View Full Amazon AWS Certified DevOps Engineer – Professional DOP-C02 Exam Dumps and Practice Test Dumps

 

Question 181. What enables event-driven AWS automation?

1. IAM policy
   2. EventBridge
   3. ECR repository
   4. CodeArtifact

Correct Answer: 2. EventBridge

Explanation:

Amazon EventBridge enables event-driven automation by detecting events from AWS services, applications, and supported external sources and routing matching events to configured targets. A rule can evaluate an event pattern and invoke services such as Lambda, Systems Manager Automation, Step Functions, or other supported targets. This approach allows workflows to respond automatically to infrastructure and application events without continuous polling. For DevOps teams, EventBridge can be used to trigger remediation, deployment workflows, notifications, or operational processes when a specific event occurs. It therefore provides an important foundation for loosely coupled and automated AWS environments.

Question 182. What provides a central event bus for custom events?

1. CloudFormation
   2. EventBridge event bus
   3. CodeBuild
   4. ECR

Correct Answer: 2. EventBridge event bus

Explanation:

An EventBridge event bus receives and routes events from AWS services, applications, and other supported event sources. Organizations can use custom event buses to separate application or organizational events from the default AWS event bus and apply specific rules to them. This supports loosely coupled architectures because event producers do not need direct knowledge of every service that consumes their events. Rules can inspect event attributes and route matching events to one or more targets. Event buses are therefore useful for building automated workflows across multiple services, accounts, and application components.

Question 183. What securely stores pipeline artifacts in S3?

1. IAM group
   2. CloudWatch alarm
   3. S3 bucket encryption
   4. CodeDeploy hook

Correct Answer: 3. S3 bucket encryption

Explanation:

Amazon S3 encryption helps protect CodePipeline artifacts stored in an S3 artifact bucket. Pipeline artifacts may contain source packages, compiled application files, deployment packages, or configuration information, so protecting them at rest is an important security consideration. S3 can use server-side encryption with AWS managed or customer managed KMS keys depending on the organization’s requirements. Access to the bucket and encryption key should also be restricted through appropriate IAM and bucket policies. Combining encryption with least-privilege access helps ensure that pipeline artifacts remain protected throughout the CI/CD process.

Question 184. What improves artifact recovery in S3?

1. S3 versioning
   2. Route 53
   3. CloudTrail
   4. IAM Access Analyzer

Correct Answer: 1. S3 versioning

Explanation:

Amazon S3 Versioning maintains multiple versions of objects stored in a bucket. When pipeline artifacts are stored in S3, versioning can help preserve previous object versions instead of permanently replacing them when an object changes. This can provide additional protection against accidental deletion or overwriting and can support recovery scenarios. Versioning is different from encryption because encryption protects the confidentiality of stored data while versioning helps preserve object history. Organizations should still configure lifecycle policies when appropriate because retaining many object versions indefinitely can increase storage usage and associated costs.

Question 185. What replicates S3 objects to another Region?

1. S3 Cross-Region Replication
   2. CodeDeploy
   3. Systems Manager Inventory
   4. CloudFormation Drift Detection

Correct Answer: 1. S3 Cross-Region Replication

Explanation:

Amazon S3 Cross-Region Replication can automatically replicate eligible objects from a source bucket to a destination bucket in another AWS Region. This can improve resilience and provide a copy of important data outside the source Region. In DevOps environments, replication can be useful for protecting deployment artifacts, backups, and other important objects when a multi-Region strategy is required. Replication requires appropriate bucket configuration, permissions, and supported replication rules. It should be considered alongside versioning, encryption, lifecycle policies, and recovery procedures to create a complete artifact protection strategy.

Question 186. What can CodeBuild reuse to speed builds?

1. CloudTrail trails
   2. Build cache
   3. IAM policies
   4. ECS clusters

Correct Answer: 2. Build cache

Explanation:

CodeBuild caching can reduce build times by allowing commonly reused dependencies or files to be retained between builds. Without caching, a build may need to download the same dependencies repeatedly, increasing build duration and network activity. Depending on the project configuration, CodeBuild can use supported cache storage options to retain reusable build information. Effective caching is especially valuable for projects with large dependency trees or frequent builds. However, cache configuration should be designed carefully because stale cached content can sometimes cause unexpected build behavior. Build processes should remain reproducible even when caching is enabled.

Question 187. What allows CodeBuild to build Docker images?

1. Privileged mode
   2. CloudFormation StackSets
   3. IAM Access Analyzer
   4. EventBridge archive

Correct Answer: 1. Privileged mode

Explanation:

CodeBuild can use privileged mode when a build needs to perform operations that require elevated container capabilities, such as building Docker images in the build environment. This capability is commonly used in CI/CD pipelines that compile application code into container images and then push those images to Amazon ECR. Because privileged mode provides additional capabilities to the build environment, it should be enabled only when required. The build role should also have narrowly scoped permissions for accessing the container registry and other AWS resources. Properly configured, this enables container image creation as part of an automated build process.

Question 188. What reports CodeBuild test execution results?

1. Report groups
   2. ECR repositories
   3. IAM boundaries
   4. S3 replication rules

Correct Answer: 1. Report groups

Explanation:

CodeBuild report groups organize test reports generated during build execution. A build can run unit tests, integration tests, or other supported automated tests and produce results in supported formats. CodeBuild can associate those results with a report group so that teams can review test outcomes separately from ordinary build artifacts. Integrating reports into CI/CD provides visibility into whether application changes meet defined quality requirements before deployment. Test reporting can also be incorporated into pipeline quality gates, allowing failed validation to prevent an application from progressing toward production.

Question 189. What stores container images for ECS deployments?

1. Amazon ECR
   2. AWS Config
   3. CloudTrail
   4. Systems Manager

Correct Answer: 1. Amazon ECR

Explanation:

Amazon Elastic Container Registry is a managed container registry that stores and manages Docker and OCI-compatible container images. ECS services can retrieve images from ECR when launching tasks, making ECR a common component of container-based CI/CD workflows. A typical pipeline may build an image with CodeBuild, push it to ECR, update an ECS task definition with the desired image, and deploy the new revision. ECR also provides features such as image scanning, lifecycle policies, repository permissions, and replication. These capabilities help organizations manage container images throughout their application delivery lifecycle.

Question 190. What removes old ECR images automatically?

1. IAM policy
   2. ECR lifecycle policy
   3. CloudWatch dashboard
   4. CodePipeline approval

Correct Answer: 2. ECR lifecycle policy

Explanation:

Amazon ECR lifecycle policies can automatically remove images that meet specified criteria. Organizations commonly use lifecycle policies to retain a suitable number of recent images while deleting older or unnecessary images. This helps control registry storage usage and reduces the accumulation of obsolete build artifacts. Rules can be based on image tags, image age, or the number of images retained depending on the supported configuration. Lifecycle policies should be designed carefully so that images still required for rollback or production deployments are not removed prematurely. Combining lifecycle management with clear image-tagging practices improves repository maintenance.

Question 191. What identifies a specific ECS task definition revision?

1. Revision number
   2. CloudWatch alarm
   3. S3 version ID
   4. IAM policy

Correct Answer: 1. Revision number

Explanation:

Amazon ECS task definitions are versioned through revisions. Each time a task definition is registered with changes, ECS creates a new revision that can be referenced by services and deployments. A revision can define settings such as container images, CPU and memory requirements, environment variables, ports, logging, and other task configuration. Versioning task definitions is important for controlled deployments because a service can be associated with a specific revision rather than an undefined configuration. If a deployment needs to be reversed, a previous task definition revision can be used to restore the earlier application configuration.

Question 192. What changes the number of ECS tasks automatically?

1. ECS Service Auto Scaling
   2. CodeArtifact
   3. CloudTrail validation
   4. CloudFormation drift detection

Correct Answer: 1. ECS Service Auto Scaling

Explanation:

ECS Service Auto Scaling automatically adjusts the desired number of tasks for an ECS service according to configured scaling policies. It can respond to workload indicators such as CPU utilization, memory utilization, or other supported metrics. When demand increases, additional tasks can be launched, while lower demand can allow the service to reduce task count within its configured limits. This helps maintain application capacity without requiring manual intervention. DevOps teams should establish appropriate minimum and maximum task counts and select metrics that accurately represent workload demand. Poorly selected scaling thresholds can result in unnecessary scaling or insufficient capacity.

Question 193. What protects an ECS service during deployment?

1. Minimum healthy percentage
   2. ECR tag
   3. IAM user
   4. CloudTrail trail

Correct Answer: 1. Minimum healthy percentage

Explanation:

The ECS minimum healthy percentage determines the minimum proportion of the service’s desired task count that should remain healthy during a rolling deployment. This setting helps control how aggressively existing tasks can be stopped while replacement tasks are being launched. Maintaining an appropriate minimum percentage can help preserve application availability during deployments. The actual behavior also depends on the service deployment controller and other configuration settings. A higher minimum healthy percentage generally places greater emphasis on maintaining running capacity during the transition, while a lower value may allow more aggressive replacement and potentially faster deployments.

Question 194. What allows extra ECS tasks during deployment?

1. Maximum percentage
   2. CloudTrail validation
   3. CodeArtifact upstream
   4. IAM permission boundary

Correct Answer: 1. Maximum percentage

Explanation:

The ECS deployment maximum percentage controls how much additional task capacity can be running during a rolling deployment relative to the service’s desired task count. Allowing additional tasks gives ECS room to launch replacement tasks before stopping older tasks, which can help maintain availability and accelerate deployments. However, temporarily running more tasks requires additional compute capacity and may increase resource usage. This setting should therefore be selected according to the application’s availability requirements and the available cluster or capacity-provider resources. Together, minimum healthy and maximum percentages determine the deployment’s replacement behavior.

Question 195. What can automatically stop a CodeDeploy rollout after a metric breach?

1. CloudWatch alarm
   2. S3 bucket
   3. ECR repository
   4. IAM group

Correct Answer: 1. CloudWatch alarm

Explanation:

CloudWatch alarms can be integrated with CodeDeploy to monitor application or infrastructure metrics during a deployment. If a configured alarm enters an alarm state, CodeDeploy can respond according to the deployment’s alarm configuration, potentially stopping the deployment and supporting rollback behavior. This allows deployment decisions to be based on actual application health rather than simply whether deployment commands completed successfully. Metrics such as error rates, latency, or unhealthy targets can provide useful indicators. Effective deployment monitoring requires alarms with appropriate thresholds and evaluation periods so that real failures are detected without reacting excessively to normal temporary fluctuations.

Question 196. What validates an application after deployment?

1. CodeDeploy lifecycle hook
   2. ECR lifecycle policy
   3. IAM permission boundary
   4. S3 replication

Correct Answer: 1. CodeDeploy lifecycle hook

Explanation:

CodeDeploy lifecycle hooks provide controlled points during a deployment where custom validation or operational scripts can execute. A hook such as ValidateService can be used after application startup to verify that the deployed application is responding correctly. Validation can include checking an endpoint, confirming a process is running, testing a service dependency, or performing other application-specific checks. This is valuable because successful file installation does not necessarily mean that the application is healthy. Lifecycle validation can prevent an unhealthy revision from being considered successful and can work with deployment failure or rollback mechanisms.

Question 197. What securely provides credentials to EC2 applications?

1. IAM role
   2. Hard-coded access key
   3. Public S3 object
   4. CloudWatch dashboard

Correct Answer: 1. IAM role

Explanation:

An IAM role can provide temporary AWS credentials to applications running on Amazon EC2 through an attached instance profile. This approach avoids embedding long-term access keys in application source code or configuration files. The EC2 instance can obtain temporary credentials and use them to call authorized AWS APIs. Permissions attached to the role should follow least-privilege principles so the application receives only the access it requires. This pattern is widely used in DevOps environments because automated applications often need to access services such as S3, Secrets Manager, Systems Manager, or other AWS resources without managing permanent credentials manually.

Question 198. What distributes a Lambda alias between two versions?

1. Weighted routing
   2. CloudFormation drift detection
   3. ECR scanning
   4. IAM boundary

Correct Answer: 1. Weighted routing

Explanation:

Lambda alias weighted routing allows an alias to distribute invocations between two Lambda function versions according to configured weights. This capability supports gradual deployments by allowing a controlled percentage of requests to reach the new version while the remainder continues using the existing version. Monitoring can then determine whether the new version behaves correctly before traffic is increased. If problems occur, the traffic allocation can be adjusted back toward the previous version. Weighted routing is therefore useful for reducing deployment risk and implementing canary-style release strategies for serverless applications.

Question 199. What prevents a CloudFormation stack from accidental deletion?

1. Termination protection
   2. CodeBuild cache
   3. EventBridge rule
   4. ECR repository policy

Correct Answer: 1. Termination protection

Explanation:

CloudFormation termination protection helps prevent accidental deletion of an entire stack. When enabled, CloudFormation blocks deletion attempts until termination protection is disabled. This can provide an additional safeguard for production stacks and other environments containing important infrastructure. Termination protection does not prevent all resource modifications, nor does it replace IAM permissions or stack policies. It specifically addresses stack deletion. Organizations can combine termination protection with change sets, stack policies, IAM controls, and deployment reviews to create multiple safeguards around critical infrastructure. These controls are particularly valuable when infrastructure changes are automated through CI/CD pipelines.

Question 200. What provides centralized multi-account CloudFormation deployments?

1. CloudFormation StackSets
   2. CodeBuild report groups
   3. ECR lifecycle policies
   4. CloudWatch Logs

Correct Answer: 1. CloudFormation StackSets

Explanation:

AWS CloudFormation StackSets provides centralized management of CloudFormation stacks across multiple AWS accounts and Regions. Instead of manually deploying the same template separately into every environment, administrators can define a StackSet and specify the accounts and Regions that should receive stack instances. StackSets also provide controls for how operations are executed, including deployment preferences and failure behavior. This is particularly useful for organizations managing standardized infrastructure such as logging, security configurations, IAM-related resources, or common operational components across many accounts. Centralized StackSet management improves consistency and reduces repetitive infrastructure deployment tasks.