DOP-C02 — frequently asked questions

E affects retention, not query logic. It keeps recent data in memory but doesn't reduce the I/O cost of reading/write structure like A and D do.

No. Timestream can push down filters to specific measures within a multi-measure record, scanning only the relevant data rather than the whole record.

User data runs only at boot. Stack updates do not re-execute user data on existing instances, leaving them unchanged.

cfn-hup monitors metadata for changes and triggers cfn-init to apply updates without replacing instances.

It continuously enforces an SSM document association, ensuring running instances converge to the desired application state.

The app must exchange its OIDC token for temporary AWS credentials to call Amazon S3, which is exactly what AssumeRoleWithWebIdentity does. This avoids long-term access keys and matches option E.

Use auth.company.com:aud with StringEquals, matching option D. Option C's sts.amazon.com:aud is not the documented condition key for a custom OIDC provider.

Create an IAM OIDC provider using the provider URL, audience, and signature (B); create an IAM role with S3 permissions and the OIDC trust policy (D); then call AssumeRoleWithWebIdentity (E).

Yes, Control Tower guardrails are built on AWS Config rules. Activating a guardrail leverages this underlying capability without custom deployment.

Option C requires creating and deploying custom Config rules to every account. Option A uses pre-built Control Tower guardrails, reducing management overhead.

It allows the pipeline to assume an IAM role without managing long-term credentials or EC2 instances, providing direct access to CodeArtifact.

Upstream configuration ensures CodeArtifact pulls dependencies from public sources into your private repository during builds, rather than pushing outwards.

It deploys to 100% of traffic immediately, exposing all users to errors before any rollback can occur.

No, metric filters cannot invoke Lambda. Use alarms or events instead for automated actions.

Automatic rollbacks trigger immediately based on alarm thresholds without human intervention, improving efficiency.

The question states builds can exceed 2 hours. Pre-replicating images via ECR avoids this delay during recovery.

No, automated backups are region-local. Use Global Database or snapshot copying to meet RPO requirements across regions.

Metric filters only process log events ingested after their creation. They cannot retroactively analyze logs from the previous 7 days.

It allows ad-hoc querying and aggregation of stored log data using SQL-like syntax, perfect for analyzing historical trends without pre-setup.

Tags within a single group use OR logic, while separate groups use AND logic. An instance must match at least one tag in every defined group.

Option B puts all tags in one group, applying OR logic. The new instance matches Environment=Production, so it still gets selected despite other mismatches.

Use separate single-tag groups to enforce AND conditions. Keep related tags in one group only if you want OR behavior between them.

Replication copies raw data without modification, failing the redaction requirement. Object Lambda transforms data on read, keeping a single source of truth.

Yes. By creating separate S3 Object Lambda access points for each application, you can apply distinct Lambda functions to redact data differently for each consumer.

SCP A denies PutObject, which secures object uploads, not the bucket creation itself. It cannot prevent an unencrypted bucket from being provisioned.

Proactive controls block non-compliant stack operations before resources are created. Detective controls only report violations after the resource exists.

AWS Config emits real-time compliance events to EventBridge, whereas Lambda requires periodic polling which introduces latency.

No, GuardDuty focuses on threat detection like malware or unauthorized access, not infrastructure configuration compliance.

Enhanced Fan-Out provides dedicated throughput per consumer, removing contention and reducing latency caused by shared bandwidth and polling intervals.

No, Reserved Concurrency limits maximum concurrent executions. It protects against throttling but does not increase processing speed or reduce backlog latency.

Unidirectional CRR only replicates Primary to Secondary. If the app fails over to Secondary and writes data, that data is not sent back to Primary, causing loss upon return.

Yes, Managed Replication (MRP) supports two-way rules. It automates the creation of replication rules between buckets to keep them in sync bidirectionally.

No, CodeDeploy processes all defined file mappings in the appspec.yml. If a file matches multiple rules, it will be deployed to all specified destinations.

Mapping the root directory '/' to a destination copies all files and folders from the source root to that destination, including any specific files already targeted by other rules.

Option A uses the legacy CloudWatch Agent and Fluent Bit. AWS now recommends AWS Distro for OpenTelemetry (ADOT) for EKS as it provides a unified, standardized way to collect metrics and logs.

You use a CloudWatch Metric Log Filter Alarm. This type of alarm monitors log groups for specific patterns (like error messages) in the Autoscaler's deployment logs.

No, VPC endpoints do not support ECR Public repositories. You must use a pull-through cache rule to cache public images in a private repository.

Option A requires managing a separate CodeBuild project for each image, creating high operational overhead. The pull-through cache rule automates this efficiently.

No, cross-zone load balancing is always enabled for ALBs. You must disable it at the Target Group level.

It ensures traffic stays in the healthy zone during a shift, preventing the ALB from sending requests to unhealthy instances in other zones.

Increasing minimum healthy percent controls the count of running tasks but doesn't stop the ALB from marking an unready task as unhealthy, which still triggers restarts.

Yes, the concept is identical; instances also need a grace period to initialize applications before ELB health checks can successfully verify them.

No. CodeArtifact access is controlled entirely through IAM identity-based policies attached to users, roles, or instance profiles.

It configures your package manager (like pip) to use temporary credentials from the instance's IAM role to authenticate with CodeArtifact.

StackSets require manual or custom automation to manage deployments and drift correction, increasing operational overhead compared to Control Tower's native automation.

You synthesize your CDK app into a CloudFormation template and use it in Control Tower's Customizations feature to apply configurations to accounts automatically.

Logs Insights parses text logs, which is inefficient for structured metrics and requires managing log schemas and queries, increasing operational overhead.

No, it is a lightweight daemon installed once on the instance that handles metric aggregation and transmission, reducing application-side coding effort.