Free Amazon Web Services DOP-C02 Practice Exam with Questions & Answers | Set: 6

A zonal shift in Amazon Application Recovery Controller is the correct mechanism for quickly moving traffic away from an impaired Availability Zone while keeping the application active in healthy zones. AWS states that zonal shift causes the load balancer to stop sending new traffic to the affected Availability Zone. For ALB targets, the shifted-away targets receive an AdministrativeOverride state, and the ALB stops routing new traffic to them while existing connections close normally. Disabling cross-zone load balancing at the target group level supports the static-stability goal because traffic and capacity remain zonally scoped. Option B is manual and slower. Option C leaves cross-zone inheritance in place, which weakens zonal isolation. Option D changes subnet configuration and is operationally riskier than ARC zonal shift.

================

This solution will meet the requirements because it will use CloudFormation nested stacks and stack sets to deploy the templates more efficiently and consistently across multiple regions. Nested stacks allow the company to separate out common components and reuse templates, while stack sets allow the company to create stacks in multiple accounts and regions with a single template. The company can also use Amazon SNS to send notifications to the data engineering team whenever a change is made to the templates or the stacks. Amazon SNS is a service that allows you to publish messages to subscribers, such as email addresses, phone numbers, or other AWS services. By using Amazon SNS, the company can ensure that the data engineering team is aware of all changes to the templates and can take appropriate actions if needed. What is Amazon SNS? - Amazon Simple Notification Service

The company’s primary goals are to produce daily builds , publish artifacts to an Amazon S3–hosted website , and do so with the least operational overhead . Because the source repository is public and builds are produced on a fixed daily schedule, there is no requirement for complex multi-stage orchestration or manual pipeline invocations.

Option B provides the most streamlined and AWS-recommended solution. By using AWS CodeBuild directly with the public repository as the source, the company eliminates the need to manage an AWS CodePipeline altogether. CodeBuild can natively compile the project and publish build artifacts directly to an Amazon S3 bucket through its artifacts configuration. This minimizes service dependencies and operational complexity.

Using an Amazon EventBridge scheduled rule to trigger the CodeBuild project daily ensures builds occur automatically without manual intervention. Enabling artifact encryption is the AWS best practice, even for public artifacts, because encryption at rest does not prevent public read access when bucket policies allow it.

Option A relies on webhooks and push-based triggers, which do not meet the “build every day” requirement and introduce unnecessary coupling to repository activity. Options C and D retain CodePipeline, which adds extra configuration and maintenance overhead without providing additional value for this simple build-and-publish workflow.

Therefore, Option B meets all requirements with the least operational effort while following AWS-recommended CI/CD design principles.

Mutual TLS (mTLS) authentication requires two-way authentication between the client and the server. For Amazon API Gateway, you can enable mTLS for a custom domain name, which requires clients to present X.509 certificates to verify their identity to access your API. To set up mTLS, you would typically use AWS Certificate Manager (ACM) to create a private certificate authority (CA) and provision a client certificate signed by this private CA. The root CA certificate is then uploaded to an Amazon S3 bucket and configured in API Gateway as the trust store12.

Introducing mutual TLS authentication for Amazon API Gateway1.

Configuring mutual TLS authentication for a REST API2.

AWS Private Certificate Authority details3.

AWS Certificate Manager Private Certificate Authority updates4.

Enable AWS Config Across the Organization:

AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. It can be used to assess, audit, and evaluate the configurations of your resources.

Enabling AWS Config across the organization ensures that all accounts are monitored for compliance.

Create a Conformance Pack Using the approved-amis-by-id AWS Config Managed Rule:

A conformance pack is a collection of AWS Config rules and remediation actions that can be easily deployed across an organization.

The approved-amis-by-id managed rule checks whether running instances are using approved AMIs.

Deploy the Conformance Pack Across the Organization:

Deploying the conformance pack across the organization ensures that all accounts adhere to the policy of using only approved AMIs.

The conformance pack can be deployed via the AWS Management Console, CLI, or SDKs.

Configure the Rule to Run the AWS-StopEC2Instance AWS Systems Manager Automation Runbook for Non-Compliant EC2 Instances:

The AWS-StopEC2Instance runbook can be configured to automatically stop any EC2 instances that are found to be non-compliant (i.e., not using approved AMIs).

This remediation action ensures that any unauthorized instances are promptly stopped, enforcing the policy without manual intervention.

By following these steps, the solution ensures that all EC2 instances across the organization use approved AMIs, and any non-compliant instances are remediated automatically.

To analyze and find the number of logins for a specific user from the past 7 days, a CloudWatch Logs Insights query is the most suitable solution. CloudWatch Logs Insights enables you to interactively search and analyze your log data in Amazon CloudWatch Logs. You can use the query language to perform queries that contain multiple commands, including aggregation functions, which can count the occurrences of logins for a specific username over a specified time period. This approach is more direct and efficient than creating a metric filter or subscription, which would require additional steps to publish and sum a metric. References: AWS Certified DevOps Engineer - Professional, CloudWatch Logs Insights query syntax, Tutorial: Run a query with an aggregation function, Add or remove a number widget from a CloudWatch dashboard.

 Modify the Build Stage to Add a Test Action with a RunOrder Value of 2:

The build stage in AWS CodePipeline can have multiple actions. By adding a test action with a runOrder value of 2, the test action will execute after the initial build action completes.

 Use AWS CodeBuild as the Action Provider to Run Unit Tests:

AWS CodeBuild is a fully managed build service that compiles source code, runs tests, and produces software packages.

Using CodeBuild to run unit tests ensures that the tests are executed in a controlled environment and that only the code changes that pass the unit tests proceed to the deploy stage.

Example configuration in CodePipeline:

{

" name " : " BuildStage " ,

" actions " : [

{

" name " : " Build " ,

" actionTypeId " : {

" category " : " Build " ,

" owner " : " AWS " ,

" provider " : " CodeBuild " ,

" version " : " 1 "

},

" runOrder " : 1

},

{

" name " : " Test " ,

" actionTypeId " : {

" category " : " Test " ,

" owner " : " AWS " ,

" provider " : " CodeBuild " ,

" version " : " 1 "

},

" runOrder " : 2

}

]

}

By integrating the unit tests into the build stage and ensuring they run after the build process, the pipeline guarantees that only code changes passing all unit tests are deployed.

The company requires an organization-wide, centralized, and automated solution to detect sensitive data in Amazon S3, aggregate findings in one location, and quarantine affected objects with minimal operational overhead. AWS provides a native service specifically designed for this purpose: Amazon Macie .

Option A is essential because Amazon Macie automatically discovers and classifies sensitive data such as PII in S3 buckets using managed machine learning models. When enabled at the organization level , Macie scans buckets across all accounts and Regions. Integrating Macie with AWS Security Hub centralizes all findings in a single dashboard, allowing the company’s security officer to review and manage sensitive data alerts across the organization without building custom aggregation pipelines.

Detection alone is not sufficient; remediation is also required. Option C completes the solution by using Amazon EventBridge , which natively receives Macie findings in near real time. An EventBridge rule can trigger a Lambda function whenever Macie identifies sensitive data. The Lambda function can then copy the affected object to a quarantine S3 bucket and delete the original object, meeting the remediation requirement automatically and consistently.

Option D requires custom sensitive data detection logic, which is complex, error-prone, and unnecessary given Macie’s capabilities. Option E is invalid because SCPs cannot inspect or move data. Option B does not detect sensitive information.

Therefore, A and C together provide the most efficient, scalable, and AWS-recommended solution.

https://blog.fourninecloud.com/auto-scaling-lifecycle-hooks-to-export-server-logs-when-instance-terminating-58e06d7c0d6a

To meet the requirements, the DevOps engineer should do the following:

Turn on the Multi-AZ option on the Aurora cluster.

Update the application to use the Aurora cluster endpoint for write operations.

Update the Aurora cluster ' s reader endpoint for reads.

Turning on the Multi-AZ option will create a replica of the database in a different Availability Zone. This will ensure that the database remains available even if one of the Availability Zones is unavailable.

Updating the application to use the Aurora cluster endpoint for write operations will ensure that all writes are sent to both the primary and replica databases. This will ensure that the data is always consistent.

Updating the Aurora cluster ' s reader endpoint for reads will allow the application to read data from the replica database. This will improve the performance of the application during the maintenance window.