Pass Amazon AWS Certified DevOps Engineer - Professional DOP-C02 Exam in First Attempt Guaranteed!

Provision and test a suitably sized standby baseline with controlled scale-up on failover. This is suitable for another situation: A standby Region has copied AMIs but no provisioned database capacity and cannot accept traffic for hours. In this case, engineers instead need the paired investigation (Review target tracking, ALB request metrics, task CPU/memory and scaling cooldown.) and design change (Configure ECS Service Auto Scaling with appropriate target tracking and bounds.). These two steps address: An ECS Fargate application scales tasks manually and saturates its ALB during promotional traffic spikes.

Implement scalable worker capacity tied to backlog-per-worker or age-based demand signals. This is suitable for another situation: A worker fleet uses CPU utilization to scale even though pending SQS message backlog increases rapidly while CPU remains low. In this case, engineers instead need the paired investigation (Review target tracking, ALB request metrics, task CPU/memory and scaling cooldown.) and design change (Configure ECS Service Auto Scaling with appropriate target tracking and bounds.). These two steps address: An ECS Fargate application scales tasks manually and saturates its ALB during promotional traffic spikes.

Inspect Lambda concurrent executions, throttles, payment API quotas and latency. This is suitable for another situation: A public API invokes Lambda and saturates an external payment service when automatic concurrency grows after a marketing event. In this case, engineers instead need the paired investigation (Review target tracking, ALB request metrics, task CPU/memory and scaling cooldown.) and design change (Configure ECS Service Auto Scaling with appropriate target tracking and bounds.). These two steps address: An ECS Fargate application scales tasks manually and saturates its ALB during promotional traffic spikes.

Synthetic monitoring should exercise user-important paths with appropriate credentials and certificate checks. This instead addresses a different case: An external application returns 200 for its home page even as the login endpoint has expired certificates and cannot authenticate users. For the stated situation (A high-severity payment error alarm stays green when the application stops publishing error metrics during an outage.), the better principle is: Missing metric data needs treatment consistent with the failure mode and alarm semantics. The deciding distinction is: Missing metric data needs treatment consistent with the failure mode and alarm semantics.

Trace spans can isolate latency contributions across distributed calls. This instead addresses a different case: An application has slow checkout requests only when external credit checks are called, but aggregate ALB metrics cannot locate the dependency. For the stated situation (A high-severity payment error alarm stays green when the application stops publishing error metrics during an outage.), the better principle is: Missing metric data needs treatment consistent with the failure mode and alarm semantics. The deciding distinction is: Missing metric data needs treatment consistent with the failure mode and alarm semantics.

CloudTrail management events can attribute configuration changes when logged and retained appropriately. This instead addresses a different case: A production security group unexpectedly allows SSH from the internet, and teams disagree who changed it. For the stated situation (A high-severity payment error alarm stays green when the application stops publishing error metrics during an outage.), the better principle is: Missing metric data needs treatment consistent with the failure mode and alarm semantics. The deciding distinction is: Missing metric data needs treatment consistent with the failure mode and alarm semantics.

A prohibited-Region deployment fails while allowed Regions and mandatory global services work. This instead addresses a different case: A multinational OU has a data residency rule, but new accounts can deploy regulated S3 resources in arbitrary Regions. For the stated situation (A datacenter fleet and EC2 instances need the same audited patch procedure, but offline servers are not in Systems Manager inventory.), the better verification is: A selected on-premises node reports patch status through the central approved console. The deciding distinction is: Hybrid systems can be managed through supported SSM activation and scoped policies where reachable.

A scheduled invocation occurs after the old server is terminated and failures are detectable. This instead addresses a different case: A production housekeeping Lambda is triggered by a local server cron job and silently stops after that server is retired. For the stated situation (A datacenter fleet and EC2 instances need the same audited patch procedure, but offline servers are not in Systems Manager inventory.), the better verification is: A selected on-premises node reports patch status through the central approved console. The deciding distinction is: Hybrid systems can be managed through supported SSM activation and scoped policies where reachable.

Actual installed package inventory reconciles to approved software baseline. This instead addresses a different case: Operations estimates patch compliance from EC2 tags but has no verified installed software inventory. For the stated situation (A datacenter fleet and EC2 instances need the same audited patch procedure, but offline servers are not in Systems Manager inventory.), the better verification is: A selected on-premises node reports patch status through the central approved console. The deciding distinction is: Hybrid systems can be managed through supported SSM activation and scoped policies where reachable.

Parameter naming and permissions must isolate environment configuration. This instead addresses a different case: Multiple environments share unqualified /db/password parameter names and a production application accidentally reads a staging secret. For the stated situation (A template refactor changes an S3 bucket logical ID, risking replacement of a bucket containing business records.), the better principle is: IaC refactors should identify replacement and deletion consequences before execution. The deciding distinction is: IaC refactors should identify replacement and deletion consequences before execution.

Governed configuration changes should trigger timely, scoped detection and remediation. This instead addresses a different case: An application team repeatedly disables approved EBS encryption defaults and security reviews detect the drift weeks later. For the stated situation (A template refactor changes an S3 bucket logical ID, risking replacement of a bucket containing business records.), the better principle is: IaC refactors should identify replacement and deletion consequences before execution. The deciding distinction is: IaC refactors should identify replacement and deletion consequences before execution.

Existing resources should be imported into IaC when supported instead of blindly replaced. This instead addresses a different case: A production queue built manually is now required in a managed CloudFormation stack, but engineers fear recreating it will lose messages. For the stated situation (A template refactor changes an S3 bucket logical ID, risking replacement of a bucket containing business records.), the better principle is: IaC refactors should identify replacement and deletion consequences before execution. The deciding distinction is: IaC refactors should identify replacement and deletion consequences before execution.

Inspect AWS Config rule events, EventBridge filters and automation target permissions. This is suitable for another situation: Security operations wants alerts whenever Config detects that approved encryption settings are disabled on new storage resources. In this case, engineers instead need the paired investigation (Inspect instance type support, status-check metrics and automated action requirements.) and design change (Configure a CloudWatch alarm with supported EC2 recovery action where appropriate.). These two steps address: A critical single EC2 instance occasionally fails hardware health checks, but operators discover the outage only when customers complain.

Create a managed synthetic login journey with secure test identity and operational alarm. This is suitable for another situation: An external application returns 200 for its home page even as the login endpoint has expired certificates and cannot authenticate users. In this case, engineers instead need the paired investigation (Inspect instance type support, status-check metrics and automated action requirements.) and design change (Configure a CloudWatch alarm with supported EC2 recovery action where appropriate.). These two steps address: A critical single EC2 instance occasionally fails hardware health checks, but operators discover the outage only when customers complain.

Enable supported AWS X-Ray tracing or OpenTelemetry tracing and propagate context. This is suitable for another situation: API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops. In this case, engineers instead need the paired investigation (Inspect instance type support, status-check metrics and automated action requirements.) and design change (Configure a CloudWatch alarm with supported EC2 recovery action where appropriate.). These two steps address: A critical single EC2 instance occasionally fails hardware health checks, but operators discover the outage only when customers complain.

Use EventBridge Scheduler or approved managed scheduling with alerting and retry policy. This instead addresses a different case: A production housekeeping Lambda is triggered by a local server cron job and silently stops after that server is retired. For the stated situation (A fleet must receive OS security patches only during approved windows, with controlled reboots and exception reporting.), the better engineering action is: Schedule compliant patching through approved maintenance windows and targeted baselines. The deciding distinction is: Patch automation should account for maintenance schedules, baselines and operational safety.

Use IAM Identity Center groups and governed permission sets for cross-account staff access. This instead addresses a different case: An enterprise manually creates duplicate IAM users in dozens of accounts for employees, creating slow offboarding. For the stated situation (A fleet must receive OS security patches only during approved windows, with controlled reboots and exception reporting.), the better engineering action is: Schedule compliant patching through approved maintenance windows and targeted baselines. The deciding distinction is: Patch automation should account for maintenance schedules, baselines and operational safety.

Create a Systems Manager State Manager association installing and checking the required agent. This instead addresses a different case: A managed EC2 fleet often loses an approved monitoring agent after instance replacement. For the stated situation (A fleet must receive OS security patches only during approved windows, with controlled reboots and exception reporting.), the better engineering action is: Schedule compliant patching through approved maintenance windows and targeted baselines. The deciding distinction is: Patch automation should account for maintenance schedules, baselines and operational safety.

Schedule compliant patching through approved maintenance windows and targeted baselines. This is suitable for another situation: A fleet must receive OS security patches only during approved windows, with controlled reboots and exception reporting. In this case, engineers instead need the paired investigation (Review agent connectivity, hybrid activation, licensing requirements and node enrollment.) and design change (Register supported hybrid nodes in Systems Manager and assign compliant patch baselines.). These two steps address: A datacenter fleet and EC2 instances need the same audited patch procedure, but offline servers are not in Systems Manager inventory.

Split work into durable Step Functions state transitions or supported managed operations. This is suitable for another situation: A Lambda invoked for a multi-hour infrastructure migration times out before tasks finish and loses progress. In this case, engineers instead need the paired investigation (Review agent connectivity, hybrid activation, licensing requirements and node enrollment.) and design change (Register supported hybrid nodes in Systems Manager and assign compliant patch baselines.). These two steps address: A datacenter fleet and EC2 instances need the same audited patch procedure, but offline servers are not in Systems Manager inventory.

Use scoped paths or separate accounts with least-privilege parameter read access. This is suitable for another situation: Multiple environments share unqualified /db/password parameter names and a production application accidentally reads a staging secret. In this case, engineers instead need the paired investigation (Review agent connectivity, hybrid activation, licensing requirements and node enrollment.) and design change (Register supported hybrid nodes in Systems Manager and assign compliant patch baselines.). These two steps address: A datacenter fleet and EC2 instances need the same audited patch procedure, but offline servers are not in Systems Manager inventory.

A planned replica or writer failover routes clients to healthy supported instances. This instead addresses a different case: An Aurora cluster has replicas in different AZs but applications use fixed instance endpoints and never fail over to another reader. For the stated situation (A multi-Region shopping app writes the same item in two Regions and occasionally overwrites updates unexpectedly.), the better verification is: Concurrent writes are reconciled according to documented business semantics. The deciding distinction is: Active-active replicated data needs explicit conflict resolution and application reconciliation semantics.

A drill restores an entire order and payment flow without missing or duplicated settlement. This instead addresses a different case: A multi-service order platform restores database and queue snapshots from mismatched times, creating duplicate settlement records. For the stated situation (A multi-Region shopping app writes the same item in two Regions and occasionally overwrites updates unexpectedly.), the better verification is: Concurrent writes are reconciled according to documented business semantics. The deciding distinction is: Active-active replicated data needs explicit conflict resolution and application reconciliation semantics.

A controlled failover keeps recovery within the agreed service interruption objective. This instead addresses a different case: A critical RDS database runs on one instance and must recover automatically from underlying infrastructure failure without manual restoration. For the stated situation (A multi-Region shopping app writes the same item in two Regions and occasionally overwrites updates unexpectedly.), the better verification is: Concurrent writes are reconciled according to documented business semantics. The deciding distinction is: Active-active replicated data needs explicit conflict resolution and application reconciliation semantics.

Set appropriate rolling update bounds, readiness probes and availability policies. This instead addresses a different case: An EKS rolling deployment scales down all API pods at once, causing requests to fail despite multiple nodes. For the stated situation (An ECS fleet includes both x86_64 and Arm64 capacity, but a pipeline publishes only an x86 image under a generic tag.), the better engineering action is: Publish verified architecture-specific images or a multi-architecture manifest as appropriate. The deciding distinction is: Build artifacts must match the target compute architecture and runtime requirements.

Enforce least-privilege S3 access and approved server-side encryption on release artifacts. This instead addresses a different case: Deployment artifacts containing sensitive configuration are stored in an S3 bucket with broad read access and no enforced encryption policy. For the stated situation (An ECS fleet includes both x86_64 and Arm64 capacity, but a pipeline publishes only an x86 image under a generic tag.), the better engineering action is: Publish verified architecture-specific images or a multi-architecture manifest as appropriate. The deciding distinction is: Build artifacts must match the target compute architecture and runtime requirements.

Remove token-printing commands and use scoped secret injection with safe diagnostics. This instead addresses a different case: A diagnostic CodeBuild command prints an authentication token to CloudWatch Logs before fetching a private package. For the stated situation (An ECS fleet includes both x86_64 and Arm64 capacity, but a pipeline publishes only an x86 image under a generic tag.), the better engineering action is: Publish verified architecture-specific images or a multi-architecture manifest as appropriate. The deciding distinction is: Build artifacts must match the target compute architecture and runtime requirements.

Inspect published event schemas, consumer parsers, DLQ counts and producer revisions. This is suitable for another situation: A producer changes the event payload field name and consumers silently ignore new events while their SQS queues fill. In this case, engineers instead need the paired investigation (Review delivery guarantees, subscriptions, DLQs and consumer coupling.) and design change (Publish to a suitable topic and distribute through separate durable SQS queues.). These two steps address: One order-created event needs to inform billing, fulfillment and analytics independently, but a direct Lambda chain loses downstream events when one service is unavailable.

Route qualifying findings through EventBridge to the authorized incident workflow. This is suitable for another situation: A GuardDuty finding appears in one account, but the incident team sees it only after manually checking the service console. In this case, engineers instead need the paired investigation (Review delivery guarantees, subscriptions, DLQs and consumer coupling.) and design change (Publish to a suitable topic and distribute through separate durable SQS queues.). These two steps address: One order-created event needs to inform billing, fulfillment and analytics independently, but a direct Lambda chain loses downstream events when one service is unavailable.

Use conditional automation and human approval for high-risk stateful remediation. This is suitable for another situation: A production alarm starts an infrastructure rebuild immediately even during a payroll settlement window where failover can corrupt in-flight transactions. In this case, engineers instead need the paired investigation (Review delivery guarantees, subscriptions, DLQs and consumer coupling.) and design change (Publish to a suitable topic and distribute through separate durable SQS queues.). These two steps address: One order-created event needs to inform billing, fulfillment and analytics independently, but a direct Lambda chain loses downstream events when one service is unavailable.

Deploy to a bounded canary or targeted cohort and expand only after validated signals. This is suitable for another situation: A new payment option passes staging but causes failures only for a small set of customer geographies. In this case, engineers instead need the paired investigation (Review repository protection rules, pull-request triggers and build pass requirements.) and design change (Trigger CodeBuild tests on pull requests and make their status mandatory for merge.). These two steps address: Developers merge feature branches into main before CodeBuild checks run, allowing a failing package into the release source.

Review generated CloudFormation change sets, deletion or replacement actions and approval policy. This is suitable for another situation: A pipeline applies a template change that silently replaces a stateful database resource during a minor refactor. In this case, engineers instead need the paired investigation (Review repository protection rules, pull-request triggers and build pass requirements.) and design change (Trigger CodeBuild tests on pull requests and make their status mandatory for merge.). These two steps address: Developers merge feature branches into main before CodeBuild checks run, allowing a failing package into the release source.

Publish verified architecture-specific images or a multi-architecture manifest as appropriate. This is suitable for another situation: An ECS fleet includes both x86_64 and Arm64 capacity, but a pipeline publishes only an x86 image under a generic tag. In this case, engineers instead need the paired investigation (Review repository protection rules, pull-request triggers and build pass requirements.) and design change (Trigger CodeBuild tests on pull requests and make their status mandatory for merge.). These two steps address: Developers merge feature branches into main before CodeBuild checks run, allowing a failing package into the release source.