View Full Amazon AWS Certified DevOps Engineer – Professional DOP-C02 Exam Dumps and Practice Test Dumps

 

Question 161. What controls permissions for AWS resources?

1. IAM policies
   2. CloudWatch dashboards
   3. ECR tags
   4. CodeBuild reports

Correct Answer: 1. IAM policies

Explanation:

AWS Identity and Access Management policies define what actions principals are allowed or denied to perform on AWS resources. Policies can be attached to users, groups, roles, or resources depending on the authorization model being used. In DevOps environments, IAM policies are essential for controlling access to deployment pipelines, build systems, repositories, infrastructure services, and production resources. Following least-privilege principles helps reduce unnecessary permissions. Policies can also use conditions to restrict access based on factors such as resource tags, source identity, or requested AWS Region, providing more precise control over automated and human access.

Question 162. What restricts permissions delegated through an IAM role?

1. Security group
   2. Permission boundary
   3. CloudFormation template
   4. EventBridge rule

Correct Answer: 2. Permission boundary

Explanation:

An IAM permissions boundary defines the maximum permissions that an identity-based policy can grant to an IAM principal. It does not directly grant permissions by itself; instead, it establishes a limit on the permissions the principal can receive from other applicable identity policies. This is useful in large organizations where administrators need to delegate IAM role or user creation without allowing delegated administrators to create principals with unrestricted permissions. Permission boundaries can therefore provide an additional security control for CI/CD environments and development teams that need to create or manage IAM roles while remaining within centrally defined authorization limits.

Question 163. What analyzes unintended AWS access paths?

1. AWS IAM Access Analyzer
   2. Amazon ECR
   3. AWS CodeArtifact
   4. CloudWatch Logs

Correct Answer: 1. AWS IAM Access Analyzer

Explanation:

IAM Access Analyzer helps organizations identify resources that are accessible from outside their intended trust boundaries. It can analyze resource-based policies and identify external access paths involving resources such as S3 buckets, IAM roles, KMS keys, and other supported services. This can help security and DevOps teams discover unintended cross-account or public access. Access Analyzer findings can then be reviewed and addressed by modifying resource policies or permissions. It complements normal IAM policy reviews by providing visibility into effective external access rather than requiring administrators to manually inspect every possible policy relationship.

Question 164. What provides temporary AWS credentials?

1. AWS STS
   2. Amazon ECR
   3. CloudFormation
   4. CodeBuild

Correct Answer: 1. AWS STS

Explanation:

AWS Security Token Service provides temporary security credentials that can be used to access AWS resources. Temporary credentials are particularly useful for automation, cross-account access, federated identities, and applications that should not rely on long-term access keys. In DevOps workflows, IAM roles can be assumed through STS to obtain temporary credentials for deployment or administrative operations. These credentials have a limited lifetime and include an access key ID, secret access key, and session token. Using temporary role credentials reduces the need to distribute permanent credentials across build systems, deployment servers, and automation scripts.

Question 165. What can restrict AWS accounts within an organization?

1. Service Control Policies
   2. CloudWatch alarms
   3. ECR lifecycle policies
   4. CodeBuild projects

Correct Answer: 1. Service Control Policies

Explanation:

AWS Organizations Service Control Policies, or SCPs, define the maximum available permissions for accounts within an organization or organizational unit. SCPs do not grant permissions directly; instead, they establish guardrails that restrict which AWS actions can be used by principals in affected accounts. For example, an organization can use SCPs to prevent accounts from disabling certain security services or using specific Regions. This makes SCPs useful for centralized governance. IAM policies still determine what individual principals can actually perform, but an SCP can prevent an otherwise permitted action from being available within the account.

Question 166. What stores application secrets centrally?

1. AWS Secrets Manager
   2. Amazon CloudWatch
   3. AWS CodeDeploy
   4. Amazon Route 53

Correct Answer: 1. AWS Secrets Manager

Explanation:

AWS Secrets Manager provides centralized storage and management for sensitive information such as database credentials, API keys, and other application secrets. Applications and automation systems can retrieve secrets through controlled AWS APIs instead of embedding credentials directly in source code or configuration files. Secrets Manager also supports features such as encryption using AWS KMS and automated secret rotation for supported scenarios. In DevOps environments, integrating Secrets Manager with build and deployment processes helps reduce the risk of exposing credentials in repositories, scripts, or pipeline configuration while providing centralized access control.

Question 167. What identifies a specific secret version in Secrets Manager?

1. Version stage
   2. ECR digest
   3. Deployment group
   4. CloudFormation stack ID

Correct Answer: 1. Version stage

Explanation:

AWS Secrets Manager uses version stages to identify the role of different versions of a secret. Common stages include AWSCURRENT and AWSPREVIOUS, which help applications and rotation workflows determine which secret version should currently be used. During rotation, staging labels can move between versions as the new credential becomes active. This allows applications to retrieve the current secret without having to hard-code a specific version identifier. Version staging is especially useful in automated rotation workflows because the active credential can change while applications continue requesting the current staged version.

Question 168. What encrypts Secrets Manager secret values?

1. AWS KMS
   2. CloudFront
   3. CodePipeline
   4. Systems Manager Inventory

Correct Answer: 1. AWS KMS

Explanation:

AWS Secrets Manager encrypts secret values at rest using AWS Key Management Service keys. By default, Secrets Manager can use an AWS managed KMS key, while organizations can also configure a customer managed KMS key when they require additional control over key policies and lifecycle management. Access to the secret and the associated encryption key must both be appropriately authorized. Using KMS provides centralized cryptographic controls while Secrets Manager handles secret storage and retrieval. This separation allows organizations to manage sensitive credentials without exposing their plaintext values in application source code or ordinary configuration files.

Question 169. What can store non-secret configuration parameters?

1. Systems Manager Parameter Store
   2. CodeDeploy deployment group
   3. ECR image digest
   4. CloudTrail trail

Correct Answer: 1. Systems Manager Parameter Store

Explanation:

AWS Systems Manager Parameter Store provides centralized storage for configuration parameters and can also store sensitive values as SecureString parameters. It is useful for values such as application settings, environment-specific configuration, URLs, feature settings, and other parameters that should not be hard-coded into applications or deployment scripts. Parameters can be organized using hierarchical names, making it easier to separate values by application and environment. IAM policies control who or what can retrieve parameters. Parameter Store is commonly integrated with CodeBuild, ECS, Lambda, and other AWS services to provide configuration at runtime or during deployment.

Question 170. What creates a CloudWatch metric from matching log text?

1. Metric filter
   2. StackSet
   3. Deployment group
   4. IAM role

Correct Answer: 1. Metric filter

Explanation:

A CloudWatch Logs metric filter searches incoming log events for a defined pattern and publishes the number of matching events as a CloudWatch metric. This allows operational information contained in application logs to become measurable and usable with dashboards and alarms. For example, an organization could create a metric filter that counts occurrences of a particular error message and then configure an alarm when the count exceeds an acceptable threshold. Metric filters are useful when applications already produce meaningful log messages but do not expose dedicated metrics for every operational condition that needs to be monitored.

Question 171. What centralizes AWS API activity records?

1. AWS CloudTrail
   2. AWS CodeArtifact
   3. Amazon ECR
   4. AWS AppConfig

Correct Answer: 1. AWS CloudTrail

Explanation:

AWS CloudTrail records API activity and other supported account events, providing visibility into actions performed against AWS resources. CloudTrail records can include information about the identity that made a request, the service involved, the action performed, and other event details. Organizations use these records for auditing, security investigations, troubleshooting, and operational monitoring. In larger environments, an organization trail can provide centralized logging across multiple AWS accounts. Protecting the resulting log files is important because CloudTrail records may contain evidence needed to understand configuration changes or investigate unexpected activity.

Question 172. What lets CloudFormation manage existing resources?

1. Resource import
   2. Deployment alarm
   3. CodeBuild cache
   4. ECR replication

Correct Answer: 1. Resource import

Explanation:

CloudFormation resource import allows supported existing AWS resources to be brought under CloudFormation management without necessarily recreating them. This can help organizations transition manually created infrastructure into an infrastructure-as-code model. During an import operation, the resource must meet the requirements for the relevant resource type and be described appropriately in the CloudFormation template. Once successfully imported, the resource becomes associated with the stack and can be managed through subsequent CloudFormation operations. Resource import can therefore help teams gradually move existing environments toward consistent declarative infrastructure management.

Question 173. What controls parallelism during StackSets operations?

1. Operation preferences
   2. Buildspec phases
   3. IAM access keys
   4. ECR lifecycle rules

Correct Answer: 1. Operation preferences

Explanation:

CloudFormation StackSets operation preferences control how StackSet operations are performed across target accounts and Regions. These settings can influence deployment concurrency and failure behavior, allowing administrators to control how aggressively changes are rolled out. Managing concurrency is important when deploying infrastructure across a large number of accounts because simultaneously changing every environment can increase operational impact. StackSets can use deployment strategies that gradually process targets and stop or continue based on configured failure tolerances. Operation preferences therefore provide important control over the scale and pace of centralized infrastructure deployments.

Question 174. What service can orchestrate multi-step automation workflows?

1. Systems Manager Automation
   2. Amazon Route 53
   3. ECR
   4. CloudWatch Dashboard

Correct Answer: 1. Systems Manager Automation

Explanation:

AWS Systems Manager Automation allows organizations to define and execute automated operational workflows using Automation runbooks. A runbook can contain multiple steps that perform tasks such as modifying AWS resources, running commands, invoking other AWS services, or validating conditions. Automation is useful for repeatable operational procedures because the workflow can be standardized rather than performed manually each time. It can also be invoked by other AWS services and integrated into remediation processes. Organizations can use Automation for deployment-related operations, incident response, patching workflows, infrastructure maintenance, and other routine administrative activities.

Question 175. What feature automatically fixes certain AWS Config violations?

1. Config remediation
   2. CodePipeline approval
   3. ECR replication
   4. CloudWatch dashboard

Correct Answer: 1. Config remediation

Explanation:

AWS Config remediation allows organizations to automatically or manually invoke corrective actions when resources violate defined Config rules. Remediation actions can use Systems Manager Automation documents to perform standardized corrective operations. For example, an organization may configure remediation to address a resource that does not meet a required security configuration. Automated remediation can reduce the time between detecting a configuration problem and correcting it. However, remediation actions should be tested carefully because an incorrect automated response could modify production resources unexpectedly. Appropriate IAM permissions, rule conditions, and remediation parameters are important parts of a safe implementation.

Question 176. What checks resources against defined configuration rules?

1. AWS Config
   2. CodeBuild
   3. CodeArtifact
   4. Lambda aliases

Correct Answer: 1. AWS Config

Explanation:

AWS Config continuously records supported resource configuration information and can evaluate resources against defined configuration rules. These rules can assess whether resources meet organizational requirements, such as security or operational standards. Config provides historical configuration information as well, allowing teams to investigate how resource settings changed over time. In DevOps environments, Config can be integrated with remediation workflows so that detected violations can trigger corrective actions. This makes Config useful not only for visibility but also for continuous governance of infrastructure that is created or modified through automated deployment processes.

Question 177. What helps monitor application latency and errors in CloudWatch?

1. Application Signals
   2. ECR lifecycle policy
   3. Stack policy
   4. CodeArtifact upstream

Correct Answer: 1. Application Signals

Explanation:

Amazon CloudWatch Application Signals provides application performance monitoring capabilities focused on key application health indicators. It can help teams understand service performance through measurements such as latency, availability, and error-related behavior. This visibility is valuable during deployments because teams need to determine whether a newly released version is performing as expected. Application Signals can complement logs, metrics, traces, and deployment alarms by providing service-level views of application health. When integrated into an operational workflow, these signals can help teams identify degradation and connect application behavior with changes introduced during software delivery.

Question 178. What provides distributed tracing for applications?

1. AWS X-Ray
   2. CodeArtifact
   3. ECR
   4. IAM Access Analyzer

Correct Answer: 1. AWS X-Ray

Explanation:

AWS X-Ray provides distributed tracing that helps developers and operations teams analyze requests as they move through multiple components of an application. A single request may pass through services such as API endpoints, Lambda functions, databases, and other components, making traditional logs difficult to correlate. X-Ray traces can help identify where latency or errors occur within the request path. This is useful for troubleshooting microservices and distributed applications, particularly after deployments. Tracing information can complement CloudWatch metrics and logs by providing a more connected view of the application’s request flow.

Question 179. What manages application configuration independently from code?

1. AWS AppConfig
   2. CodeDeploy
   3. ECR
   4. CloudTrail

Correct Answer: 1. AWS AppConfig

Explanation:

AWS AppConfig allows applications to retrieve and use configuration data separately from the application code itself. This can include feature flags, operational settings, tuning parameters, and other values that may need to change without rebuilding the application. AppConfig provides controlled deployment mechanisms so configuration changes can be gradually introduced and monitored. Separating configuration from code can make operational changes faster and reduce unnecessary application deployments. It also provides mechanisms for validation and rollback, helping organizations reduce the risk of configuration errors affecting all application users simultaneously.

Question 180. What helps prevent excessive permissions in CI/CD roles?

1. Least privilege
   2. AllAtOnce deployment
   3. ECR tag naming
   4. CloudWatch dashboard

Correct Answer: 1. Least privilege

Explanation:

The principle of least privilege means granting a CI/CD role only the permissions required to perform its intended tasks. For example, a build role may need permission to read source dependencies and write build artifacts, while a deployment role may need access to specific deployment resources. Avoiding broad permissions reduces the potential impact if credentials or automation components are compromised. IAM policies, permission boundaries, resource policies, and role separation can all support least-privilege designs. In DevOps environments, reviewing permissions regularly is important because pipelines evolve and may accumulate access that is no longer necessary.