Pass Amazon AWS Certified DevOps Engineer - Professional DOP-C02 Exam in First Attempt Guaranteed!

Quarantine only the confirmed instance through reviewed network or isolation controls. This is suitable for another situation: An incident automation should isolate one compromised EC2 instance, but its script selects every instance in the same environment tag. In this case, engineers instead need the paired investigation (Inspect ECS service events, target health, logs, dependency reachability and restart rate.) and design change (Use ECS service reconciliation with alarms and root-cause escalation for repeated failures.). These two steps address: An ECS application task fails health checks every few minutes, and the team restarts the same failing task manually without identifying a dependency outage.

Inspect relevant AWS Health notices, affected resources, deploy timestamps and CloudWatch metrics. This is suitable for another situation: Following an AWS service impairment, application timeouts increase in one Region but operators repeatedly redeploy healthy code. In this case, engineers instead need the paired investigation (Inspect ECS service events, target health, logs, dependency reachability and restart rate.) and design change (Use ECS service reconciliation with alarms and root-cause escalation for repeated failures.). These two steps address: An ECS application task fails health checks every few minutes, and the team restarts the same failing task manually without identifying a dependency outage.

Inspect EventBridge event pattern, action-induced events and invocation counts. This is suitable for another situation: An event rule starts a Lambda that tags an EC2 resource, and the resulting CloudTrail tagging event triggers the same Lambda repeatedly. In this case, engineers instead need the paired investigation (Inspect ECS service events, target health, logs, dependency reachability and restart rate.) and design change (Use ECS service reconciliation with alarms and root-cause escalation for repeated failures.). These two steps address: An ECS application task fails health checks every few minutes, and the team restarts the same failing task manually without identifying a dependency outage.

Apply reviewed region-deny guardrails with necessary exceptions at appropriate OU scope. This instead addresses a different case: A multinational OU has a data residency rule, but new accounts can deploy regulated S3 resources in arbitrary Regions. For the stated situation (A team moves an account to a new OU and expects an existing StackSets-managed baseline to remain unchanged without review.), the better engineering action is: Plan OU migrations with explicit baseline deployment and removal behavior tests. The deciding distinction is: Account movement can change inherited guardrails and service-managed StackSets targets.

Use service-managed StackSets with appropriate OU targets and automatic deployment where supported. This instead addresses a different case: A central platform team needs to roll out an approved Config rule to newly joined accounts across multiple Regions without manual role creation each time. For the stated situation (A team moves an account to a new OU and expects an existing StackSets-managed baseline to remain unchanged without review.), the better engineering action is: Plan OU migrations with explicit baseline deployment and removal behavior tests. The deciding distinction is: Account movement can change inherited guardrails and service-managed StackSets targets.

Replace persistent shared keys with approved cross-account roles and short-lived credentials. This instead addresses a different case: A central deployment role uses a shared user access key to write objects to member-account buckets. For the stated situation (A team moves an account to a new OU and expects an existing StackSets-managed baseline to remain unchanged without review.), the better engineering action is: Plan OU migrations with explicit baseline deployment and removal behavior tests. The deciding distinction is: Account movement can change inherited guardrails and service-managed StackSets targets.

Use an appropriate Athena-backed query or CloudTrail Lake pattern to search retained audit events. This instead addresses a different case: The platform team needs to analyze months of historical organization CloudTrail records across accounts to detect policy changes. For the stated situation (A seasonal shopping workload triggers fixed CPU threshold alerts every evening although nightly traffic is normal and expected.), the better engineering action is: Configure CloudWatch anomaly detection with evaluated bounds and meaningful context. The deciding distinction is: Dynamic baseline alarms can detect unusual deviations when static thresholds create chronic false positives.

Use the appropriate metric split and correlated logs to target the failing layer. This instead addresses a different case: An application dashboard reports increased HTTP 5xx errors after release, but it does not distinguish target errors from errors generated by the ALB. For the stated situation (A seasonal shopping workload triggers fixed CPU threshold alerts every evening although nightly traffic is normal and expected.), the better engineering action is: Configure CloudWatch anomaly detection with evaluated bounds and meaningful context. The deciding distinction is: Dynamic baseline alarms can detect unusual deviations when static thresholds create chronic false positives.

Set queue age alarms and controlled poison-message routing to a DLQ. This instead addresses a different case: A queue's depth remains modest but its oldest message waits 40 minutes because one poison message repeatedly fails processing. For the stated situation (A seasonal shopping workload triggers fixed CPU threshold alerts every evening although nightly traffic is normal and expected.), the better engineering action is: Configure CloudWatch anomaly detection with evaluated bounds and meaningful context. The deciding distinction is: Dynamic baseline alarms can detect unusual deviations when static thresholds create chronic false positives.

Use stable device partition keys where ordering is required, with monitored throughput. This instead addresses a different case: A telemetry consumer requires per-device ordering but producers assign random partition keys and observations arrive out of sequence. For the stated situation (A broken message repeatedly fails an event-driven worker and blocks useful progress while on-call has no way to inspect it.), the better engineering action is: Configure an appropriate SQS DLQ with alerting and governed redrive procedure. The deciding distinction is: Poison messages should be isolated with bounded receive counts and accountable remediation.

Correct the specific startup configuration or image error and deploy a verified revision. This instead addresses a different case: An EKS deployment enters CrashLoopBackOff after a config release, although the cluster nodes and pods have adequate CPU. For the stated situation (A broken message repeatedly fails an event-driven worker and blocks useful progress while on-call has no way to inspect it.), the better engineering action is: Configure an appropriate SQS DLQ with alerting and governed redrive procedure. The deciding distinction is: Poison messages should be isolated with bounded receive counts and accountable remediation.

Create selective event patterns matching only approved incident conditions. This instead addresses a different case: A security automation rule currently runs for every CloudTrail event, flooding a response Lambda with unrelated calls. For the stated situation (A broken message repeatedly fails an event-driven worker and blocks useful progress while on-call has no way to inspect it.), the better engineering action is: Configure an appropriate SQS DLQ with alerting and governed redrive procedure. The deciding distinction is: Poison messages should be isolated with bounded receive counts and accountable remediation.

Check CloudFormation import support, logical IDs, actual configuration and queue identifiers. This instead addresses a different case: A production queue built manually is now required in a managed CloudFormation stack, but engineers fear recreating it will lose messages. For the stated situation (A managed EC2 fleet often loses an approved monitoring agent after instance replacement.), the better investigation is: Review SSM agent registration, associations, instance profiles and compliance reporting. The deciding distinction is: Configuration state should be continuously enforced on new and existing managed nodes.

Examine event identifiers, retry behavior, transactional storage and duplicate records. This instead addresses a different case: An S3 ObjectCreated event invokes a Lambda that retries a billing update after a transient error and charges the same customer twice. For the stated situation (A managed EC2 fleet often loses an approved monitoring agent after instance replacement.), the better investigation is: Review SSM agent registration, associations, instance profiles and compliance reporting. The deciding distinction is: Configuration state should be continuously enforced on new and existing managed nodes.

Measure task duration, timeouts, retry safety and progress checkpoints. This instead addresses a different case: A Lambda invoked for a multi-hour infrastructure migration times out before tasks finish and loses progress. For the stated situation (A managed EC2 fleet often loses an approved monitoring agent after instance replacement.), the better investigation is: Review SSM agent registration, associations, instance profiles and compliance reporting. The deciding distinction is: Configuration state should be continuously enforced on new and existing managed nodes.

A test missing-agent instance is corrected while unrelated resources remain untouched. This instead addresses a different case: AWS Config finds an EC2 instance without the approved monitoring agent, but the repair Lambda has permission to modify every resource in the account. For the stated situation (A GuardDuty finding appears in one account, but the incident team sees it only after manually checking the service console.), the better verification is: A safe test finding creates a tracked incident with account, resource and severity context. The deciding distinction is: Security findings need reliable event routing with context and severity-based action.

A delayed file starts exactly one logical report after it is fully available. This instead addresses a different case: An automation starts on a fixed schedule even though the required S3 data file often arrives late, causing incomplete daily reports. For the stated situation (A GuardDuty finding appears in one account, but the incident team sees it only after manually checking the service console.), the better verification is: A safe test finding creates a tracked incident with account, resource and severity context. The deciding distinction is: Security findings need reliable event routing with context and severity-based action.

An affected account event is visible to authorized operators with timely service context. This instead addresses a different case: An AWS Health event affects a critical enterprise database in an otherwise quiet account, but the team monitors only application CloudWatch alarms. For the stated situation (A GuardDuty finding appears in one account, but the incident team sees it only after manually checking the service console.), the better verification is: A safe test finding creates a tracked incident with account, resource and severity context. The deciding distinction is: Security findings need reliable event routing with context and severity-based action.

A test network flow is represented in accessible records with relevant interface information. This instead addresses a different case: Security investigators cannot reconstruct a suspected data exfiltration path because VPC Flow Logs were never enabled for regulated subnets. For the stated situation (A predictable daily traffic peak starts before the reactive Auto Scaling policy can launch sufficient EC2 instances.), the better verification is: Capacity is ready before known peaks while unwanted excess capacity is limited. The deciding distinction is: Predictable demand can be addressed with scheduled or predictive capacity planning.

A failing test release restores healthy tasks while recording the rollback reason. This instead addresses a different case: A new ECS task definition produces errors after traffic shift, but the deployment continues to completion because alarms are not associated with the release. For the stated situation (A predictable daily traffic peak starts before the reactive Auto Scaling policy can launch sufficient EC2 instances.), the better verification is: Capacity is ready before known peaks while unwanted excess capacity is limited. The deciding distinction is: Predictable demand can be addressed with scheduled or predictive capacity planning.

A duplicate alarm event causes no duplicate destructive action and notification is consistent. This instead addresses a different case: An alarm invokes a Lambda that restarts services and pages staff, but retries sometimes perform the restart twice and send conflicting messages. For the stated situation (A predictable daily traffic peak starts before the reactive Auto Scaling policy can launch sufficient EC2 instances.), the better verification is: Capacity is ready before known peaks while unwanted excess capacity is limited. The deciding distinction is: Predictable demand can be addressed with scheduled or predictive capacity planning.

Private TLS key material should be protected and excluded from build artifacts. This instead addresses a different case: A custom TLS termination service stores its private key in an unencrypted public container image layer. For the stated situation (A disaster-recovery copy process creates unencrypted EC2 volumes from old snapshots even though the production baseline requires encryption.), the better principle is: Encryption standards should apply to restored volumes and associated snapshot workflows. The deciding distinction is: Encryption standards should apply to restored volumes and associated snapshot workflows.

Compliance monitoring needs organization-level collection and aggregation at appropriate scope. This instead addresses a different case: Governance wants one view of noncompliant encrypted volumes across every AWS Organization account and Region. For the stated situation (A disaster-recovery copy process creates unencrypted EC2 volumes from old snapshots even though the production baseline requires encryption.), the better principle is: Encryption standards should apply to restored volumes and associated snapshot workflows. The deciding distinction is: Encryption standards should apply to restored volumes and associated snapshot workflows.

Managed public certificate renewal depends on sustained validation prerequisites. This instead addresses a different case: A production ALB certificate renewal stalls because the required DNS validation CNAME was deleted. For the stated situation (A disaster-recovery copy process creates unencrypted EC2 volumes from old snapshots even though the production baseline requires encryption.), the better principle is: Encryption standards should apply to restored volumes and associated snapshot workflows. The deciding distinction is: Encryption standards should apply to restored volumes and associated snapshot workflows.

Actual installed package inventory reconciles to approved software baseline. This instead addresses a different case: Operations estimates patch compliance from EC2 tags but has no verified installed software inventory. For the stated situation (A managed EC2 fleet often loses an approved monitoring agent after instance replacement.), the better verification is: A replaced node converges to the approved agent state and compliance is measurable. The deciding distinction is: Configuration state should be continuously enforced on new and existing managed nodes.

A simulated timeout follows the expected recovery or compensation path without skipped stages. This instead addresses a different case: A manual checklist coordinates data migration, validation, and customer notification, but operators skip steps when a Lambda function times out. For the stated situation (A managed EC2 fleet often loses an approved monitoring agent after instance replacement.), the better verification is: A replaced node converges to the approved agent state and compliance is measurable. The deciding distinction is: Configuration state should be continuously enforced on new and existing managed nodes.

A prohibited-Region deployment fails while allowed Regions and mandatory global services work. This instead addresses a different case: A multinational OU has a data residency rule, but new accounts can deploy regulated S3 resources in arbitrary Regions. For the stated situation (A managed EC2 fleet often loses an approved monitoring agent after instance replacement.), the better verification is: A replaced node converges to the approved agent state and compliance is measurable. The deciding distinction is: Configuration state should be continuously enforced on new and existing managed nodes.

Backup retention should resist malicious or accidental deletion for the required period. This instead addresses a different case: A regulated dataset is protected by S3 copies, but the only operator can permanently delete versions during an incident. For the stated situation (Ransomware could delete backups because production administrators have the same permissions on the only backup vault.), the better principle is: Recovery copies should be protected against compromised primary account identities. The deciding distinction is: Recovery copies should be protected against compromised primary account identities.

Autoscaling depends on valid observable metrics and resource limits as well as policy objects. This instead addresses a different case: A Kubernetes horizontal pod autoscaler is configured but never scales pods because its custom metric adapter is missing. For the stated situation (Ransomware could delete backups because production administrators have the same permissions on the only backup vault.), the better principle is: Recovery copies should be protected against compromised primary account identities. The deciding distinction is: Recovery copies should be protected against compromised primary account identities.

Pilot-light recovery must pre-plan network, service quota and scale-up capacity. This instead addresses a different case: A pilot-light disaster recovery setup replicates data but recovery scripts try to restore full production capacity into an undersized subnet with insufficient IPs. For the stated situation (Ransomware could delete backups because production administrators have the same permissions on the only backup vault.), the better principle is: Recovery copies should be protected against compromised primary account identities. The deciding distinction is: Recovery copies should be protected against compromised primary account identities.

Assume creating a metric filter automatically forwards every raw event to OpenSearch. This instead addresses a different case: CloudWatch Logs receives application errors but the incident analytics system never sees them because the log stream is not forwarded. For the stated situation (An enterprise needs near-real-time CloudWatch metric delivery to a central external analytics platform but polling every account exceeds API limits.), the better unsafe assumption to reject is: Create per-second ListMetrics polling loops in every member account as the only collection method. The deciding distinction is: Metric streams support managed delivery of selected CloudWatch metrics to supported downstream paths.

Generate unrelated random request IDs at every hop and expect automatic correlation. This instead addresses a different case: API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops. For the stated situation (An enterprise needs near-real-time CloudWatch metric delivery to a central external analytics platform but polling every account exceeds API limits.), the better unsafe assumption to reject is: Create per-second ListMetrics polling loops in every member account as the only collection method. The deciding distinction is: Metric streams support managed delivery of selected CloudWatch metrics to supported downstream paths.

Monitor only table size in bytes to determine DynamoDB request capacity health. This instead addresses a different case: A provisioned DynamoDB table experiences frequent throttling without any configured application alarm. For the stated situation (An enterprise needs near-real-time CloudWatch metric delivery to a central external analytics platform but polling every account exceeds API limits.), the better unsafe assumption to reject is: Create per-second ListMetrics polling loops in every member account as the only collection method. The deciding distinction is: Metric streams support managed delivery of selected CloudWatch metrics to supported downstream paths.