test rotation allows new connections and does not expose plaintext credentials. This instead addresses a different case: A scheduled Secrets Manager rotation updates a credential, but its consumer application continues using the revoked password and fails authentication. For the stated situation (AWS Config finds an EC2 instance without the approved monitoring agent, but the repair Lambda has permission to modify every resource in the account.), the better verification is: A test missing-agent instance is corrected while unrelated resources remain untouched. The deciding distinction is: Event-based remediation should be scoped to the affected resource and run with least privilege.

A known temporary exposure is detected and safely removed with an audit record. This instead addresses a different case: Operations edits a firewall security group to add temporary unrestricted access but forgets to remove it after an emergency. For the stated situation (AWS Config finds an EC2 instance without the approved monitoring agent, but the repair Lambda has permission to modify every resource in the account.), the better verification is: A test missing-agent instance is corrected while unrelated resources remain untouched. The deciding distinction is: Event-based remediation should be scoped to the affected resource and run with least privilege.

Point-in-time recovery depends on backup retention and database capabilities, not just one manual snapshot. This instead addresses a different case: A table is accidentally overwritten and operators can restore only yesterday's full snapshot, losing recent transactions. For the stated situation (A regulated dataset is protected by S3 copies, but the only operator can permanently delete versions during an incident.), the better principle is: Backup retention should resist malicious or accidental deletion for the required period. The deciding distinction is: Backup retention should resist malicious or accidental deletion for the required period.

Recovery feasibility includes pre-authorized IAM roles and tested control-plane actions. This instead addresses a different case: The secondary service is healthy, but a disaster exercise reveals operators cannot change DNS because the failover role lacks permission. For the stated situation (A regulated dataset is protected by S3 copies, but the only operator can permanently delete versions during an incident.), the better principle is: Backup retention should resist malicious or accidental deletion for the required period. The deciding distinction is: Backup retention should resist malicious or accidental deletion for the required period.

Caching or read replicas can reduce repeated reads when consistency requirements permit. This instead addresses a different case: An authenticated read-heavy API repeatedly queries a database for identical catalog metadata, exhausting database read capacity. For the stated situation (A regulated dataset is protected by S3 copies, but the only operator can permanently delete versions during an incident.), the better principle is: Backup retention should resist malicious or accidental deletion for the required period. The deciding distinction is: Backup retention should resist malicious or accidental deletion for the required period.