Disagreement ranking

DOP-C02 — most debated topics

Community-voted ranking of 135 topics, sorted by disagreement level. A higher dispute score means more test-takers disagree on the answer.

Full ranking

135 topics · highest disagreement first

  1. Optimizing Amazon Timestream Query Performance

    S-grade Dispute: 85% 9 comments

  2. Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

    S-grade Dispute: 62% 5 comments

  3. Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

    S-grade Dispute: 48% 9 comments

  4. Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

    S-grade Dispute: 45% 5 comments

  5. Deny iam:CreateUser with an SCP attached to the research team's account

    S-grade Dispute: 44% 17 comments

  6. Centralize pre-scan and post-scan ECR repositories in the shared account and gate promotion with one EventBridge-triggered Lambda

    S-grade Dispute: 42% 9 comments

  7. Use a service-managed StackSet on the root OU and deploy a separate stack in the management account

    S-grade Dispute: 41% 7 comments

  8. Apply a permissions boundary through the CDK bootstrap default so both deployment and Lambda roles are capped

    A-grade Dispute: 37% 3 comments

  9. Enforce the cost allocation tag with CDK tagging and deploy SQS queues defined as CDK constructs through CDK stacks

    S-grade Dispute: 36% 6 comments

  10. Deny all actions when ec2:MetadataHttpTokens is not required so existing instances lose API access

    S-grade Dispute: 32% 7 comments

  11. Deny sso and sso-directory actions in the DevOps permission set with an aws:SourceAccount condition, then delete the SCP

    S-grade Dispute: 31% 7 comments

  12. Target the AWS-RestartEC2Instance Automation runbook from an AWS Health event rule for termination and retirement events

    S-grade Dispute: 31% 8 comments

  13. Query an Athena table over the organization CloudTrail trail with partition projection to find top users and roles

    S-grade Dispute: 31% 7 comments

  14. Refactor user data to cfn-init with cfn-hup, and enforce the SSM document with a State Manager association

    S-grade Dispute: 30% 12 comments

  15. Remove one secondary cluster from the Aurora global database to reduce replication lag blocking writes

    A-grade Dispute: 29% 4 comments

  16. Set the vulnerable CodeArtifact package version to archived and allow direct publishing while blocking upstream operations

    S-grade Dispute: 28% 12 comments

  17. Create an IAM OIDC identity provider, a role trusting the IdP audience, and use AssumeRoleWithWebIdentity

    S-grade Dispute: 27% 9 comments

  18. Create container availability alert rules and grant the Prometheus service principal SNS publish on the topic

    S-grade Dispute: 27% 31 comments

  19. Enable the AWS Config drift-detection managed rule and alert on its compliance-change event via EventBridge

    S-grade Dispute: 26% 14 comments

  20. Add an SQS standard dead-letter queue and a CloudWatch Logs target to the EventBridge rule, and audit activity with CloudTrail

    S-grade Dispute: 26% 10 comments

  21. Allow the primary account in the destination vault access policy and share the primary KMS key with the destination account

    S-grade Dispute: 25% 11 comments

  22. Use an organization trail in the management account with CloudWatch anomaly detection and query it with Metrics Insights

    S-grade Dispute: 25% 5 comments

  23. Build the base image in an EC2 Image Builder container recipe and distribute to ECR in all three Regions weekly

    S-grade Dispute: 23% 8 comments

  24. Replacing FullAWSAccess with an EC2-only Allow caps the admin roles to EC2 actions and denies everything else

    S-grade Dispute: 23% 6 comments

  25. Send Redshift user activity audit logs to CloudWatch and display them with a CloudWatch Logs dashboard widget

    S-grade Dispute: 23% 7 comments

  26. Activate the Control Tower RDS encryption guardrail and notify through EventBridge to SNS

    S-grade Dispute: 22% 11 comments

  27. Create the AWSControlTowerExecution role in the new account and enroll it with the Service Catalog ProvisionProduct API

    S-grade Dispute: 22% 6 comments

  28. Use a Standard workflow with a parallel state started directly by an EventBridge rule on S3 object creation

    S-grade Dispute: 22% 6 comments

  29. Use configuration change recording with the ssh-restricted Config rule and SNS for notifications

    S-grade Dispute: 22% 8 comments

  30. Schedule a State Manager association running an Automation document with EventBridge SNS failure notifications

    A-grade Dispute: 22% 3 comments

  31. Create a Systems Manager State Manager association targeting all managed nodes to run the antivirus document

    S-grade Dispute: 20% 6 comments

  32. Centralize a domain and shared-library repository in the shared services account and use it as upstream for team repositories

    S-grade Dispute: 20% 5 comments

  33. Point CodeUri at the local folder and deploy with sam deploy, or package the folder and use cloudformation package plus deploy

    A-grade Dispute: 20% 3 comments

  34. Move containers to AWS Fargate and replace MySQL with the MySQL-compatible Aurora Serverless v2

    A-grade Dispute: 20% 3 comments

  35. Federate the corporate IdP through IAM Identity Center with SAML and deny IAM user login profile creation via SCP

    S-grade Dispute: 18% 5 comments

  36. Create a Multi-AZ FSx for NetApp ONTAP file system, mount it via user data, and instance refresh the Auto Scaling groups

    S-grade Dispute: 18% 9 comments

  37. Attach an instance profile with a CodeArtifact IAM role and run aws codeartifact login on the instance

    A-grade Dispute: 18% 4 comments

  38. Configure the EKS Pod Identity Agent add-on so pods obtain credentials without an OIDC provider

    S-grade Dispute: 17% 8 comments

  39. Store guardrail templates in CodeCommit and auto-trigger a CodePipeline pipeline via EventBridge for each OU

    A-grade Dispute: 17% 3 comments

  40. Front the Aurora reader endpoint with RDS Proxy and open the connection outside the Lambda handler

    S-grade Dispute: 16% 8 comments

  41. Give the node instance profile CloudWatchAgentServerPolicy and run the CloudWatch agent, then query pod memory by Service

    S-grade Dispute: 16% 5 comments

  42. Use S3 Batch Operations replication to retry objects that failed to replicate

    S-grade Dispute: 15% 8 comments

  43. Deploy a restrictive instance template with Lambda and EventBridge to isolate instances carrying the isolation tag

    S-grade Dispute: 15% 10 comments

  44. Convert RDS storage autoscaling events into a CloudWatch custom metric with EventBridge and Lambda for the dashboard

    S-grade Dispute: 15% 6 comments

  45. Create a custom metric for blocked requests from a metrics filter and alarm using CloudWatch anomaly detection

    A-grade Dispute: 12% 4 comments

  46. Implement the token check in a CloudFront Function with CloudWatch logging and continuous deployment

    A-grade Dispute: 12% 4 comments

  47. Create the us-east-1 artifact store bucket for CodePipeline and add a deploy action using the us-east-1 template artifact

    S-grade Dispute: 11% 5 comments

  48. Capture ECS task state-change events with EventBridge and investigate stopped tasks in CloudWatch Logs Insights

    S-grade Dispute: 10% 5 comments

  49. Deploy Multi-AZ FSx for NetApp ONTAP per Region with a scheduled SnapMirror relationship to the on-premises array

    S-grade Dispute: 10% 6 comments

  50. Add a resource-based policy on the Lambda function granting Amazon S3 permission to invoke it

    S-grade Dispute: 10% 5 comments

  51. Publish VPC Flow Logs to CloudWatch Logs and count RDP sessions with a log group metric filter

    S-grade Dispute: 10% 6 comments

  52. Use the drift detection Config rule with an EventBridge rule on NON_COMPLIANT targeting SNS

    S-grade Dispute: 9% 5 comments

  53. Send CloudTrail management events to CloudWatch Logs, filter failed ConsoleLogin, and alarm to SNS

    A-grade Dispute: 9% 4 comments

  54. Give each application an S3 Object Lambda access point that redacts data as objects are retrieved

    S-grade Dispute: 8% 9 comments

  55. Export the database stack and import its outputs as references in the web application template

    A-grade Dispute: 8% 4 comments

  56. Define a PermissionBoundaries policy and a DeveloperBoundary attached to the CreateAndManageUsers role

    A-grade Dispute: 8% 4 comments

  57. Split the deployment group into an Environment tag group and a Name tag group to require both tags

    S-grade Dispute: 7% 8 comments

  58. Enable failed batch item reporting on the Lambda function and add an SQS dead-letter queue

    S-grade Dispute: 7% 8 comments

  59. Check for blocking SCPs and IAM permission boundaries, fix them in CodeCommit, and deploy through CloudFormation

    A-grade Dispute: 7% 4 comments

  60. Use On-Demand warm pools for critical data and a separate Spot group scaling on a CloudWatch agent memory metric

    A-grade Dispute: 7% 4 comments

  61. Deploy Lambda with a canary configuration and automatic rollback triggered by API Gateway 5XX alarms

    S-grade Dispute: 6% 6 comments

  62. Update S3 bucket policies to the new IP range and deny S3 access with an SCP on the two OUs

    S-grade Dispute: 6% 6 comments

  63. Use IAM Roles Anywhere for the on-premises pipeline and CodeArtifact external connections for public repositories

    S-grade Dispute: 5% 7 comments

  64. Pre-stage CloudFormation templates in S3 and rely on cross-Region replication for images and Aurora backups

    S-grade Dispute: 5% 9 comments

  65. Enable IAM authorization on the API methods and require SigV4-signed requests from the interface VPC endpoint

    S-grade Dispute: 5% 7 comments

  66. Query the log group with CloudWatch Logs Insights to count logins over seven days

    S-grade Dispute: 4% 10 comments

  67. Enable the proactive Control Tower S3 KMS-encryption control with CloudFormation hooks on all OUs

    S-grade Dispute: 3% 10 comments

  68. Enable provisioned concurrency, reuse database connections outside the handler, and route connections through RDS Proxy

    A-grade Dispute: 0% 20 comments

  69. Deny when the EC2 instance source VPC and IP do not match the caller's source VPC and IP via SCP

    A-grade Dispute: 0% 9 comments

  70. Install the CloudWatch agent to publish disk metrics and add a disk space alarm as a patching safety control

    A-grade Dispute: 0% 5 comments

  71. Match the UPDATE_COMPLETE stack status in an EventBridge rule and invoke the tagging Lambda function

    A-grade Dispute: 0% 4 comments

  72. Add the secondary ALB as an origin in an origin group that fails over on HTTP 5xx and use it as the default behavior

    A-grade Dispute: 0% 4 comments

  73. Reduce Latency for Lambda Processing Kinesis Logs

    A-grade Dispute: 0% 6 comments

  74. Deny AWS actions from source IPs outside the company range with an SCP attached to the organization root

    A-grade Dispute: 0% 5 comments

  75. AWS S3 Cross-Region Replication for Multi-Region HA

    A-grade Dispute: 0% 17 comments

  76. Create a Control Tower landing zone with per-team OUs, enroll existing accounts, and provision new accounts through it

    A-grade Dispute: 0% 6 comments

  77. Use native Git in CodeBuild to clone, test, then create and push a Git tag when the tests pass

    A-grade Dispute: 0% 6 comments

  78. Use a blue/green deployment with the HalfAtATime configuration and the BeforeAllowTraffic hook to delete temporary files

    A-grade Dispute: 0% 4 comments

  79. Build an Account Factory Customization blueprint with the baseline and provision every account from it

    A-grade Dispute: 0% 5 comments

  80. Add a resource-based policy to the Lambda function so AWS Config can invoke it

    A-grade Dispute: 0% 6 comments

  81. Create a role with a permissions boundary that permits creating policies and roles, and grant the developer access to assume it

    A-grade Dispute: 0% 3 comments

  82. Trigger CodePipeline with EventBridge on new commits and alert from ECR image scan findings via EventBridge to SNS

    A-grade Dispute: 0% 6 comments

  83. Invoke a Lambda on every successful and failed pipeline run to publish CloudWatch custom metrics and a dashboard

    A-grade Dispute: 0% 4 comments

  84. Empty the non-empty S3 bucket from the custom resource's Lambda on Delete using RequestType Delete

    A-grade Dispute: 0% 6 comments

  85. Use Systems Manager Inventory with AWS Config rules to identify prohibited applications

    A-grade Dispute: 0% 4 comments

  86. Allow the Kubernetes service account's assumed IAM role in the KMS key policy to use the key

    A-grade Dispute: 0% 4 comments

  87. Use Macie and Step Functions to redact PII in production before copying, and schedule the state machine weekly with EventBridge

    A-grade Dispute: 0% 5 comments

  88. Grant EventBridge permission to run commands on the EKS worker nodes and target a State Manager association by node tags

    A-grade Dispute: 0% 4 comments

  89. Collect metrics to S3 on a schedule, catalog with a Glue crawler, query with Athena, and visualize in QuickSight

    A-grade Dispute: 0% 4 comments

  90. Allow NFS inbound from the cluster, give the EFS CSI driver an IAM role, and create a mount target in the node subnet

    A-grade Dispute: 0% 4 comments

  91. Use IAM Roles Anywhere with per-device certificates for least-privilege EFS access and amazon-efs-utils on the devices

    A-grade Dispute: 0% 4 comments

  92. Create a cross-account role in the management account that the new account's Lambda execution role can assume

    A-grade Dispute: 0% 3 comments

  93. Use two-way S3 bucket replication and convert the DynamoDB tables to global tables

    A-grade Dispute: 0% 3 comments

  94. Enable ECR enhanced scanning and use EventBridge with Lambda to reject images with HIGH or CRITICAL findings

    A-grade Dispute: 0% 3 comments

  95. Match the CloudTrail event pattern for AssumeRole in EventBridge and notify SNS from a Lambda

    A-grade Dispute: 0% 4 comments

  96. Use an Aurora global database with promotion for data and Route 53 failover routing for the application tier

    A-grade Dispute: 0% 4 comments

  97. Turn on ECR enhanced scanning and invoke an EC2 Image Builder container image pipeline from an Inspector finding event

    A-grade Dispute: 0% 4 comments

  98. Use the aws:downloadContent plugin with sourceType GitHub and the repository details in sourceInfo

    A-grade Dispute: 0% 4 comments

  99. CodeDeploy AppSpec File Mapping Rules

    A-grade Dispute: 0% 3 comments

  100. Pass records to AWS Step Functions and decouple the sequential steps into tasks and Lambda functions

    A-grade Dispute: 0% 3 comments

  101. Use FSx for NetApp ONTAP in the DR Region with SnapMirror replication from the primary Region

    A-grade Dispute: 0% 4 comments

  102. Enable GuardDuty EKS Audit Log Monitoring and Amazon Detective with EKS audit logs as a source

    A-grade Dispute: 0% 5 comments

  103. Enable S3 Replication Time Control, create an S3 Multi-Region Access Point, and submit its routes on failover

    A-grade Dispute: 0% 5 comments

  104. Write CDK assertions tests and set the CodeBuild build phase OnFailure property to ABORT

    A-grade Dispute: 0% 3 comments

  105. Send Network Firewall flow logs to a Kinesis Data Firehose delivery stream with a Lambda transformer

    A-grade Dispute: 0% 4 comments

  106. Add an ECS deploy stage, output imagedefinitions.json, and run connectivity checks from a Lambda action stage

    A-grade Dispute: 0% 3 comments

  107. Create a State Manager association with a tag query so new Auto Scaling instances are configured automatically

    A-grade Dispute: 0% 3 comments

  108. Subscribe all log groups to a Firehose delivery stream in a dedicated account with a Lambda automating new log group subscriptions

    A-grade Dispute: 0% 3 comments

  109. Store the Docker images in ECR and enable the local Docker layer cache in CodeBuild

    A-grade Dispute: 0% 3 comments

  110. Roll the green Auto Scaling group to the new version first, then switch the ALB to the green target group

    A-grade Dispute: 0% 4 comments

  111. Set the Systems Manager default EC2 instance management role so new instances are managed automatically

    A-grade Dispute: 0% 3 comments

  112. Disable cross-zone load balancing on the target group and initiate a zonal shift on the ALB

    A-grade Dispute: 0% 3 comments

  113. Allow cross-account events into the DevOps event bus and create a rule in each account targeting that bus

    A-grade Dispute: 0% 4 comments

  114. EKS Cluster Metrics and Log Collection with CloudWatch

    A-grade Dispute: 0% 5 comments

  115. Create an FSx for NetApp ONTAP instance in the DR Region with a 5-minute SnapMirror schedule

    A-grade Dispute: 0% 3 comments

  116. Use AWS Config with a restricted-ssh custom rule on the configuration-change trigger and Lambda remediation

    A-grade Dispute: 0% 3 comments

  117. Enable EventBridge schema discovery, monitor EventBridge and Step Functions metrics, and check failed invocation metrics

    A-grade Dispute: 0% 4 comments

  118. Create an EBS CSI driver IAM role with the required permissions and attach it to the CSI driver add-on

    A-grade Dispute: 0% 4 comments

  119. Use a CloudFormation hook enforcing encryption and deploy it across the OU with StackSets trusted access

    A-grade Dispute: 0% 5 comments

  120. ECR Pull Through Cache and VPC Endpoints for ECS

    A-grade Dispute: 0% 5 comments

  121. Add an ECR lifecycle policy expiring images with the matching tag after 15 days

    A-grade Dispute: 0% 3 comments

  122. Use an SCP to require the CostCenter tag, a tag policy for valid values, and update the script to fix noncompliant resources

    A-grade Dispute: 0% 3 comments

  123. Export the bucket name as a CloudFormation output with the StackVariables namespace and deploy using StackVariables.BucketName

    A-grade Dispute: 0% 3 comments

  124. Attach a resource policy to the API Gateway API allowing only the specific VPC IDs

    A-grade Dispute: 0% 3 comments

  125. Increase the ALB target group health check grace period for the ECS service

    A-grade Dispute: 0% 5 comments

  126. Create one custom patch baseline combining the OS and custom repositories and run AWS-RunPatchBaseline

    A-grade Dispute: 0% 4 comments

  127. Set the existing WAF web ACL default action to Block and allow the office IP set at priority 0

    A-grade Dispute: 0% 4 comments

  128. Create a Contributor Insights rule for top contributors and alarm on INSIGHT_RULE_METRIC for over half the errors

    A-grade Dispute: 0% 3 comments

  129. Route 53 Zonal Shift with ALB Target Group Settings

    S-grade Dispute: 0% 17 comments

  130. Troubleshooting ECS ALB Health Check Failures

    S-grade Dispute: 0% 6 comments

  131. Granting EC2 Access to CodeArtifact for Python Packages

    A-grade Dispute: 0% 8 comments

  132. Restrict CodeConnections Provider and HA Regions

    A-grade Dispute: 0% 8 comments

  133. Deploying CDK Security Controls Across AWS Accounts

    A-grade Dispute: 0% 6 comments

  134. Least Overhead for Custom EC2 Metrics

    A-grade Dispute: 0% 2 comments

  135. Automating Dedicated License Allocation at Scale

    A-grade Dispute: 0% 42 comments

← Back to DOP-C02 AWS DevOps Engineer Professional Study Guide