DOP-C02 AWS DevOps Engineer Professional Study Guide

#1

Optimizing Amazon Timestream Query Performance

S-Grade Dispute: 85% 9 comments

#2

Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

S-Grade Dispute: 62% 5 comments

#3

Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

S-Grade Dispute: 48% 9 comments

#4

Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

S-Grade Dispute: 45% 5 comments

#5

Deny iam:CreateUser with an SCP attached to the research team's account

S-Grade Dispute: 44% 17 comments

#6

Centralize pre-scan and post-scan ECR repositories in the shared account and gate promotion with one EventBridge-triggered Lambda

S-Grade Dispute: 42% 9 comments

#7

Use a service-managed StackSet on the root OU and deploy a separate stack in the management account

S-Grade Dispute: 41% 7 comments

#8

Apply a permissions boundary through the CDK bootstrap default so both deployment and Lambda roles are capped

A-Grade Dispute: 37% 3 comments

#9

Enforce the cost allocation tag with CDK tagging and deploy SQS queues defined as CDK constructs through CDK stacks

S-Grade Dispute: 36% 6 comments

#10

Deny all actions when ec2:MetadataHttpTokens is not required so existing instances lose API access

S-Grade Dispute: 32% 7 comments

#11

Deny sso and sso-directory actions in the DevOps permission set with an aws:SourceAccount condition, then delete the SCP

S-Grade Dispute: 31% 7 comments

#12

Target the AWS-RestartEC2Instance Automation runbook from an AWS Health event rule for termination and retirement events

S-Grade Dispute: 31% 8 comments

#13

Query an Athena table over the organization CloudTrail trail with partition projection to find top users and roles

S-Grade Dispute: 31% 7 comments

#14

Refactor user data to cfn-init with cfn-hup, and enforce the SSM document with a State Manager association

S-Grade Dispute: 30% 12 comments

#15

Remove one secondary cluster from the Aurora global database to reduce replication lag blocking writes

A-Grade Dispute: 29% 4 comments

#16

Set the vulnerable CodeArtifact package version to archived and allow direct publishing while blocking upstream operations

S-Grade Dispute: 28% 12 comments

#17

Create an IAM OIDC identity provider, a role trusting the IdP audience, and use AssumeRoleWithWebIdentity

S-Grade Dispute: 27% 9 comments

#18

Create container availability alert rules and grant the Prometheus service principal SNS publish on the topic

S-Grade Dispute: 27% 31 comments

#19

Enable the AWS Config drift-detection managed rule and alert on its compliance-change event via EventBridge

S-Grade Dispute: 26% 14 comments

#20

Add an SQS standard dead-letter queue and a CloudWatch Logs target to the EventBridge rule, and audit activity with CloudTrail

S-Grade Dispute: 26% 10 comments

#21

Allow the primary account in the destination vault access policy and share the primary KMS key with the destination account

S-Grade Dispute: 25% 11 comments

#22

Use an organization trail in the management account with CloudWatch anomaly detection and query it with Metrics Insights

S-Grade Dispute: 25% 5 comments

#23

Build the base image in an EC2 Image Builder container recipe and distribute to ECR in all three Regions weekly

S-Grade Dispute: 23% 8 comments

#24

Replacing FullAWSAccess with an EC2-only Allow caps the admin roles to EC2 actions and denies everything else

S-Grade Dispute: 23% 6 comments

#25

Send Redshift user activity audit logs to CloudWatch and display them with a CloudWatch Logs dashboard widget

S-Grade Dispute: 23% 7 comments

#26

Activate the Control Tower RDS encryption guardrail and notify through EventBridge to SNS

S-Grade Dispute: 22% 11 comments

#27

Create the AWSControlTowerExecution role in the new account and enroll it with the Service Catalog ProvisionProduct API

S-Grade Dispute: 22% 6 comments

#28

Use a Standard workflow with a parallel state started directly by an EventBridge rule on S3 object creation

S-Grade Dispute: 22% 6 comments

#29

Use configuration change recording with the ssh-restricted Config rule and SNS for notifications

S-Grade Dispute: 22% 8 comments

#30

Schedule a State Manager association running an Automation document with EventBridge SNS failure notifications

A-Grade Dispute: 22% 3 comments

#31

Create a Systems Manager State Manager association targeting all managed nodes to run the antivirus document

S-Grade Dispute: 20% 6 comments

#32

Centralize a domain and shared-library repository in the shared services account and use it as upstream for team repositories

S-Grade Dispute: 20% 5 comments

#33

Point CodeUri at the local folder and deploy with sam deploy, or package the folder and use cloudformation package plus deploy

A-Grade Dispute: 20% 3 comments

#34

Move containers to AWS Fargate and replace MySQL with the MySQL-compatible Aurora Serverless v2

A-Grade Dispute: 20% 3 comments

#35

Federate the corporate IdP through IAM Identity Center with SAML and deny IAM user login profile creation via SCP

S-Grade Dispute: 18% 5 comments

#36

Create a Multi-AZ FSx for NetApp ONTAP file system, mount it via user data, and instance refresh the Auto Scaling groups

S-Grade Dispute: 18% 9 comments

#37

Attach an instance profile with a CodeArtifact IAM role and run aws codeartifact login on the instance

A-Grade Dispute: 18% 4 comments

#38

Configure the EKS Pod Identity Agent add-on so pods obtain credentials without an OIDC provider

S-Grade Dispute: 17% 8 comments

#39

Store guardrail templates in CodeCommit and auto-trigger a CodePipeline pipeline via EventBridge for each OU

A-Grade Dispute: 17% 3 comments

#40

Front the Aurora reader endpoint with RDS Proxy and open the connection outside the Lambda handler

S-Grade Dispute: 16% 8 comments

#41

Give the node instance profile CloudWatchAgentServerPolicy and run the CloudWatch agent, then query pod memory by Service

S-Grade Dispute: 16% 5 comments

#42

Use S3 Batch Operations replication to retry objects that failed to replicate

S-Grade Dispute: 15% 8 comments

#43

Deploy a restrictive instance template with Lambda and EventBridge to isolate instances carrying the isolation tag

S-Grade Dispute: 15% 10 comments

#44

Convert RDS storage autoscaling events into a CloudWatch custom metric with EventBridge and Lambda for the dashboard

S-Grade Dispute: 15% 6 comments

#45

Create a custom metric for blocked requests from a metrics filter and alarm using CloudWatch anomaly detection

A-Grade Dispute: 12% 4 comments

#46

Implement the token check in a CloudFront Function with CloudWatch logging and continuous deployment

A-Grade Dispute: 12% 4 comments

#47

Create the us-east-1 artifact store bucket for CodePipeline and add a deploy action using the us-east-1 template artifact

S-Grade Dispute: 11% 5 comments

#48

Capture ECS task state-change events with EventBridge and investigate stopped tasks in CloudWatch Logs Insights

S-Grade Dispute: 10% 5 comments

#49

Deploy Multi-AZ FSx for NetApp ONTAP per Region with a scheduled SnapMirror relationship to the on-premises array

S-Grade Dispute: 10% 6 comments

#50

Add a resource-based policy on the Lambda function granting Amazon S3 permission to invoke it

S-Grade Dispute: 10% 5 comments

#51

Publish VPC Flow Logs to CloudWatch Logs and count RDP sessions with a log group metric filter

S-Grade Dispute: 10% 6 comments

#52

Use the drift detection Config rule with an EventBridge rule on NON_COMPLIANT targeting SNS

S-Grade Dispute: 9% 5 comments

#53

Send CloudTrail management events to CloudWatch Logs, filter failed ConsoleLogin, and alarm to SNS

A-Grade Dispute: 9% 4 comments

#54

Give each application an S3 Object Lambda access point that redacts data as objects are retrieved

S-Grade Dispute: 8% 9 comments

#55

Export the database stack and import its outputs as references in the web application template

A-Grade Dispute: 8% 4 comments

#56

Define a PermissionBoundaries policy and a DeveloperBoundary attached to the CreateAndManageUsers role

A-Grade Dispute: 8% 4 comments

#57

Split the deployment group into an Environment tag group and a Name tag group to require both tags

S-Grade Dispute: 7% 8 comments

#58

Enable failed batch item reporting on the Lambda function and add an SQS dead-letter queue

S-Grade Dispute: 7% 8 comments

#59

Check for blocking SCPs and IAM permission boundaries, fix them in CodeCommit, and deploy through CloudFormation

A-Grade Dispute: 7% 4 comments

#60

Use On-Demand warm pools for critical data and a separate Spot group scaling on a CloudWatch agent memory metric

A-Grade Dispute: 7% 4 comments

#61

Deploy Lambda with a canary configuration and automatic rollback triggered by API Gateway 5XX alarms

S-Grade Dispute: 6% 6 comments

#62

Update S3 bucket policies to the new IP range and deny S3 access with an SCP on the two OUs

S-Grade Dispute: 6% 6 comments

#63

Use IAM Roles Anywhere for the on-premises pipeline and CodeArtifact external connections for public repositories

S-Grade Dispute: 5% 7 comments

#64

Pre-stage CloudFormation templates in S3 and rely on cross-Region replication for images and Aurora backups

S-Grade Dispute: 5% 9 comments

#65

Enable IAM authorization on the API methods and require SigV4-signed requests from the interface VPC endpoint

S-Grade Dispute: 5% 7 comments

#66

Query the log group with CloudWatch Logs Insights to count logins over seven days

S-Grade Dispute: 4% 10 comments

#67

Enable the proactive Control Tower S3 KMS-encryption control with CloudFormation hooks on all OUs

S-Grade Dispute: 3% 10 comments

#68

Enable provisioned concurrency, reuse database connections outside the handler, and route connections through RDS Proxy

A-Grade Dispute: 0% 20 comments

#69

Deny when the EC2 instance source VPC and IP do not match the caller's source VPC and IP via SCP

A-Grade Dispute: 0% 9 comments

#70

Install the CloudWatch agent to publish disk metrics and add a disk space alarm as a patching safety control

A-Grade Dispute: 0% 5 comments

#71

Match the UPDATE_COMPLETE stack status in an EventBridge rule and invoke the tagging Lambda function

A-Grade Dispute: 0% 4 comments

#72

Add the secondary ALB as an origin in an origin group that fails over on HTTP 5xx and use it as the default behavior

A-Grade Dispute: 0% 4 comments

#73

Reduce Latency for Lambda Processing Kinesis Logs

A-Grade Dispute: 0% 6 comments

#74

Deny AWS actions from source IPs outside the company range with an SCP attached to the organization root

A-Grade Dispute: 0% 5 comments

#75

AWS S3 Cross-Region Replication for Multi-Region HA

A-Grade Dispute: 0% 17 comments

#76

Create a Control Tower landing zone with per-team OUs, enroll existing accounts, and provision new accounts through it

A-Grade Dispute: 0% 6 comments

#77

Use native Git in CodeBuild to clone, test, then create and push a Git tag when the tests pass

A-Grade Dispute: 0% 6 comments

#78

Use a blue/green deployment with the HalfAtATime configuration and the BeforeAllowTraffic hook to delete temporary files

A-Grade Dispute: 0% 4 comments

#79

Build an Account Factory Customization blueprint with the baseline and provision every account from it

A-Grade Dispute: 0% 5 comments

#80

Add a resource-based policy to the Lambda function so AWS Config can invoke it

A-Grade Dispute: 0% 6 comments

#81

Create a role with a permissions boundary that permits creating policies and roles, and grant the developer access to assume it

A-Grade Dispute: 0% 3 comments

#82

Trigger CodePipeline with EventBridge on new commits and alert from ECR image scan findings via EventBridge to SNS

A-Grade Dispute: 0% 6 comments

#83

Invoke a Lambda on every successful and failed pipeline run to publish CloudWatch custom metrics and a dashboard

A-Grade Dispute: 0% 4 comments

#84

Empty the non-empty S3 bucket from the custom resource's Lambda on Delete using RequestType Delete

A-Grade Dispute: 0% 6 comments

#85

Use Systems Manager Inventory with AWS Config rules to identify prohibited applications

A-Grade Dispute: 0% 4 comments

#86

Allow the Kubernetes service account's assumed IAM role in the KMS key policy to use the key

A-Grade Dispute: 0% 4 comments

#87

Use Macie and Step Functions to redact PII in production before copying, and schedule the state machine weekly with EventBridge

A-Grade Dispute: 0% 5 comments

#88

Grant EventBridge permission to run commands on the EKS worker nodes and target a State Manager association by node tags

A-Grade Dispute: 0% 4 comments

#89

Collect metrics to S3 on a schedule, catalog with a Glue crawler, query with Athena, and visualize in QuickSight

A-Grade Dispute: 0% 4 comments

#90

Allow NFS inbound from the cluster, give the EFS CSI driver an IAM role, and create a mount target in the node subnet

A-Grade Dispute: 0% 4 comments

#91

Use IAM Roles Anywhere with per-device certificates for least-privilege EFS access and amazon-efs-utils on the devices

A-Grade Dispute: 0% 4 comments

#92

Create a cross-account role in the management account that the new account's Lambda execution role can assume

A-Grade Dispute: 0% 3 comments

#93

Use two-way S3 bucket replication and convert the DynamoDB tables to global tables

A-Grade Dispute: 0% 3 comments

#94

Enable ECR enhanced scanning and use EventBridge with Lambda to reject images with HIGH or CRITICAL findings

A-Grade Dispute: 0% 3 comments

#95

Match the CloudTrail event pattern for AssumeRole in EventBridge and notify SNS from a Lambda

A-Grade Dispute: 0% 4 comments

#96

Use an Aurora global database with promotion for data and Route 53 failover routing for the application tier

A-Grade Dispute: 0% 4 comments

#97

Turn on ECR enhanced scanning and invoke an EC2 Image Builder container image pipeline from an Inspector finding event

A-Grade Dispute: 0% 4 comments

#98

Use the aws:downloadContent plugin with sourceType GitHub and the repository details in sourceInfo

A-Grade Dispute: 0% 4 comments

#99

CodeDeploy AppSpec File Mapping Rules

A-Grade Dispute: 0% 3 comments

#100

Pass records to AWS Step Functions and decouple the sequential steps into tasks and Lambda functions

A-Grade Dispute: 0% 3 comments

#101

Use FSx for NetApp ONTAP in the DR Region with SnapMirror replication from the primary Region

A-Grade Dispute: 0% 4 comments

#102

Enable GuardDuty EKS Audit Log Monitoring and Amazon Detective with EKS audit logs as a source

A-Grade Dispute: 0% 5 comments

#103

Enable S3 Replication Time Control, create an S3 Multi-Region Access Point, and submit its routes on failover

A-Grade Dispute: 0% 5 comments

#104

Write CDK assertions tests and set the CodeBuild build phase OnFailure property to ABORT

A-Grade Dispute: 0% 3 comments

#105

Send Network Firewall flow logs to a Kinesis Data Firehose delivery stream with a Lambda transformer

A-Grade Dispute: 0% 4 comments

#106

Add an ECS deploy stage, output imagedefinitions.json, and run connectivity checks from a Lambda action stage

A-Grade Dispute: 0% 3 comments

#107

Create a State Manager association with a tag query so new Auto Scaling instances are configured automatically

A-Grade Dispute: 0% 3 comments

#108

Subscribe all log groups to a Firehose delivery stream in a dedicated account with a Lambda automating new log group subscriptions

A-Grade Dispute: 0% 3 comments

#109

Store the Docker images in ECR and enable the local Docker layer cache in CodeBuild

A-Grade Dispute: 0% 3 comments

#110

Roll the green Auto Scaling group to the new version first, then switch the ALB to the green target group

A-Grade Dispute: 0% 4 comments

#111

Set the Systems Manager default EC2 instance management role so new instances are managed automatically

A-Grade Dispute: 0% 3 comments

#112

Disable cross-zone load balancing on the target group and initiate a zonal shift on the ALB

A-Grade Dispute: 0% 3 comments

#113

Allow cross-account events into the DevOps event bus and create a rule in each account targeting that bus

A-Grade Dispute: 0% 4 comments

#114

EKS Cluster Metrics and Log Collection with CloudWatch

A-Grade Dispute: 0% 5 comments

#115

Create an FSx for NetApp ONTAP instance in the DR Region with a 5-minute SnapMirror schedule

A-Grade Dispute: 0% 3 comments

#116

Use AWS Config with a restricted-ssh custom rule on the configuration-change trigger and Lambda remediation

A-Grade Dispute: 0% 3 comments

#117

Enable EventBridge schema discovery, monitor EventBridge and Step Functions metrics, and check failed invocation metrics

A-Grade Dispute: 0% 4 comments

#118

Create an EBS CSI driver IAM role with the required permissions and attach it to the CSI driver add-on

A-Grade Dispute: 0% 4 comments

#119

Use a CloudFormation hook enforcing encryption and deploy it across the OU with StackSets trusted access

A-Grade Dispute: 0% 5 comments

#120

ECR Pull Through Cache and VPC Endpoints for ECS

A-Grade Dispute: 0% 5 comments

#121

Add an ECR lifecycle policy expiring images with the matching tag after 15 days

A-Grade Dispute: 0% 3 comments

#122

Use an SCP to require the CostCenter tag, a tag policy for valid values, and update the script to fix noncompliant resources

A-Grade Dispute: 0% 3 comments

#123

Export the bucket name as a CloudFormation output with the StackVariables namespace and deploy using StackVariables.BucketName

A-Grade Dispute: 0% 3 comments

#124

Attach a resource policy to the API Gateway API allowing only the specific VPC IDs

A-Grade Dispute: 0% 3 comments

#125

Increase the ALB target group health check grace period for the ECS service

A-Grade Dispute: 0% 5 comments

#126

Create one custom patch baseline combining the OS and custom repositories and run AWS-RunPatchBaseline

A-Grade Dispute: 0% 4 comments

#127

Set the existing WAF web ACL default action to Block and allow the office IP set at priority 0

A-Grade Dispute: 0% 4 comments

#128

Create a Contributor Insights rule for top contributors and alarm on INSIGHT_RULE_METRIC for over half the errors

A-Grade Dispute: 0% 3 comments

DOP-C02 — Most Debated Topics

Ready to practice?