AWS DOP-C02 Practice Exam — Simulado AWS Certified DevOps Engineer Professional

Explanation: "Note that the metric filter is different from a log insights query, where the experience is interactive and provides immediate search results for the user to investigate. No automatic action can be invoked from an insights query. Metric filters, on the other hand, will generate metric data in the form of a time series. This lets you create alarms that integrate into your ITSM processes, execute AWS Lambda functions, or even create anomaly detection models." https://aws.amazon.com/blogs/mt/quantify-custom-application-metrics- with-amazon-cloudwatch- logs-and-metric-filters/

Explanation: This solution will meet the requirements because it will use CloudFormation nested stacks and stack sets to deploy the templates more efficiently and consistently across multiple regions. Nested stacks allow the company to separate out common components and reuse templates, while stack sets allow the company to create stacks in multiple accounts and regions with a single template. The company can also use Amazon SNS to send notifications to the data engineering team whenever a change is made to the templates or the stacks. Amazon SNS is a service that allows you to publish messages to subscribers, such as email addresses, phone numbers, or other AWS services. By using Amazon SNS, the company can ensure that the data engineering team is aware of all changes to the templates and can take appropriate actions if needed. What is Amazon SNS? - Amazon Simple Notification Service

Explanation: The engineer should make the following changes to achieve a policy of least permission: A: Add a condition to ensure that the principal making the request is an AWS Lambda function. This ensures that only Lambda functions can execute this policy. B: Narrow down the resources by specifying the ARN of EC2 instances instead of allowing all resources. This ensures that the policy only affects EC2 instances. D: Add a condition to ensure that this policy only applies to EC2 instances tagged with "Environment: NonProduction". This ensures that production environments are not affected by this policy. : AWS Identity and Access Management (IAM) - AWS Documentation Certified DevOps Engineer - Professional (DOP-C02) Study Guide (page 179)

Explanation: Amazon Redshift supports audit logging which can be configured to log user activity, including queries and user changes. The logs can be delivered to an S3 bucket (Option B), which is the standard location for Redshift audit logs. While Redshift can send some logs to CloudWatch, the native audit logging is typically routed to S3. Creating a CloudWatch dashboard with a log widget (Option D) allows visualization of user activities from logs ingested into CloudWatch Logs or through custom processing. Option A is invalid because CloudTrail does not capture Redshift query logs directly. Option C incorrectly assumes Redshift audit logs can be delivered directly to CloudWatch. Option E adds complexity by requiring Lambda and Athena unnecessarily when direct visualization in CloudWatch is simpler. References: Amazon Redshift Audit Logging Visualizing Logs with Amazon CloudWatch Dashboards

Explanation: The core problem described is deployment inconsistency and lack of reliability caused by using AWS Systems Manager Run Command for application deployment. Run Command executes ad hoc commands and does not provide deployment orchestration, version tracking, lifecycle hooks, or health-based traffic control, which commonly leads to drift between EC2 instances. The most reliable AWS-native solution is to adopt AWS CodePipeline combined with AWS CodeDeploy. Option B introduces a structured CI/CD pipeline with a clear build stage followed by a test stage, ensuring that only tested artifacts progress to deployment. Sequential build and test stages are preferred for reliability and deterministic behavior, especially when test results must gate deployments. Option C is essential because AWS CodeDeploy is the service specifically designed to deploy application revisions consistently across EC2 fleets. By creating a CodeDeploy application and deployment group and integrating it with the ALB, deployments gain support for lifecycle events, health checks, instance synchronization, and automatic rollback. This ensures that all EC2 instances receive the same application version and that traffic is managed safely during deployments. Option A introduces unnecessary parallelism that does not address the core issue. Option D adds excessive complexity with Lambda orchestration. Option E incorrectly replaces CodeArtifact with S3 without addressing deployment reliability. Therefore, combining CodePipeline (B) with CodeDeploy and ALB integration (C) provides consistent, repeatable, and reliable deployments aligned with AWS best practices.

Explanation: The following are the steps that the DevOps engineer should take to reduce the latency of the Lambda function at all times of the day: Configure provisioned concurrency on the Lambda function. Configure AWS Application Auto Scaling on the Lambda function with provisioned concurrency values set to a minimum of 1 and a maximum of 100. The provisioned concurrency setting ensures that there is always a minimum number of Lambda function instances available to handle requests. The Application Auto Scaling setting will automatically scale the number of Lambda function instances up or down based on the demand for the application. This solution will ensure that the Lambda function is able to handle the increased load during the middle of the day, while also keeping the cold-start latency low. The following are the reasons why the other options are not correct: Option A is incorrect because it will not reduce the cold-start latency of the Lambda function. Option B is incorrect because it will not scale the number of Lambda function instances up or down based on demand. Option D is incorrect because it will only configure reserved concurrency on the API Gateway API, which will not affect the Lambda function.

Explanation: https://docs.aws.amazon.com/codedeploy/latest/userguide/troubleshooting- deployments.html#troubleshooting-skipped-lifecycle-events

Explanation: https://aws.amazon.com/about-aws/whats-new/2016/09/aws-codedeploy-introduces-deployment- monitoring-with-amazon-cloudwatch-alarms-and-automatic-deployment-rollback/

Explanation: To aggregate events from multiple accounts into a single account, the default event bus in the receiving (DevOps) account must have a resource-based policy allowing the source accounts to put events into it. Then, an EventBridge rule in each source account routes Amazon Connect events to the default event bus in the DevOps account (cross-account event delivery). Options A and B describe policies or rules incorrectly applying permissions or routing. Option D mentions replay permissions, which are unrelated to event routing. References: EventBridge Cross-Account Event Delivery Resource-Based Policies for Event Buses

Explanation: The company's primary goals are to produce daily builds, publish artifacts to an Amazon S3hosted website, and do so with the least operational overhead. Because the source repository is public and builds are produced on a fixed daily schedule, there is no requirement for complex multi-stage orchestration or manual pipeline invocations. Option B provides the most streamlined and AWS-recommended solution. By using AWS CodeBuild directly with the public repository as the source, the company eliminates the need to manage an AWS CodePipeline altogether. CodeBuild can natively compile the project and publish build artifacts directly to an Amazon S3 bucket through its artifacts configuration. This minimizes service dependencies and operational complexity. Using an Amazon EventBridge scheduled rule to trigger the CodeBuild project daily ensures builds occur automatically without manual intervention. Enabling artifact encryption is the AWS best practice, even for public artifacts, because encryption at rest does not prevent public read access when bucket policies allow it. Option A relies on webhooks and push-based triggers, which do not meet the "build every day" requirement and introduce unnecessary coupling to repository activity. Options C and D retain CodePipeline, which adds extra configuration and maintenance overhead without providing additional value for this simple build-and- publish workflow. Therefore, Option B meets all requirements with the least operational effort while following AWS- recommended CI/CD design principles.