Free DOP-C02 practice test: 30 questions with answers

CodeDeploy supports Lambda canary and linear traffic shifting between versions through an alias, and it rolls back automatically when a linked CloudWatch alarm fires. A custom script or manual approval does not provide automatic alarm-driven rollback, and Elastic Beanstalk does not manage Lambda aliases this way.

Per-service pipelines triggered by their own source changes keep builds targeted and independent, and a shared template keeps them consistent. A monolithic pipeline rebuilds unchanged services, and a manual CodeBuild project does not provide automated delivery.

CodeDeploy supports blue/green deployments on the ECS compute platform, with traffic shifting and automatic rollback on failure. Rolling updates in Elastic Beanstalk or CloudFormation modify tasks in place, and OpsWorks is not used for ECS.

Promoting a single immutable artifact guarantees that what was tested is what is deployed, and automated tests before the gate catch defects early. Rebuilding per environment and using latest tags break reproducibility, and deploying from laptops bypasses controls.

Cross-account role assumption gives the pipeline temporary credentials scoped to a deployment role, which avoids long-lived secrets. Storing access keys or sharing root credentials creates a security risk that cannot be audited cleanly.

Secrets Manager stores the credential, rotates it on a schedule, and CodeBuild can reference the secret directly so the value is not hard-coded in the project. Plaintext variables and echoing values into logs expose the secret, and a committed encrypted file still stores the credential in source control.

Service control policies set the maximum permissions for accounts in an organization and can deny actions based on the requested Region condition key, regardless of local IAM policies. Permissions boundaries work per principal inside one account, and trust policies control who can assume a role rather than what resources are created.

An instance profile supplies temporary credentials through the instance metadata service, which avoids long-term keys, and a least-privilege policy limits the scope to the named resources. Storing access keys in user data or encrypted config files still creates long-lived secrets that can leak.

Block Public Access at the account level stops public policies and ACLs from taking effect, and Macie identifies buckets that are publicly accessible or hold sensitive data. A public principal with an IP condition still exposes data, disabling encryption weakens protection, and making objects public works against the goal.

An interface endpoint for Secrets Manager gives the function private connectivity to the service without internet egress. An internet gateway or NAT would send traffic outside the VPC toward public endpoints, and an S3 gateway endpoint only serves S3.

UpdateReplacePolicy controls what happens to the old physical resource when an update forces replacement, and DeletionPolicy controls it on stack deletion. Retain or Snapshot keeps the data, whereas Delete destroys it, and stack-level protections do not change per-resource behaviour.

cdk diff compares the synthesized template with the currently deployed stack and reports the planned changes. cdk synth only produces the CloudFormation template, cdk bootstrap prepares the environment, and cdk destroy has no dry-run option.

An SCP with a condition on the request tags for RunInstances is a preventive control that blocks untagged launches across accounts. Config and Lambda remediation are detective and act after the fact, and AMIs do not propagate tags to new instances.

Automated policy checks in the pipeline catch violations before deployment, and required peer review with linting catches errors before merge. Direct console edits and removing change set review bypass controls, and keeping templates only on laptops removes version history.

Fn::ImportValue reads a value that another stack has exported under a shared name in the same Region and account. Fn::GetAtt reads an attribute of a resource in the same template, Fn::Sub performs string substitution, and Fn::Select picks an item from a list.

Target tracking keeps capacity aligned with load so the surviving zones absorb traffic sooner. Reducing the health check grace period to zero causes instability, and disabling cross-zone load balancing can leave some zones overloaded during an outage.

DynamoDB point-in-time recovery maintains continuous backups for 35 days and allows restoring to any second in that window. A daily backup plan cannot restore to an arbitrary second, and exports or instance snapshots do not capture the table state in the same way.

Distributing instances across zones behind a load balancer that routes away from unhealthy targets is the core pattern for zonal resilience. A single instance or single-zone design creates a single point of failure regardless of how large the instance is.

Multi-AZ RDS maintains a synchronous standby in another zone, and S3 stores objects redundantly across zones. Instance store data is lost when an instance fails, and single-zone or sticky single-instance designs remove resilience.

Failover routing returns the primary record while its health check passes and switches to the secondary record when it fails. Latency and geolocation choose by user location, and weighted routing splits traffic rather than failing over.

API Gateway publishes a Latency metric to CloudWatch, and CloudWatch can display percentile statistics such as p99 on that metric directly. A metric filter counts log lines rather than computing percentiles from timings, and CloudTrail records API calls rather than request latency.

A metric filter converts matching log events into a custom metric, and an alarm on that metric gives the threshold and notification without code changes. Subscription filters forward log data rather than alerting, and a daily query is not a near real-time alert.

AWS X-Ray collects traces across distributed services and shows service maps and latency per segment. CloudWatch Synthetics runs canary tests, AWS Config tracks resource configuration, and Macie discovers sensitive data in S3.

Performance Insights breaks database load down by wait events and SQL statements and is available directly in the RDS console. Trusted Advisor, Config conformance packs and Artifact do not show database load.

Memory and disk usage are OS-level metrics that the hypervisor cannot see, so the CloudWatch agent must be installed and configured to publish them. The X-Ray daemon sends traces, the Session Manager plugin opens shells, and Flow Logs record network traffic.

Standby removes an instance from service while keeping it running, so the evidence stays available for investigation. Terminating the instance destroys the evidence, and deleting a launch template version does not affect a running instance.

AWS Config records configuration changes and can evaluate rules that notify through SNS, while CloudTrail records the IAM principal behind each API call. Inspector assesses vulnerabilities, Trusted Advisor checks are periodic, and Flow Logs show traffic rather than who changed the rules.

Alarms and EventBridge rules can start Systems Manager Automation runbooks, which execute remediation steps automatically and keep an execution history. Manual runs and unconditional hourly restarts do not respond to the actual failure, and disabling the alarm removes the signal.

CloudTrail records management API calls such as UpdateFunctionConfiguration with the caller identity and time. Invocation metrics and X-Ray traces describe runtime behaviour, and Compute Optimizer produces sizing recommendations.

CodePipeline publishes stage execution state change events under the aws.codepipeline source, and the FAILED state identifies failures. The other patterns come from unrelated services.