Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
A company manages environments for its application in multiple AWS accounts. Each environment account is in a different OU in AWS Organizations.
A DevOps team is responsible for the application deployment process across the environments. The deployment process uses an AWS CodePipeline pipeline in a Shared Services account. The DevOps team members are in the same user group. The team members have administrative access to all accounts through AWS IAM Identity Center.
A recent deployment problem in the development environment required the DevOps team to perform manual steps. The deployment to the production environment then resulted in an incident that caused the pipeline to fail, blocking new deployments for several hours.
A DevOps engineer needs to ensure that only the pipeline can perform deployments in the production environment. The DevOps engineer must have access to the environment in case of an emergency.
Which solution will meet these requirements with the MOST operational efficiency?
The requirement is to restrict production deployments strictly to the pipeline, while still allowing emergency access to a specific engineer.
The best approach is to restrict the DevOps team to read-only access in production accounts, minimizing risk of manual changes (Option A).
The DevOps engineer can have an admin permission set but assume the pipeline IAM role for deployment, enforcing strict control.
Applying an SCP to deny modification by anyone other than the pipeline role enforces this at the organization level.
Option B is similar but unnecessarily creates separate IAM users, increasing management overhead. Option C grants the DevOps engineer broader permissions that may conflict with controls. Option D complicates management with tagging and SCPs, increasing operational overhead.
AWS Organizations Service Control Policies (SCPs):
'SCPs can restrict what actions identities in member accounts can perform, even for administrators.'
(AWS Organizations SCP Documentation)
IAM Identity Center Role Assumption Best Practices:
'Use role assumption for limited elevated permissions instead of broad admin access.'
(AWS IAM Best Practices)
A company has configured Amazon RDS storage autoscaling for its RDS DB instances. A DevOps team needs to visualize the autoscaling events on an Amazon CloudWatch dashboard. Which solution will meet this requirement?
Step 1: Reacting to RDS Storage Autoscaling Events Using Amazon EventBridgeAmazon RDS emits events when storage autoscaling occurs. To visualize these events in a CloudWatch dashboard, you can create an EventBridge rule that listens for these specific autoscaling events.
Action: Create an EventBridge rule that reacts to RDS storage autoscaling events from the RDS event stream.
Why: EventBridge allows you to listen to RDS events and route them to specific AWS services for processing.
Step 2: Creating a Custom CloudWatch Metric via LambdaOnce the EventBridge rule detects a storage autoscaling event, you can use a Lambda function to publish a custom metric to CloudWatch. This metric can then be visualized in a CloudWatch dashboard.
Action: Use a Lambda function to publish custom metrics to CloudWatch based on the RDS storage autoscaling events.
Why: Custom metrics allow you to track specific events like autoscaling and visualize them easily on a CloudWatch dashboard.
This corresponds to Option A: Create an Amazon EventBridge rule that reacts to RDS storage autoscaling events from RDS events. Create an AWS Lambda function that publishes a CloudWatch custom metric. Configure the EventBridge rule to invoke the Lambda function. Visualize the custom metric by using the CloudWatch dashboard.
A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.
The company has created an AWS Key Management Service (AWS KMS) key in the source account.
Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)
The Auto Scaling group service-linked role must have a specific grant in the source account in order to decrypt the encrypted AMI. This is because the service-linked role does not have permissions to assume the default IAM role in the source account.
The following steps are required to meet the requirements:
In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.
In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.
In the source account, share the encrypted AMI with the target account.
In the target account, attach the KMS grant to the Auto Scaling group service-linked role.
The first three steps are the same as the steps that I described earlier. The fourth step is required to grant the Auto Scaling group service-linked role permissions to decrypt the AMI in the target account.
A company uses AWS CodeArtifact to centrally store Python packages. The CodeArtifact repository is configured with the following repository policy.
"Version": ''2012-10-17'',
"Statement'': [
{
"Action": [
"codeartifact:DescribePackageVersion", "codeartifact:DescribeRepository",
"codeartifact:GetPackageVersionReadme", "codeartifact:GetRepositoryEndpoint", "codeartifact:ListPackageVersionAssets", ''codeartifact: ListPackageVersionDependencies", "codeartifact:ListPackageVersions", ''codeartifact :ListPackages",
''codeartifact: ReadFromRepository"
],
"Effect": "Allow",
"Resource": "*",
"Principal":
"Condition": {
"StringEquals": {
"aws:PrincipalOrglD": [ "o-xxxxxxxxxxx"
]
}
}
}
]
A development team is building a new project in an account that is in an organization in AWS Organizations. The development team wants to use a Python library that has already been stored in the CodeArtifact repository in the organization. The development team uses AWS CodePipeline and AWS CodeBuild to build the new application. The CodeBuild job that the development team uses to build the application is configured to run in a VPC Because of compliance requirements the VPC has no internet connectivity.
The development team creates the VPC endpoints for CodeArtifact and updates the CodeBuild buildspec yaml file. However, the development team cannot download the Python library from the repository.
Which combination of steps should a DevOps engineer take so that the development team can use Code Artifact? (Select TWO.)
'AWS CodeArtifact operates in multiple Availability Zones and stores artifact data and metadata in Amazon S3 and Amazon DynamoDB. Your encrypted data is redundantly stored across multiple facilities and multiple devices in each facility, making it highly available and highly durable.' https://aws.amazon.com/codeartifact/features/ With no internet connectivity, a gateway endpoint becomes necessary to access S3.
A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules. The security team wants to programmatically retrieve this information from the member accounts using an AWS Lambda function in the management account of the organization.
Which combination of access changes will meet these requirements? (Choose three.)
https://aws.amazon.com/premiumsupport/knowledge-center/lambda-function-assume-iam-role/ https://kreuzwerker.de/post/aws-multi-account-setups-reloaded
A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.
A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.
Which solution will meet these requirements?
The following are the steps that the DevOps engineer should take to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified:
Set up AWS Config in the account.
Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applied.
Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
The managed rule AWS::Config::EBSVolumesWithoutBackupTag will return a compliance failure for any EBS volume that does not have the Backup_Frequency tag applied. The remediation action will then use the Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly to the EBS volume.
A company's web app publishes JSON logs with transaction status to CloudWatch Logs. The company wants a dashboard showing the number of successful transactions with the least operational overhead.
Which solution meets this?
CloudWatch metric filters can parse logs directly to create metrics without additional infrastructure.
Metric filters combined with CloudWatch dashboards provide the simplest and most operationally efficient solution.
Options A, B, and D add complexity with additional services (OpenSearch, Lambda, Kinesis).
References:
CloudWatch Logs Metric Filters
CloudWatch Dashboards
Exam domains verified against: Official Amazon DOP-C02 exam guide, last checked October 2026.
Implement CI/CD pipelines using AWS Developer Tools and automation frameworks. Build and manage deployment artifacts while integrating automated testing across instance, container, and serverless environments.
Sample question from this domain above: Q4
Define cloud infrastructure using Infrastructure as Code with CloudFormation and other AWS tools. Deploy automation to provision systems and manage AWS accounts in multi-account and multi-Region environments at scale.
Implement highly available and scalable solutions that meet business requirements. Design automated recovery processes and redundancy strategies to meet RTO and RPO targets.
Configure collection, aggregation, and storage of logs and metrics using AWS monitoring services. Detect issues and automate responses across complex distributed environments.
Manage event sources to trigger notifications and automated actions in response to system events. Troubleshoot application and infrastructure failures while implementing configuration changes.
Implement identity and access management at scale using IAM and federation. Apply automation for security controls, data protection, and compliance monitoring across AWS infrastructure.
Common questions about the exam itself
