View Full Amazon AWS Certified DevOps Engineer – Professional DOP-C02 Exam Dumps and Practice Test Dumps

 

Question 141. What gradually shifts Lambda traffic between versions?

1. Weighted aliases
   2. CloudFormation Hooks
   3. S3 lifecycle rules
   4. IAM groups

Correct Answer: 1. Weighted aliases

Explanation:

AWS Lambda aliases can be configured with weighted routing to distribute invocation traffic between two published function versions. This capability is useful when implementing gradual deployments because only a portion of requests can initially reach the new version. For example, a deployment can direct most traffic to the existing version while sending a smaller percentage to the new version for validation. If monitoring shows that the new version is healthy, the traffic distribution can be adjusted. This approach supports controlled releases and can reduce the impact of problems introduced by a newly deployed Lambda version.

Question 142. What identifies a specific published Lambda version?

1. Security group
   2. Version number
   3. CloudWatch dashboard
   4. S3 prefix

Correct Answer: 2. Version number

Explanation:

A published AWS Lambda function version provides an immutable snapshot of the function code and configuration at the time the version is created. Each published version receives a unique version number, allowing deployments to reference a specific application state rather than relying on the mutable $LATEST version. Lambda aliases can point to published versions and can be moved between versions during deployments. This separation is useful for release management because production traffic can remain associated with a known version while a newer version is tested independently. It also supports safer rollback when a previous version needs to receive traffic again.

Question 143. What controls Lambda deployment traffic shifting?

1. Deployment preference
   2. ECR lifecycle policy
   3. S3 replication
   4. IAM group

Correct Answer: 1. Deployment preference

Explanation:

Lambda deployment preferences define how traffic is shifted from an existing Lambda version to a newly deployed version when using deployment automation such as AWS SAM or CodeDeploy. Different strategies can gradually move traffic in stages or shift all traffic at once. Gradual strategies provide an opportunity to monitor the new version before it receives all production requests. Deployment preferences can also work with CloudWatch alarms so that an unhealthy deployment can be detected and stopped or rolled back. This makes traffic-shifting strategies an important part of controlled serverless application releases.

Question 144. What can trigger a Lambda deployment rollback?

1. S3 versioning
   2. CloudWatch alarms
   3. Route 53 records
   4. CodeArtifact repositories

Correct Answer: 2. CloudWatch alarms

Explanation:

CloudWatch alarms can monitor application metrics during a Lambda deployment and help detect problems with a newly released version. When a deployment strategy is configured to use alarms, conditions such as elevated error rates can cause the deployment system to stop the rollout or initiate rollback behavior. This creates an automated feedback mechanism between application health and deployment control. Rather than relying solely on a person to detect an issue, the deployment can respond to predefined operational thresholds. Proper alarm selection is important because the monitored metrics should accurately reflect whether the new Lambda version is functioning correctly.

Question 145. What does an AppConfig deployment strategy control?

1. Configuration rollout
   2. EC2 instance termination
   3. ECR image deletion
   4. IAM password expiration

Correct Answer: 1. Configuration rollout

Explanation:

AWS AppConfig deployment strategies control how configuration changes are gradually released to applications. Instead of immediately exposing every application instance to a new configuration, an organization can define how quickly the configuration should be distributed and how long the rollout should take. This can reduce the impact of configuration errors and provide time to monitor application behavior during the rollout. AppConfig supports controlled configuration delivery independently of application code deployment. This is particularly useful for feature flags, operational parameters, and other settings that may need to be changed frequently without rebuilding and redeploying the entire application.

Question 146. What can AppConfig use to validate configuration data?

1. Validators
   2. Deployment groups
   3. ECR tags
   4. CloudTrail trails

Correct Answer: 1. Validators

Explanation:

AWS AppConfig validators can check configuration data before it is deployed to applications. Validators can help confirm that a configuration follows an expected schema or satisfies application-specific requirements. By validating configuration before rollout, organizations can prevent malformed or incompatible values from reaching production workloads. This is especially valuable when configuration changes are made frequently or by different teams. Validation is an important part of safe configuration management because a syntactically valid value may still be inappropriate for an application. Combining validators with gradual deployment strategies provides multiple controls for reducing configuration-related failures.

Question 147. What can automatically reverse an unhealthy AppConfig deployment?

1. Deployment alarm
   2. ECR repository
   3. CodeArtifact domain
   4. IAM group

Correct Answer: 1. Deployment alarm

Explanation:

AWS AppConfig can integrate deployment monitoring with Amazon CloudWatch alarms to help detect problems during configuration rollouts. If a configured alarm enters an unhealthy state while a configuration is being deployed, AppConfig can use the deployment monitoring configuration to stop or roll back the deployment. This is useful when configuration changes affect application metrics such as error rates, latency, or availability. Automated rollback reduces the time between detecting a configuration problem and restoring the previous configuration. Organizations should select meaningful application-level metrics and configure appropriate alarm thresholds so that normal temporary variations do not cause unnecessary rollbacks.

Question 148. What pauses CloudFormation until a required signal is received?

1. Wait condition
   2. Stack policy
   3. Change set
   4. Drift detection

Correct Answer: 1. Wait condition

Explanation:

CloudFormation wait conditions can pause part of stack creation until a specified condition is satisfied, commonly through a signal from a resource or process. This can be useful when CloudFormation needs to wait for an external or asynchronous operation before continuing. The signal can indicate that an initialization or configuration task has completed successfully. Wait conditions should be configured carefully with appropriate timeout behavior because a missing signal can cause the stack operation to fail. They are different from ordinary resource dependencies because they allow CloudFormation to wait for an explicit external signal rather than simply waiting for another declared resource relationship.

Question 149. What controls updates allowed on protected CloudFormation resources?

1. Stack policy
   2. Buildspec
   3. ECR scan
   4. CodeArtifact policy

Correct Answer: 1. Stack policy

Explanation:

A CloudFormation stack policy can help protect selected resources from unintended updates during stack operations. The policy defines which update actions are allowed or denied for specific resources. This is useful for critical resources that should not be modified casually through an infrastructure update. A stack policy is different from termination protection: termination protection helps prevent deletion of the entire stack, while a stack policy focuses on controlling updates to resources within the stack. Organizations can use stack policies as an additional safeguard when managing important infrastructure through automated CloudFormation deployments.

Question 150. What detects manual changes to CloudFormation resources?

1. StackSets
   2. Drift detection
   3. CodeDeploy
   4. CodeArtifact

Correct Answer: 2. Drift detection

Explanation:

CloudFormation drift detection compares the current configuration of supported resources with the configuration that CloudFormation expects based on the stack template and recorded state. If a resource has been changed outside CloudFormation, the resource may be identified as having drifted from the expected configuration. This capability is useful in infrastructure-as-code environments because manual modifications can create differences between the declared infrastructure and the actual environment. Detecting drift does not automatically correct the resource. Administrators can investigate the difference and determine whether the template or the resource should be updated to restore the desired state.

Question 151. Which Systems Manager feature runs commands on managed instances?

1. Run Command
   2. Patch Manager
   3. Inventory
   4. Maintenance Windows

Correct Answer: 1. Run Command

Explanation:

AWS Systems Manager Run Command allows administrators and automation systems to execute commands on managed instances without requiring direct interactive access to those machines. Commands can be targeted to specific instances or groups of instances using identifiers or tags. This capability is useful for administrative tasks such as installing software, changing configuration, collecting information, or running operational scripts. Because execution is managed through Systems Manager, organizations can control access through IAM permissions and maintain command execution records. Run Command is therefore a useful component for automating operational tasks across fleets of managed servers.

Question 152. What schedules recurring Systems Manager maintenance tasks?

1. Maintenance Windows
   2. CloudFormation Hooks
   3. ECR repositories
   4. CodeArtifact domains

Correct Answer: 1. Maintenance Windows

Explanation:

Systems Manager Maintenance Windows allow organizations to define scheduled periods during which operational tasks can be performed on managed resources. Tasks can include patching, running commands, invoking automation workflows, or performing other supported maintenance operations. Scheduling maintenance activities within defined windows helps reduce the chance of disruptive changes occurring during critical business periods. Maintenance Windows can also define targets and task priorities so that the work is performed in a controlled manner. This makes them useful for routine operations such as patch installation, system updates, configuration changes, and other scheduled maintenance activities.

Question 153. What collects software information from managed instances?

1. Systems Manager Inventory
   2. CodePipeline
   3. CloudFormation
   4. CodeDeploy

Correct Answer: 1. Systems Manager Inventory

Explanation:

Systems Manager Inventory collects information about managed instances and their installed software, configurations, and other supported metadata. Organizations can use this information to understand what software and configurations exist across their fleet. Inventory data can support operational processes such as patch management, compliance reviews, troubleshooting, and asset visibility. Rather than manually connecting to each server, administrators can use centralized Systems Manager capabilities to gather information across many managed instances. This is particularly useful in larger environments where manually maintaining an accurate inventory would be difficult and error-prone.

Question 154. What defines the events that EventBridge should match?

1. Event pattern
   2. IAM boundary
   3. Buildspec
   4. Deployment group

Correct Answer: 1. Event pattern

Explanation:

Amazon EventBridge event patterns define the characteristics of events that a rule should match. A pattern can filter events based on fields such as event source, detail type, account, Region, and other event attributes. When an incoming event matches the configured pattern, the EventBridge rule can invoke one or more targets. This enables event-driven automation without requiring applications to continuously poll for changes. For example, a rule can respond to a particular AWS service event and trigger a Lambda function, Systems Manager automation, Step Functions workflow, or another supported target.

Question 155. What can EventBridge use when target delivery repeatedly fails?

1. Dead-letter queue
   2. ECR repository
   3. CloudFormation template
   4. CodeArtifact repository

Correct Answer: 1. Dead-letter queue

Explanation:

Amazon EventBridge can use a dead-letter queue to retain events that could not be successfully delivered to a configured target after the available retry attempts. This provides an additional recovery mechanism because failed events are not simply lost when target invocation repeatedly fails. The dead-letter queue can be an Amazon SQS queue, allowing operations teams to inspect or process the failed events later. EventBridge also supports retry behavior for target delivery. Combining retries with a dead-letter queue provides greater resilience for event-driven workflows where temporary or persistent target failures can occur.

Question 156. What displays multiple CloudWatch metrics together?

1. CloudWatch dashboard
   2. CodeDeploy deployment group
   3. ECR repository
   4. IAM policy

Correct Answer: 1. CloudWatch dashboard

Explanation:

Amazon CloudWatch dashboards allow multiple metrics and monitoring visualizations to be displayed together in a customized view. Teams can use dashboards to monitor application performance, infrastructure utilization, deployment health, and operational indicators from a centralized location. A dashboard can include metrics from different AWS resources and services, making it useful for understanding the overall health of an application environment. During deployments, teams may use dashboards to observe error rates, latency, CPU utilization, request counts, and other indicators while a new release is being introduced.

Question 157. What turns matching log entries into CloudWatch metrics?

1. Metric filter
   2. Deployment preference
   3. Stack policy
   4. IAM role

Correct Answer: 1. Metric filter

Explanation:

CloudWatch Logs metric filters can search log events for defined patterns and publish matching occurrences as CloudWatch metrics. This allows information that exists only in application logs to become measurable and usable with other CloudWatch capabilities. For example, a metric filter can count occurrences of a specific error message and publish that count as a metric. The resulting metric can then be displayed on dashboards or used with alarms. This is useful when an application does not already publish a dedicated metric for an operational condition that needs to be monitored.

Question 158. What controls how long CloudWatch Logs are retained?

1. Log retention setting
   2. IAM permission boundary
   3. ECR tag
   4. CodePipeline action

Correct Answer: 1. Log retention setting

Explanation:

CloudWatch Logs log groups have configurable retention settings that determine how long log events are retained before they are automatically deleted. Organizations can choose an appropriate retention period based on operational requirements, troubleshooting needs, compliance considerations, and storage costs. Without an appropriate retention configuration, logs may remain available longer than necessary and increase storage usage. Different log groups can use different retention periods depending on their purpose. For example, short-lived development logs may require less retention than production application logs used for operational investigation or auditing.

Question 159. What helps verify CloudTrail log file integrity?

1. Log file validation
   2. CodeBuild reports
   3. ECR scanning
   4. ECS desired count

Correct Answer: 1. Log file validation

Explanation:

AWS CloudTrail log file validation helps determine whether CloudTrail log files have been modified or deleted after delivery. It uses digital validation mechanisms that allow organizations to verify the integrity of log files stored for auditing purposes. This can be important when CloudTrail records are used for security investigations, operational reviews, or compliance evidence. Enabling log file validation does not prevent someone with sufficient access from modifying storage, but it provides a mechanism for detecting integrity problems. Organizations should also protect the destination S3 bucket with appropriate access controls and security policies.

Question 160. What service aggregates AWS Config data across accounts?

1. AWS Config aggregator
   2. CodePipeline
   3. CodeArtifact
   4. CodeDeploy

Correct Answer: 1. AWS Config aggregator

Explanation:

An AWS Config aggregator provides a centralized view of AWS Config resource configuration and compliance information from multiple accounts and Regions. This is useful for organizations that operate many AWS accounts and need centralized visibility into configuration status. Instead of reviewing each account separately, administrators can query aggregated information from a central location. Config aggregators can support governance, compliance monitoring, and operational analysis across an AWS organization. They are particularly useful when teams need to identify configuration trends or compliance issues across a large multi-account environment while keeping the underlying resources managed within their respective AWS accounts.