View Full Amazon AWS Certified DevOps Engineer – Professional DOP-C02 Exam Dumps and Practice Test Dumps

 

Question 221. What does an EventBridge dead-letter queue store?

1. Successful events
   2. Failed event deliveries
   3. CloudFormation templates
   4. Docker layers

Correct Answer: 2. Failed event deliveries

Explanation:

An Amazon EventBridge dead-letter queue, or DLQ, provides a destination for events that could not be successfully delivered to their configured targets after EventBridge has completed its retry attempts. The DLQ is commonly implemented with Amazon SQS, allowing operations teams to retain failed events for later investigation and possible reprocessing. This is useful because an event should not simply disappear when a target is temporarily unavailable, misconfigured, or unable to process the request. Teams can monitor the DLQ and investigate the reason for failures. Combining EventBridge retry policies with a DLQ provides stronger resilience for event-driven CI/CD and operational automation workflows.

Question 222. Which CloudWatch feature combines multiple alarms into one status?

1. Metric filter
   2. Log group
   3. Composite alarm
   4. Dashboard widget

Correct Answer: 3. Composite alarm

Explanation:

Amazon CloudWatch composite alarms combine the states of multiple individual alarms into a single higher-level alarm state. Instead of triggering an operational action based on one metric alone, a composite alarm can evaluate logical relationships between several alarms. For example, a deployment monitoring design could require both an increased error rate and reduced healthy capacity before considering the application unhealthy. This can reduce unnecessary notifications caused by isolated metric fluctuations. Composite alarms are especially useful for complex monitoring and automated deployment rollback scenarios because they allow teams to create higher-level conditions from existing alarms without modifying the underlying application metrics.

Question 223. What can CloudWatch Synthetics canaries test?

1. User-facing application workflows
   2. IAM policy documents only
   3. ECR image tags only
   4. CloudFormation parameters only

Correct Answer: 1. User-facing application workflows

Explanation:

CloudWatch Synthetics canaries run automated scripts on a schedule to check application endpoints and important user workflows. They can test whether an application is reachable, whether an API returns expected results, or whether a multi-step interaction behaves correctly. This provides active monitoring rather than waiting for real users to report a problem. Synthetics canaries can be particularly useful after deployments because they can validate application behavior from an external perspective. When integrated with CloudWatch alarms, their results can also contribute to automated operational responses. This makes canaries valuable for detecting availability or functional problems that ordinary infrastructure metrics might not reveal.

Question 224. What does a CloudWatch Logs subscription filter do?

1. Deletes old log groups
   2. Encrypts every EC2 volume
   3. Changes IAM permissions
   4. Sends matching log events to a destination

Correct Answer: 4. Sends matching log events to a destination

Explanation:

A CloudWatch Logs subscription filter identifies log events that match specified patterns and delivers those matching events to a configured destination. Depending on the architecture, destinations can include services such as Amazon Kinesis Data Streams, Amazon Data Firehose, or AWS Lambda. This allows logs to be processed or analyzed continuously rather than requiring administrators to manually retrieve log files. Subscription filters are useful for centralized logging, security monitoring, real-time analytics, and automated operational workflows. For example, a filter could identify application errors and forward matching events to another service for analysis. Proper filtering also helps avoid unnecessarily transmitting large volumes of unrelated log data.

Question 225. Why use an AWS Config conformance pack?

1. To build Docker images
   2. To package related compliance rules and remediation actions
   3. To deploy Lambda layers
   4. To increase ECS task count

Correct Answer: 2. To package related compliance rules and remediation actions

Explanation:

AWS Config conformance packs provide a structured way to package collections of AWS Config rules and, where applicable, remediation actions into a reusable configuration package. They are useful when organizations need to apply a consistent set of compliance or operational requirements across accounts or environments. Instead of configuring every rule individually, administrators can define a collection that represents a particular standard or organizational control set. Conformance packs can help standardize governance and simplify deployment of configuration controls. In DevOps environments, they can also be integrated with automated remediation workflows so that detected configuration problems are handled consistently rather than relying entirely on manual investigation.

Question 226. What does an AWS Config advanced query provide?

1. SQL-like queries across configuration data
   2. Docker image compilation
   3. Lambda concurrency reservations
   4. CodeBuild caching

Correct Answer: 1. SQL-like queries across configuration data

Explanation:

AWS Config advanced queries allow administrators to query resource configuration and compliance-related information using a SQL-like query language. This makes it easier to inspect configuration data across many AWS resources without manually opening individual resource pages. For example, teams can query resources based on resource type, configuration attributes, or other available fields to identify resources that meet particular conditions. Advanced queries can support operational audits, inventory reporting, governance investigations, and troubleshooting. They are especially valuable in environments with many accounts or resources because they provide a centralized way to answer configuration questions using structured data rather than inspecting resources individually.

Question 227. What is the purpose of an AWS Config aggregator?

1. To compile CodeBuild reports
   2. To replicate ECR images
   3. To collect configuration data from multiple accounts or Regions
   4. To create IAM users

Correct Answer: 3. To collect configuration data from multiple accounts or Regions

Explanation:

An AWS Config aggregator provides a centralized view of configuration and compliance information collected from multiple AWS accounts and Regions. This is particularly useful for organizations operating at scale where reviewing each account separately would be inefficient. A central security or operations team can use an aggregator to examine configuration information across the organization and identify resources or compliance conditions that require attention. The aggregator does not replace the individual AWS Config recorders in the source accounts. Instead, it provides a consolidated querying and monitoring capability. This supports centralized governance, auditing, inventory management, and operational visibility across distributed AWS environments.

Question 228. Which IAM feature restricts permissions granted by another policy?

1. Permission boundary
   2. Access key
   3. Security group
   4. Route table

Correct Answer: 1. Permission boundary

Explanation:

An IAM permissions boundary establishes the maximum permissions that an IAM principal can receive through its identity-based policies. It does not directly grant permissions by itself. Instead, it acts as a boundary that limits the effective permissions available to the user or role. This is useful when organizations delegate IAM administration or allow teams to create roles while still preventing those roles from exceeding predefined permission limits. Effective permissions are determined by the interaction of identity-based policies, resource policies, permissions boundaries, service control policies, and other applicable controls. Permissions boundaries therefore provide an important mechanism for implementing controlled delegation and reducing excessive privilege.

Question 229. What does IAM Access Analyzer help identify?

1. Slow Docker builds
   2. Unused ECR layers
   3. CloudFormation syntax errors
   4. Resources that may be accessible externally

Correct Answer: 4. Resources that may be accessible externally

Explanation:

IAM Access Analyzer helps identify resources that are accessible from outside an AWS account or organization when resource-based policies allow such access. It can analyze policies for supported AWS resources and identify external access paths that may create unintended exposure. This is useful for security teams because resource policies can sometimes grant access more broadly than intended. Access Analyzer findings can help administrators review permissions and determine whether external access is expected or should be removed. It is not a replacement for general IAM policy analysis, but it provides valuable visibility into resource-based access relationships and supports least-privilege security practices.

Question 230. What is IAM role chaining?

1. Using one assumed role to assume another role
   2. Encrypting two KMS keys together
   3. Linking two CloudFormation stacks
   4. Replicating two ECR repositories

Correct Answer: 1. Using one assumed role to assume another role

Explanation:

IAM role chaining occurs when temporary credentials obtained by assuming one IAM role are used to assume another IAM role. This can be useful in multi-account environments where an initial identity assumes an intermediate role and then accesses another account through a second role. However, role chaining introduces additional credential and session-management considerations, including limitations on session duration for chained role assumptions. DevOps automation should therefore use role chaining only when the architecture requires it and should keep trust policies and permissions tightly scoped. Cross-account CI/CD designs should also ensure that every trust relationship is intentional and that temporary credentials are handled securely.

Question 231. What does a KMS key policy primarily control?

1. ECS task placement
   2. Access to use or manage a KMS key
   3. CodeBuild compute size
   4. CloudWatch log retention

Correct Answer: 2. Access to use or manage a KMS key

Explanation:

An AWS KMS key policy is a primary authorization mechanism that controls who can use or manage a KMS key. Unlike many AWS resources, KMS key policies play a central role in determining permissions for cryptographic operations and key administration. A key policy can allow specific IAM principals or AWS services to perform actions such as encrypting, decrypting, generating data keys, or managing key configuration. IAM policies can also participate in authorization when the key policy permits the relevant access model. Carefully designed KMS policies are essential for protecting encrypted CI/CD artifacts, secrets, logs, databases, and other sensitive resources without granting broader cryptographic permissions than required.

Question 232. What is a KMS grant useful for?

1. Defining ECS health checks
   2. Creating CloudFormation outputs
   3. Providing controlled, temporary or delegated key permissions
   4. Managing Route 53 records

Correct Answer: 3. Providing controlled, temporary or delegated key permissions

Explanation:

AWS KMS grants provide a mechanism for delegating specific permissions to AWS principals or services for a KMS key without requiring the key policy to be modified for every individual authorization scenario. Grants are useful when AWS services need permission to use a customer-managed key on behalf of an application or when controlled delegation is required. They can specify particular operations that the grantee is allowed to perform. Grants are distinct from ordinary IAM permissions and key policies and are designed to support fine-grained authorization for cryptographic operations. Proper grant management helps organizations provide only the key capabilities that a service or workload actually requires.

Question 233. What does Secrets Manager rotation automate?

1. Changing secret credentials periodically
   2. Rebuilding EC2 AMIs
   3. Increasing ECS task capacity
   4. Creating CloudFormation stacks

Correct Answer: 1. Changing secret credentials periodically

Explanation:

AWS Secrets Manager rotation automates the process of periodically changing sensitive credentials stored in Secrets Manager. Depending on the secret type and configuration, rotation can update credentials in the relevant service while also updating the stored secret value. This reduces the need for administrators or applications to manage long-lived passwords manually. Automated rotation can help reduce the security risk associated with credentials remaining unchanged for long periods. Applications should retrieve secrets dynamically rather than embedding credentials in source code or configuration files. Rotation workflows must also be designed carefully so that applications and dependent services continue using valid credentials during the transition.

Question 234. Which Parameter Store feature supports encrypted sensitive values?

1. StringList
   2. SecureString
   3. PlainTextOnly
   4. EncryptedList

Correct Answer: 2. SecureString

Explanation:

AWS Systems Manager Parameter Store supports the SecureString parameter type for storing sensitive values in encrypted form. SecureString parameters use AWS KMS for encryption, allowing organizations to protect credentials, tokens, configuration secrets, and other sensitive values. Access to these parameters should be controlled with IAM permissions, and applications should retrieve them only when necessary. SecureString is different from ordinary String parameters, which are not intended to provide the same encryption protection for sensitive data. Parameter Store can therefore provide a centralized configuration mechanism while allowing security-sensitive values to be protected with AWS KMS and controlled through IAM.

Question 235. Why use Parameter Store parameter hierarchies?

1. To organize parameters by path
   2. To create EC2 security groups
   3. To replace CloudTrail
   4. To replicate Lambda functions

Correct Answer: 1. To organize parameters by path

Explanation:

Parameter Store hierarchies allow parameters to be organized using structured paths, such as /production/application/database/password or /development/application/api/url. This makes configuration management easier when an application has many parameters across multiple environments or components. IAM policies can also use parameter paths to provide controlled access to groups of related parameters. Hierarchical organization supports clearer naming conventions, easier retrieval, and better separation between environments. When combined with SecureString parameters, KMS encryption, and appropriate IAM permissions, parameter hierarchies can provide a practical way to manage centralized application configuration while reducing the need to hard-code environment-specific values into deployment scripts or application code.

Question 236. What does S3 versioning provide for pipeline artifact buckets?

1. Automatic ECS scaling
   2. Multiple recoverable versions of objects
   3. IAM role creation
   4. Lambda concurrency

Correct Answer: 2. Multiple recoverable versions of objects

Explanation:

Amazon S3 versioning maintains multiple versions of objects stored in a bucket. For CI/CD artifact buckets, this can provide additional protection against accidental overwrites or deletions and can make it possible to identify or recover earlier versions of important objects. Versioning does not by itself guarantee that an artifact is trustworthy, so access controls, encryption, lifecycle policies, and other security mechanisms should also be applied. Versioned artifact storage can be particularly useful when pipeline data must be retained for auditing or troubleshooting. Organizations should also consider storage costs and lifecycle rules because retaining many versions indefinitely can increase the amount of stored data.

Question 237. Which deployment approach sends traffic gradually to a new version?

1. All-at-once deployment
   2. Immutable storage
   3. Canary deployment
   4. Manual backup

Correct Answer: 3. Canary deployment

Explanation:

A canary deployment gradually introduces a new application version to a limited portion of traffic or infrastructure before expanding the rollout. The initial group acts as an early validation population where teams can monitor metrics such as errors, latency, health checks, and application behavior. If the new version performs as expected, traffic can be increased according to the deployment strategy. If problems occur, the rollout can be stopped or rolled back before the entire user population is affected. Canary deployments are therefore useful for reducing deployment risk and combining controlled traffic shifting with automated monitoring and rollback mechanisms in production environments.

Question 238. What is immutable infrastructure?

1. Infrastructure modified manually after every release
   2. Infrastructure that cannot use automation
   3. Infrastructure recreated instead of modified in place
   4. Infrastructure without monitoring

Correct Answer: 3. Infrastructure recreated instead of modified in place

Explanation:

Immutable infrastructure is an operational approach in which existing infrastructure instances are not modified directly after deployment. When a change is required, a new version of the infrastructure or application environment is created and then deployed, while the old version is eventually removed. This reduces configuration drift because servers are not repeatedly changed through manual procedures over their lifetime. Immutable approaches work well with infrastructure as code, automated image creation, CI/CD pipelines, and blue/green deployments. They can also make deployments more predictable because each new environment starts from a known configuration. However, teams must design appropriate replacement, health-check, rollback, and state-management processes.

Question 239. Why are deployment health checks important in CI/CD?

1. They validate application readiness during deployment
   2. They create IAM users
   3. They encrypt S3 objects automatically
   4. They modify Docker tags

Correct Answer: 1. They validate application readiness during deployment

Explanation:

Deployment health checks provide automated evidence that a newly deployed application or service is operating correctly before the rollout proceeds. Depending on the architecture, health checks may verify application endpoints, container health, load balancer target health, service availability, or other operational indicators. They are especially important when deployments use automated traffic shifting because the pipeline needs reliable signals to determine whether the new version should receive additional traffic. Combining health checks with CloudWatch alarms, deployment controllers, and rollback mechanisms can create a safer automated deployment process. Without meaningful validation, a pipeline might mark a technically successful deployment as successful even though the application is not actually ready for users.

Question 240. What is a key benefit of automated deployment rollback?

1. It removes all monitoring requirements
   2. It reduces recovery time after detected deployment failures
   3. It prevents every application defect
   4. It eliminates the need for testing

Correct Answer: 2. It reduces recovery time after detected deployment failures

Explanation:

Automated rollback allows a deployment system to return an application or infrastructure environment to a previously known-good version when defined failure conditions are detected. These conditions can be based on CloudWatch alarms, health checks, deployment failures, application errors, or other operational signals. The main benefit is faster recovery because the system does not need to wait for an engineer to manually identify the problem and initiate a rollback. Automated rollback does not prevent defects from being introduced, so it should be combined with testing, monitoring, validation, and controlled deployment strategies. A well-designed