Pass Amazon AWS Certified DevOps Engineer - Professional DOP-C02 Exam in First Attempt Guaranteed!

Diversify capacity pools or update launch configuration consistent with requirements. This instead addresses a different case: An Auto Scaling group repeatedly fails to launch enough instances in one AZ despite other AZs having capacity. For the stated situation (A GuardDuty finding appears in one account, but the incident team sees it only after manually checking the service console.), the better engineering action is: Route qualifying findings through EventBridge to the authorized incident workflow. The deciding distinction is: Security findings need reliable event routing with context and severity-based action.

Configure an appropriate SQS DLQ with alerting and governed redrive procedure. This instead addresses a different case: A broken message repeatedly fails an event-driven worker and blocks useful progress while on-call has no way to inspect it. For the stated situation (A GuardDuty finding appears in one account, but the incident team sees it only after manually checking the service console.), the better engineering action is: Route qualifying findings through EventBridge to the authorized incident workflow. The deciding distinction is: Security findings need reliable event routing with context and severity-based action.

Introduce versioned event contracts, compatibility checks and error routing. This instead addresses a different case: A producer changes the event payload field name and consumers silently ignore new events while their SQS queues fill. For the stated situation (A GuardDuty finding appears in one account, but the incident team sees it only after manually checking the service console.), the better engineering action is: Route qualifying findings through EventBridge to the authorized incident workflow. The deciding distinction is: Security findings need reliable event routing with context and severity-based action.

Use reserved concurrency or queue buffering and controlled backpressure. This instead addresses a different case: A public API invokes Lambda and saturates an external payment service when automatic concurrency grows after a marketing event. For the stated situation (A pilot-light disaster recovery setup replicates data but recovery scripts try to restore full production capacity into an undersized subnet with insufficient IPs.), the better engineering action is: Pre-provision foundational networking and validate recoverable capacity expansion. The deciding distinction is: Pilot-light recovery must pre-plan network, service quota and scale-up capacity.

Introduce bounded exponential backoff, jitter, throttling and staged traffic restoration. This instead addresses a different case: During a regional outage, aggressive retry loops cause all recovered services to overload the backup database within minutes. For the stated situation (A pilot-light disaster recovery setup replicates data but recovery scripts try to restore full production capacity into an undersized subnet with insufficient IPs.), the better engineering action is: Pre-provision foundational networking and validate recoverable capacity expansion. The deciding distinction is: Pilot-light recovery must pre-plan network, service quota and scale-up capacity.

Define least-privilege emergency DNS roles and practice failover under expected conditions. This instead addresses a different case: The secondary service is healthy, but a disaster exercise reveals operators cannot change DNS because the failover role lacks permission. For the stated situation (A pilot-light disaster recovery setup replicates data but recovery scripts try to restore full production capacity into an undersized subnet with insufficient IPs.), the better engineering action is: Pre-provision foundational networking and validate recoverable capacity expansion. The deciding distinction is: Pilot-light recovery must pre-plan network, service quota and scale-up capacity.

Enable protected collection and query access covering required identity events. This instead addresses a different case: An incident responder needs to investigate unusual role assumptions across accounts over months, but only recent management events are readily accessible. For the stated situation (An enterprise stores thousands of S3 objects across accounts and needs to discover unclassified personal records at scale.), the better engineering action is: Enable suitable Macie discovery with centralized review of detected sensitive data. The deciding distinction is: Sensitive-data discovery should be automated and authorized across relevant storage scopes.

Apply approved S3 Object Lock retention where required with tested access governance. This instead addresses a different case: An organization must retain regulatory audit evidence for seven years, but administrators can remove every copy using ordinary DeleteObject. For the stated situation (An enterprise stores thousands of S3 objects across accounts and needs to discover unclassified personal records at scale.), the better engineering action is: Enable suitable Macie discovery with centralized review of detected sensitive data. The deciding distinction is: Sensitive-data discovery should be automated and authorized across relevant storage scopes.

Fix the infrastructure module and enable appropriate Block Public Access plus monitoring. This instead addresses a different case: New project buckets frequently become publicly readable because an IaC module omits S3 Block Public Access. For the stated situation (An enterprise stores thousands of S3 objects across accounts and needs to discover unclassified personal records at scale.), the better engineering action is: Enable suitable Macie discovery with centralized review of detected sensitive data. The deciding distinction is: Sensitive-data discovery should be automated and authorized across relevant storage scopes.

Inspect tracing activation, propagation headers, service map and correlated request IDs. This is suitable for another situation: API Gateway, Lambda and downstream services emit logs, but operators cannot correlate one slow customer request across service hops. In this case, engineers instead need the paired investigation (Inspect load balancer access log settings, S3 policy, Region and delivery status.) and design change (Set approved bucket access and logging settings without broad public permissions.). These two steps address: An ALB intermittently rejects requests, but access logs are absent because the configured S3 bucket policy denies delivery.

Configure a supported CloudWatch Logs subscription to the approved analytics pipeline. This is suitable for another situation: CloudWatch Logs receives application errors but the incident analytics system never sees them because the log stream is not forwarded. In this case, engineers instead need the paired investigation (Inspect load balancer access log settings, S3 policy, Region and delivery status.) and design change (Set approved bucket access and logging settings without broad public permissions.). These two steps address: An ALB intermittently rejects requests, but access logs are absent because the configured S3 bucket policy denies delivery.

Review demand cycle, instance warmup, scaling latency and seasonal variability. This is suitable for another situation: A predictable daily traffic peak starts before the reactive Auto Scaling policy can launch sufficient EC2 instances. In this case, engineers instead need the paired investigation (Inspect load balancer access log settings, S3 policy, Region and delivery status.) and design change (Set approved bucket access and logging settings without broad public permissions.). These two steps address: An ALB intermittently rejects requests, but access logs are absent because the configured S3 bucket policy denies delivery.

Review agreed RPO, schedule, database logs and recovered data age. This instead addresses a different case: A finance team requires five minutes of maximum data loss, but its AWS Backup job runs only once daily. For the stated situation (A worker fleet uses CPU utilization to scale even though pending SQS message backlog increases rapidly while CPU remains low.), the better investigation is: Measure backlog per worker, task duration, queue age and scaling policies. The deciding distinction is: Scaling should reflect actual workload demand and processing time, not unrelated utilization alone.

Inspect partition key distribution, throttled requests and access patterns. This instead addresses a different case: A DynamoDB table has substantial unused provisioned capacity but requests to one partition key still throttle under burst load. For the stated situation (A worker fleet uses CPU utilization to scale even though pending SQS message backlog increases rapidly while CPU remains low.), the better investigation is: Measure backlog per worker, task duration, queue age and scaling policies. The deciding distinction is: Scaling should reflect actual workload demand and processing time, not unrelated utilization alone.

Review processing time distribution, visibility settings and duplicate business actions. This instead addresses a different case: Message consumers regularly process tasks longer than the SQS visibility timeout, causing duplicate deliveries while the first worker is active. For the stated situation (A worker fleet uses CPU utilization to scale even though pending SQS message backlog increases rapidly while CPU remains low.), the better investigation is: Measure backlog per worker, task duration, queue age and scaling policies. The deciding distinction is: Scaling should reflect actual workload demand and processing time, not unrelated utilization alone.

Build a versioned immutable artifact once, then promote that artifact through approvals and environments. This is suitable for another situation: Each environment rebuilds an application from its Git branch, making production binaries differ from staging even when the commit matches. In this case, engineers instead need the paired investigation (Review ECR tag mutability, digests, image lifecycle policies and build attestations.) and design change (Enable appropriate image tag immutability or deploy by digest with controlled image retention.). These two steps address: A container image tag is overwritten weekly, so audit teams cannot reproduce the exact build used for an earlier release.

Remove token-printing commands and use scoped secret injection with safe diagnostics. This is suitable for another situation: A diagnostic CodeBuild command prints an authentication token to CloudWatch Logs before fetching a private package. In this case, engineers instead need the paired investigation (Review ECR tag mutability, digests, image lifecycle policies and build attestations.) and design change (Enable appropriate image tag immutability or deploy by digest with controlled image retention.). These two steps address: A container image tag is overwritten weekly, so audit teams cannot reproduce the exact build used for an earlier release.

Review AMI build recipe, update schedule, patch evidence and launch template versions. This is suitable for another situation: Production EC2 Auto Scaling launches instances from an AMI built manually months earlier with inconsistent patch levels. In this case, engineers instead need the paired investigation (Review ECR tag mutability, digests, image lifecycle policies and build attestations.) and design change (Enable appropriate image tag immutability or deploy by digest with controlled image retention.). These two steps address: A container image tag is overwritten weekly, so audit teams cannot reproduce the exact build used for an earlier release.

Scaling should reflect actual workload demand and processing time, not unrelated utilization alone. This instead addresses a different case: A worker fleet uses CPU utilization to scale even though pending SQS message backlog increases rapidly while CPU remains low. For the stated situation (A production ALB forwards traffic only to instances in one Availability Zone even though the application requires tolerance of an AZ outage.), the better principle is: Multi-AZ service design needs healthy targets and sufficient capacity in independent zones. The deciding distinction is: Multi-AZ service design needs healthy targets and sufficient capacity in independent zones.

Managed Multi-AZ database deployment provides synchronous standby and automatic infrastructure failover where supported. This instead addresses a different case: A critical RDS database runs on one instance and must recover automatically from underlying infrastructure failure without manual restoration. For the stated situation (A production ALB forwards traffic only to instances in one Availability Zone even though the application requires tolerance of an AZ outage.), the better principle is: Multi-AZ service design needs healthy targets and sufficient capacity in independent zones. The deciding distinction is: Multi-AZ service design needs healthy targets and sufficient capacity in independent zones.

Highly available applications should avoid unreplicated session state tied to an individual node. This instead addresses a different case: Two application instances run in distinct AZs but all sessions are stored on one instance and users lose carts during target failures. For the stated situation (A production ALB forwards traffic only to instances in one Availability Zone even though the application requires tolerance of an AZ outage.), the better principle is: Multi-AZ service design needs healthy targets and sufficient capacity in independent zones. The deciding distinction is: Multi-AZ service design needs healthy targets and sufficient capacity in independent zones.

Trace spans can isolate latency contributions across distributed calls. This instead addresses a different case: An application has slow checkout requests only when external credit checks are called, but aggregate ALB metrics cannot locate the dependency. For the stated situation (A regional AWS Health event indicates maintenance of a service used by five accounts, but no on-call team receives it.), the better principle is: Operational events need managed cross-account routing and accountable notification paths. The deciding distinction is: Operational events need managed cross-account routing and accountable notification paths.

Queue monitoring must track oldest message age and dead-letter handling, not count alone. This instead addresses a different case: A queue's depth remains modest but its oldest message waits 40 minutes because one poison message repeatedly fails processing. For the stated situation (A regional AWS Health event indicates maintenance of a service used by five accounts, but no on-call team receives it.), the better principle is: Operational events need managed cross-account routing and accountable notification paths. The deciding distinction is: Operational events need managed cross-account routing and accountable notification paths.

Supported EC2 recovery alarms can automate appropriate recovery responses to infrastructure issues. This instead addresses a different case: A critical single EC2 instance occasionally fails hardware health checks, but operators discover the outage only when customers complain. For the stated situation (A regional AWS Health event indicates maintenance of a service used by five accounts, but no on-call team receives it.), the better principle is: Operational events need managed cross-account routing and accountable notification paths. The deciding distinction is: Operational events need managed cross-account routing and accountable notification paths.

Use an Allow statement in an SCP as the sole authorization for a principal. This instead addresses a different case: A team attaches an AWS Organizations SCP allowing S3 access and assumes member-account workloads now have permission to list all buckets. For the stated situation (A central platform team needs to roll out an approved Config rule to newly joined accounts across multiple Regions without manual role creation each time.), the better unsafe assumption to reject is: Distribute administrator credentials to every member account and launch manual stacks. The deciding distinction is: Managed multi-account deployment benefits from governed CloudFormation StackSets administration.

Assume YAML syntax validation proves a stateful resource update is nondestructive. This instead addresses a different case: A template refactor changes an S3 bucket logical ID, risking replacement of a bucket containing business records. For the stated situation (A central platform team needs to roll out an approved Config rule to newly joined accounts across multiple Regions without manual role creation each time.), the better unsafe assumption to reject is: Distribute administrator credentials to every member account and launch manual stacks. The deciding distinction is: Managed multi-account deployment benefits from governed CloudFormation StackSets administration.

Treat the template file as proof that runtime resources cannot drift. This instead addresses a different case: A CloudFormation-managed security group was changed directly in the console, and the next stack update behaves differently from the approved template. For the stated situation (A central platform team needs to roll out an approved Config rule to newly joined accounts across multiple Regions without manual role creation each time.), the better unsafe assumption to reject is: Distribute administrator credentials to every member account and launch manual stacks. The deciding distinction is: Managed multi-account deployment benefits from governed CloudFormation StackSets administration.

Sensitive-data discovery should be automated and authorized across relevant storage scopes. This instead addresses a different case: An enterprise stores thousands of S3 objects across accounts and needs to discover unclassified personal records at scale. For the stated situation (A service needs stateful application access, but network engineers rely on one stateless NACL inbound allow rule and response traffic is blocked.), the better principle is: NACLs are stateless and require explicit return-path allowances; security groups are stateful. The deciding distinction is: NACLs are stateless and require explicit return-path allowances; security groups are stateful.

Private TLS key material should be protected and excluded from build artifacts. This instead addresses a different case: A custom TLS termination service stores its private key in an unencrypted public container image layer. For the stated situation (A service needs stateful application access, but network engineers rely on one stateless NACL inbound allow rule and response traffic is blocked.), the better principle is: NACLs are stateless and require explicit return-path allowances; security groups are stateful. The deciding distinction is: NACLs are stateless and require explicit return-path allowances; security groups are stateful.

Temporary credential lifetime and retrieval must match execution and approval workflow timing. This instead addresses a different case: A pipeline uses STS credentials to deploy a stack, but those credentials expire during a long manual approval pause and the deployment later fails. For the stated situation (A service needs stateful application access, but network engineers rely on one stateless NACL inbound allow rule and response traffic is blocked.), the better principle is: NACLs are stateless and require explicit return-path allowances; security groups are stateful. The deciding distinction is: NACLs are stateless and require explicit return-path allowances; security groups are stateful.

Build a verified image and roll the Auto Scaling group with instance refresh or a controlled deployment. This instead addresses a different case: An operations team changes configuration in running EC2 instances manually, and Auto Scaling replacement instances lose those changes. For the stated situation (Developers merge feature branches into main before CodeBuild checks run, allowing a failing package into the release source.), the better engineering action is: Trigger CodeBuild tests on pull requests and make their status mandatory for merge. The deciding distinction is: Continuous integration should gate protected branches on automated test results before merge.

Run a controlled performance stage with agreed throughput and latency gates. This instead addresses a different case: A service passes one-user functional tests yet violates its 99th percentile latency target at peak checkout demand. For the stated situation (Developers merge feature branches into main before CodeBuild checks run, allowing a failing package into the release source.), the better engineering action is: Trigger CodeBuild tests on pull requests and make their status mandatory for merge. The deciding distinction is: Continuous integration should gate protected branches on automated test results before merge.

Run integration tests in a segregated account with constrained resource access. This instead addresses a different case: Integration tests frequently overwrite production queues because staging jobs use a copied production endpoint variable. For the stated situation (Developers merge feature branches into main before CodeBuild checks run, allowing a failing package into the release source.), the better engineering action is: Trigger CodeBuild tests on pull requests and make their status mandatory for merge. The deciding distinction is: Continuous integration should gate protected branches on automated test results before merge.