DOP-C02 sample exam questions

An EventBridge rule on the default event bus matches security group API calls from CloudTrail and invokes the function in near real time. CloudTrail does not subscribe to SNS with filters this way, an hourly schedule is too slow, and AWS service events arrive on the default bus rather than a custom one.

The CloudWatch agent and CloudTrail can both send logs to CloudWatch Logs, and Logs Insights queries them together. CloudWatch does not directly query CloudTrail logs in S3, the agent does not write to Kinesis or S3 directly, and Redshift adds unneeded work.

Amazon GuardDuty detects compromised instances, suspicious network activity and unusual API activity, and a delegated administrator manages member accounts. An EventBridge rule there forwards findings to SNS. Invitations are not needed within an organization, and CloudTrail, flow logs and SCPs do not detect these threats by themselves.

An EC2 IAM role provides temporary AWS credentials with no stored keys, and Secrets Manager stores and rotates database credentials for each environment. Access keys in parameters are long-term secrets, and a password in a config file with the artifacts is harder to secure and change.

CodeDeploy's OneAtATime configuration deploys one instance at a time, and an alarm on CPU utilization can automatically roll back the deployment group. Elastic Beanstalk does not roll back based on an alarm like this, and Step Functions or Systems Manager options need much more custom work.

Using load balancer health checks lets Auto Scaling replace failed instances, and the CloudWatch agent is needed to collect memory data for an alarm and SNS notification. Memory is not a default EC2 metric, a shorter interval does not fix anything, and TCP checks could pass while the application is unhealthy.

A GuardDuty detector fails to create if one already exists, so a custom resource with Lambda can check first and enable it only when needed. Conditions cannot query the account state, Fn::GetAtt reads template resources, and a manual list is not automated.

A private CA suits internal teams and issues client certificates, and API Gateway mutual TLS uses a trust store in S3 containing the root CA certificate. The trust store does not hold client certificates or private keys, and public CAs are not needed.

AWS Control Tower provides preventive and detective controls by OU, enrolls existing accounts, and applies them to new accounts created through it. SCPs alone are only preventive, stack sets and conformance packs alone are mainly detective and require more upkeep.

Developers have access from only some accounts, so check for SCPs and permissions boundaries that block them, then make fixes in CodeCommit and deploy through CloudFormation. Turning off Block Public Access and adding accounts by hand are not relevant, and an AWS Config recorder does not revert changes.

AWS Config evaluates security groups on configuration changes across accounts, and a function can remediate noncompliant rules quickly. The check is the restricted-ssh logic. A periodic trigger is slower, deleting all rules is too broad, and hourly automation leaves a gap.

Console sign-ins are management events, so CloudTrail in CloudWatch Logs with a metric filter and alarm sends messages to SNS with little work. Athena schedules take more effort, and data events do not include ConsoleLogin.

A canary sends 10% of traffic for 5 minutes, which allows monitoring before a full shift. A TargetResponseTime alarm with rollback on the deployment group reacts directly to slower responses. Linear shifting exposes more traffic over time, and the other metrics do not measure response time.

S3 server access logs include authentication failures, such as requests with invalid credentials, which CloudTrail does not record. CloudTrail is needed for many other audit purposes, but it does not capture these rejected calls, and GuardDuty only reports findings.

A StatusCheckFailed_System alarm with the recover action moves the instance to healthy hardware and keeps its EBS volume, including after loss of network connectivity. Auto Scaling replaces instances and can lose data, and NetworkOut in INSUFFICIENT_DATA is not a reliable signal for recovery.