Free DOP-C02 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

When you create a pipeline from CodePipeline during the step-by-step it creates a CloudWatch Event

rule for a given branch and repo

like this:

{

"source": [

"aws.codecommit"

],

"detail-type": [

"CodeCommit Repository State Change"

],

"resources": [

"arn:aws:codecommit:us-east-1:xxxxx:repo-name"

],

"detail": {

"event": [

"referenceCreated",

"referenceUpdated"

],

"referenceType": [

"branch"

],

"referenceName": [

"master"

]

}

}

https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-trigger-source-repochanges-console.html

Comprehensive and Detailed Explanation From Exact Extract:

To allow an EC2 instance to access CodeArtifact, an IAM role attached via an instance profile must be

granted permissions to access the CodeArtifact repository. The EC2 instance assumes this role.

The instance then uses the AWS CLI command aws codeartifact login to authenticate and configure

the package manager (e.g., pip) to use the CodeArtifact repository. This command obtains an

authorization token and sets up repository credentials securely on the instance.

Service-linked roles (Option A) are managed by AWS services, not used for instance access.

CodeArtifact does not support ACLs (Option C), and resource-based policies (Option B) do not grant

access to EC2 instances by principal.

This method is standard for securely managing credentials and access to CodeArtifact in automated

deployments.

Reference:

AWS CodeArtifact Access Control and Authentication:

"Use IAM roles attached to compute resources and the aws codeartifact login command to

authenticate to repositories."

(AWS CodeArtifact Developer Guide)

Option A is incorrect because setting the deployment configuration to LambdaAllAtOnce means that

the new version of the application will be deployed to all Lambda functions at once, affecting all

customers. This does not meet the requirement of affecting the fewest customers possible.

Moreover, configuring automatic rollbacks on the deployment group is not operationally efficient, as

it requires manual intervention to fix the errors and redeploy the application.

Option B is correct because setting the deployment configuration to

LambdaCanary10Percent10Minutes means that the new version of the application will be deployed

to 10 percent of the Lambda functions first, and then to the remaining 90 percent after 10 minutes.

This minimizes the impact of errors on customers, as only 10 percent of them will be affected by a

faulty deployment. Configuring automatic rollbacks on the deployment group also meets the

requirement of reverting to the most recent stable version of the application when an error is

detected. Creating a CloudWatch alarm that detects HTTP Bad Gateway errors on API Gateway is a

valid way to monitor the health of the application and trigger a rollback if needed.

Option C is incorrect because setting the deployment configuration to LambdaAllAtOnce means that

the new version of the application will be deployed to all Lambda functions at once, affecting all

customers. This does not meet the requirement of affecting the fewest customers possible.

Moreover, configuring manual rollbacks on the deployment group is not operationally efficient, as it

requires human intervention to stop the current deployment and start a new one. Creating an SNS

topic to send notifications every time a deployment fails is not sufficient to detect errors in the

application, as it does not monitor the API Gateway responses.

Option D is incorrect because configuring manual rollbacks on the deployment group is not

operationally efficient, as it requires human intervention to stop the current deployment and start a

new one. Creating a metric filter on a CloudWatch log group for API Gateway to monitor HTTP Bad

Gateway errors is a valid way to monitor the health of the application, but invoking a new Lambda

function to perform a rollback is unnecessary and complex, as CodeDeploy already provides

automatic rollback functionality.

AWS CodeDeploy Deployment Configurations

[AWS CodeDeploy Rollbacks]

Amazon CloudWatch Alarms

:

:

:

The requirement is to create automation that deletes unattached EBS volumes that have been

unattached for 14 days. To do this, the DevOps engineer needs to use the following steps:

Create an Amazon CloudWatch Events rule to execute an AWS Lambda function daily. CloudWatch

Events is a service that enables event-driven architectures by delivering events from various sources

to targets. Lambda is a service that lets you run code without provisioning or managing servers. By

creating a CloudWatch Events rule that executes a Lambda function daily, the DevOps engineer can

schedule a recurring task to check and delete unattached EBS volumes.

The Lambda function should find unattached EBS volumes and tag them with the current date, and

delete unattached volumes that have tags with dates that are more than 14 days old. The Lambda

function can use the EC2 API to list and filter unattached EBS volumes based on their state and tags.

The function can then tag each unattached volume with the current date using the create-tags

command. The function can also compare the tag value with the current date and delete any

unattached volume that has been tagged more than 14 days ago using the delete-volume command.

Option A is incorrect because S3 event notifications do not support s3.ObjectTagging:Put events. S3

event notifications only support events related to object creation, deletion, replication, and restore.

Moreover, enabling bucket versioning on the S3 bucket is not relevant to the tagging requirements,

as it only keeps multiple versions of objects in the bucket.

Option B is incorrect because enabling server access logging on the S3 bucket does not help with

tagging the resources. Server access logging only records requests for access to the bucket or its

objects. It does not capture the user ID or the cost center ID of the resources. Furthermore, creating

an S3 event notification on the S3 bucket for s3.ObjectTagging:Put events is not possible, as

explained in option A.

Option C is incorrect because creating a recurring hourly Amazon EventBridge scheduled rule that

invokes the Lambda function is not efficient or timely. The Lambda function would have to read the

logs from the S3 bucket every hour and tag the resources accordingly, which could incur unnecessary

costs and delays. A better solution would be to trigger the Lambda function as soon as a resource is

created, rather than waiting for an hourly schedule.

Option D is correct because creating an Amazon EventBridge rule that uses Amazon EC2 as the event

source and matches events delivered by CloudTrail is a valid way to tag the resources. CloudTrail

records all API calls made to AWS services, including EC2, and delivers them as events to

EventBridge. The EventBridge rule can filter the events based on the user ID and the resource type,

and then target the Lambda function to tag the resources with the cost center ID. This solution meets

the tagging requirements in a timely and efficient manner.

S3 event notifications

Server access logging

Amazon EventBridge rules

AWS CloudTrail

"You can use subscriptions to get access to a real-time feed of log events from CloudWatch Logs and

have it delivered to other services such as an Amazon Kinesis stream, an Amazon Kinesis Data

Firehose stream, or AWS Lambda for custom processing, analysis, or loading to other systems. When

log events are sent to the receiving service, they are Base64 encoded and compressed with the gzip

format." See https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions.html

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structurehooks.html

A Lambda function in one account can mount a file system in a different account. For this scenario,

you configure VPC peering between the function VPC and the file system VPC.

https://docs.aws.amazon.com/lambda/latest/dg/services-efs.html

https://aws.amazon.com/ru/blogs/storage/mount-amazon-efs-file-systems-cross-account-fromamazon-eks/

1. Need to update the file system policy on EFS to allow mounting the file system into Account B.

## File System Policy

$ cat file-system-policy.json

{

"Statement": [

{

"Effect": "Allow",

"Action": [

"elasticfilesystem:ClientMount",

"elasticfilesystem:ClientWrite"

],

"Principal": {

"AWS": "arn:aws:iam:::root" # Replace with AWS account ID of EKS cluster

}

}

]

}

2. Need VPC peering between Account A and Account B as the pre-requisite

3. Need to assume cross-account IAM role to describe the mounts so that a specific mount can be

chosen.

https://aws.amazon.com/premiumsupport/knowledge-center/monitor-security-group-changes-ec2/

https://aws.amazon.com/blogs/mt/how-to-centrally-manage-aws-iot-greengrass-devices-using-awssystems-manager/?force_isolation=true

A comprehensive and detailed explanation is:

Option A is correct because using batch writes to write multiple log events in a single write operation

is a recommended practice for optimizing the performance and cost of data ingestion in Timestream.

Batch writes can reduce the number of network round trips and API calls, and can also take

advantage of parallel processing by Timestream. Batch writes can also improve the compression ratio

of data in the memory store and the magnetic store, which can reduce the storage costs and improve

the query performance1.

Option B is incorrect because writing each log event as a single write operation is not a

recommended practice for optimizing the performance and cost of data ingestion in Timestream.

Writing each log event as a single write operation would increase the number of network round trips

and API calls, and would also reduce the compression ratio of data in the memory store and the

magnetic store. This would increase the storage costs and degrade the query performance1.

Option C is incorrect because treating each log as a single-measure record is not a recommended

practice for optimizing the query performance in Timestream. Treating each log as a single-measure

record would result in creating multiple records for each timestamp, which would increase the

storage size and the query latency. Moreover, treating each log as a single-measure record would

require using joins to query multiple measures for the same timestamp, which would add complexity

and overhead to the query processing2.

Option D is correct because treating each log as a multi-measure record is a recommended practice

for optimizing the query performance in Timestream. Treating each log as a multi-measure record

would result in creating a single record for each timestamp, which would reduce the storage size and

the query latency. Moreover, treating each log as a multi-measure record would allow querying

multiple measures for the same timestamp without using joins, which would simplify and speed up

the query processing2.

Option E is incorrect because configuring the memory store retention period to be longer than the

magnetic store retention period is not a valid option in Timestream. The memory store retention

period must always be shorter than or equal to the magnetic store retention period. This ensures

that data is moved from the memory store to the magnetic store before it expires out of the memory

store3.

Option F is correct because configuring the memory store retention period to be shorter than the

magnetic store retention period is a valid option in Timestream. The memory store retention period

determines how long data is kept in the memory store, which is optimized for fast point-in-time

queries. The magnetic store retention period determines how long data is kept in the magnetic store,

which is optimized for fast analytical queries. By configuring these retention periods appropriately,

you can balance your storage costs and query performance according to your application needs3.

1: Batch writes

2: Multi-measure records vs. single-measure records

3: Storage

This solution will meet the requirements in the most operationally efficient manner because it will

use CloudWatch Logs destination to aggregate the log groups from all the accounts to a single S3

bucket in the logging account. However, unlike option A, this solution will create a CloudWatch Logs

destination for each region, instead of a single destination for all regions. This will improve the

performance and reliability of the log delivery, as it will avoid cross-region data transfer and latency

issues. Moreover, this solution will use an Amazon Kinesis data stream and an Amazon Kinesis Data

Firehose delivery stream for each region, instead of a single stream for all regions. This will also

improve the scalability and throughput of the log delivery, as it will avoid bottlenecks and throttling

issues that may occur with a single stream.

EC2 instances running in private subnets of a VPC can now have controlled access to S3 buckets,

objects, and API functions that are in the same region as the VPC. You can use an S3 bucket policy to

indicate which VPCs and which VPC Endpoints have access to your S3 buckets 1-

https://aws.amazon.com/pt/blogs/aws/new-vpc-endpoint-for-amazon-s3/

The CfCT solution is designed for the exact purpose stated in the question. It extends the capabilities

of AWS Control Tower by providing you with a way to automate resource provisioning and apply

custom configurations across all AWS accounts created in the Control Tower environment. This

enables the company to implement additional account customizations when new accounts are

provisioned via the Control Tower Account Factory. The CloudFormation templates and SCPs can be

added to a CodeCommit repository and will be automatically deployed to new accounts when they

are created. This provides a highly automated solution that does not require manual intervention to

deploy resources and SCPs to new accounts.

:

CodeCommit generates events in CloudWatch, CloudWatch triggers the CodeBuild

https://aws.amazon.com/es/blogs/devops/complete-ci-cd-with-aws-codecommit-aws-codebuildaws-codedeploy-and-aws-codepipeline/

https://aws.amazon.com/blogs/mt/how-to-set-up-aws-opsworks-stacks-auto-healing-notificationsin-amazon-cloudwatch-events/