AWS Certified DevOps Engineer - Professional (DOP-C02) Practice Exam

A company uses AWS CodeDeploy to deploy a Lambda function through a production alias with a canary configuration that shifts 10% of traffic for 10 minutes before shifting the remaining traffic. The deployment group monitors a CloudWatch alarm and has automatic rollback enabled when the alarm enters ALARM. The alarm calculates 100 × SUM(Errors) / SUM(Invocations) for the production alias and uses a 5% threshold. During a deployment, the candidate version consistently fails 30% of its invocations, but the previous version has no errors. The alarm reports approximately 3%, remains OK, and allows the deployment to continue. Traffic volume is high enough to provide representative measurements for both versions every minute. A DevOps engineer must make the deployment stop and roll back when the candidate version's error rate exceeds 5%, without changing the traffic-shifting schedule or treating a candidate error rate below 5% as a failure. Which solution meets these requirements?

A company must automate configuration updates for 50,000 independent application environments. An Amazon S3 object contains a 40-MB JSON array that identifies the environments. For each environment, the automation must initiate an infrastructure update, wait for completion, and validate the configuration. Each environment's workflow takes 10–20 minutes and produces at least 2 KB of diagnostic output. The solution must support 100 concurrently running environment workflows while enforcing that concurrency limit. It must retain diagnostic output in S3 and continue processing if no more than 1% of the environment workflows fail. The DevOps engineer wants to minimize custom orchestration code. Which solution meets these requirements?

A company runs a stateless HTTPS service on EC2 instances in two Availability Zones behind one Application Load Balancer (ALB). A listener rule uses a weighted forward action to send 50% of requests to each of two target groups. Each target group contains only the instances in one Availability Zone. Cross-zone load balancing is enabled, and target group stickiness is disabled. During a resilience test, all application processes in one Availability Zone fail. The ALB marks every target in that zone's target group unhealthy, but some new requests continue to fail. The other target group remains healthy and has sufficient capacity to serve the entire workload. The company requires new requests to use the remaining healthy targets after health checks detect this type of failure in either zone. During normal operation, both zones must serve traffic. The solution must retain the existing ALB and DNS configuration and must not require incident-time configuration changes or custom failover automation. Which change meets these requirements?

A company must notify its security team whenever an assumed-role session successfully calls StopLogging or DeleteTrail in an AWS account, except when the session belongs to the approved TrailMaintenance role. Failed API calls must not generate notifications. All relevant calls use assumed-role credentials, and failed calls include an errorCode field in their CloudTrail events. A trail is already logging all write management events. An Amazon SNS topic has confirmed email subscriptions and a resource policy that permits EventBridge to publish notifications. The approved role ARN is arn:aws:iam::123456789012:role/TrailMaintenance. A DevOps engineer will create an EventBridge rule on the default event bus and configure the SNS topic as its target. Which event pattern meets the requirements?

A company runs an Amazon ECS service on EC2 instances supplied by an Auto Scaling group capacity provider. Managed scaling is enabled with a target capacity of 100%. The service uses only this capacity provider. The Auto Scaling group has a desired capacity of 4 and a maximum capacity of 20. Its mixed instances policy allows m5.large instances (2 vCPUs, 8 GiB of memory) and m5.2xlarge instances (8 vCPUs, 32 GiB of memory), without instance weights. Each task requires 4 vCPUs and 16 GiB of memory. The four existing instances are m5.2xlarge instances and have no remaining capacity for additional tasks. After the service's desired count increases, additional tasks remain in PROVISIONING. The capacity provider's CapacityProviderReservation metric remains at its target, and no scale-out activity occurs. Subnet addresses, service quotas, and instance availability are not limiting factors. The task resource requirements cannot be reduced. A DevOps engineer must correct the configuration so that managed scaling automatically provisions capacity for these tasks. Which change meets this requirement?

A company runs thousands of short-duration data-processing workers on Amazon EC2. The workers authenticate to an internal service by using mutual TLS. An existing workload controller generates certificate signing requests and can install replacement certificates without restarting the workers. A new security standard requires worker certificates to be valid for 12 hours and replaced every 6 hours. The issuing service must reject any request for a worker certificate with a validity period longer than 7 days, even if a defect in the controller requests a longer period. Issuance roles cannot change the issuing CA's configuration. The company wants a managed CA and does not require revocation because the service's security design relies on short certificate lifetimes. Which solution meets these requirements?