Free AWS Certified DevOps Engineer - Professional (DOP-C02) Sample Questions

Correct answers: A, C — EC2 Image Builder; AWS Systems Manager Automation

• A. Correct. EC2 Image Builder is a purpose-built AWS service designed specifically to automate the creation, maintenance, validation, testing, and distribution of secure, up-to-date 'golden AMIs'. It provides a complete, managed pipeline that integrates versioning and can be triggered on a schedule or by events, making it an ideal solution for this requirement.
• B. Incorrect. AWS CodeDeploy is an application deployment service used to automate the installation of application revisions onto existing compute services like EC2, Lambda, or ECS. It operates after an instance is running and is not used for creating the underlying machine images (AMIs).
• C. Correct. AWS Systems Manager Automation allows you to author custom runbooks to automate common operational tasks. It can be used to create a golden AMI pipeline by orchestrating steps such as launching a base AMI, applying patches and software using Systems Manager Run Command, running validation tests, and finally creating a new, hardened AMI from the instance. This provides a highly customizable and repeatable automation solution.
• D. Incorrect. AWS CloudFormation and its `cfn-init` helper script are used for provisioning infrastructure and configuring EC2 instances at launch time. This process occurs after an instance is launched from an AMI; it is not a tool for automating the creation, versioning, or validation of the AMI artifact itself.
• E. Incorrect. AWS DataSync is a data transfer service designed to move large amounts of data between on-premises storage systems and AWS storage services. It has no capabilities related to creating or managing EC2 AMIs.

Correct answers: A, C — The CodeBuild service role in account 111111111111 must have an IAM policy allowing ECR actions on the target repository ARN in account 999999999999.; The ECR repository in account 999999999999 must have a resource-based policy granting permissions to the CodeBuild role ARN from account 111111111111.

• A. This is a correct and necessary step. The AWS CodeBuild service role in the source account (111111111111) is the principal making the request. It requires an identity-based IAM policy that explicitly allows it to perform the necessary ECR actions (like ecr:PutImage, ecr:InitiateLayerUpload, etc.) on the specific ECR repository ARN in the destination account (999999999999).
• B. This is incorrect. Amazon ECR is an AWS managed service with regional endpoints that are accessible over the internet by default. Cross-account access is controlled through IAM policies, not network connectivity. While VPC endpoints can be used for private access, VPC peering is not required for granting permissions between accounts.
• C. This is the second correct and necessary step for cross-account access. In addition to the principal's permissions, the resource being accessed (the ECR repository in account 999999999999) must have a resource-based policy (a repository policy) that explicitly grants the principal from the other account (the CodeBuild role ARN) permission to perform the desired actions.
• D. This is incorrect because it is not the *minimum* required configuration. While assuming a role in the production account is a valid pattern for cross-account access, it is more complex than necessary for this scenario. For services like ECR that support resource-based policies, the most direct and minimal approach is the combination of an identity-based policy on the principal and a resource-based policy on the resource.
• E. This is incorrect. AWS Organizations can simplify multi-account management but is not a prerequisite for enabling cross-account resource access. IAM permissions, through identity-based and resource-based policies, can be configured between any two AWS accounts, regardless of their organizational membership.

Correct answers: B, C — In the CodeBuild project configuration, reference the Secrets Manager ARNs in the `secretsManager` section of the environment definition.; Grant the CodeBuild service role `secretsmanager:GetSecretValue` permission and reference the secrets in the buildspec.yml `env.secrets-manager` section.

• A. This method is not recommended. While the AWS CLI can retrieve secrets, storing them directly in shell variables risks exposing them in build logs, especially if commands are echoed or debugging modes like `set -x` are enabled. The native CodeBuild integrations are more secure.
• B. This is a correct approach. AWS CodeBuild allows you to define environment variables in the project configuration that reference secrets stored in AWS Secrets Manager. CodeBuild securely retrieves the secret's value and injects it as an environment variable, automatically masking the value in build logs. This method centralizes the secret configuration at the project level.
• C. This is another correct approach. The `buildspec.yml` file supports an `env.secrets-manager` section where you can map environment variable names to specific secrets in Secrets Manager. This method requires granting the CodeBuild service role the `secretsmanager:GetSecretValue` IAM permission. The secret values are securely injected and masked in the build logs. This keeps the secret configuration versioned with the source code.
• D. This is a major security anti-pattern. Storing secrets in a source code repository, even a private one, is highly insecure. It exposes credentials to anyone with access to the repository and makes secret rotation and management extremely difficult.
• E. This is insecure and violates best practices. Passing secrets as plaintext environment variables exposes them in the CodeBuild project configuration, making them visible in the AWS Console and to anyone with permissions to describe the build project via the API.

Correct answer: B — Create a single pipeline. In the deployment stage, add two parallel actions, each configured with a different region and the appropriate cross-region deployment provider (e.g., CodeDeploy, CloudFormation).

• A. This approach is incorrect because managing two separate pipelines doubles the operational overhead and introduces the risk of configuration drift. More importantly, it does not guarantee simultaneous deployment as the two pipelines would run independently, even if triggered by the same source commit.
• B. This is the correct approach. AWS CodePipeline stages support running multiple actions in parallel. By configuring a single deployment stage with two parallel actions—one for each region—the pipeline can deploy simultaneously to both locations. This maintains a single, manageable pipeline, ensures consistency, and directly meets the business requirement for parallel deployment.
• C. This approach is incorrect because it is sequential by design, which violates the requirement for simultaneous deployment. It introduces unnecessary latency between the primary and secondary region deployments. Additionally, invoking a second pipeline via a Lambda function adds complexity and an extra potential point of failure.
• D. This approach is incorrect because it relies on asynchronous S3 cross-region replication, which has inherent latency and cannot guarantee simultaneous deployment. It creates a decoupled, event-driven architecture that is more complex to manage and troubleshoot than a single pipeline. This pattern is better suited for eventual consistency scenarios, not for simultaneous hot-standby deployments.

Correct answers: A, D — Create a new, temporary Aurora Serverless database cluster as part of the test stage in the pipeline.; In an AWS CodeBuild project, run the migration tool against the temporary database to apply and then revert the schema changes, asserting the final state.

• A. Correct. This approach provides the required isolated and ephemeral environment for testing. By programmatically creating a new, temporary database cluster for each test run within the CI/CD pipeline, the team ensures that tests are clean, repeatable, and have no impact on persistent environments like staging or production. This is a standard best practice for database migration testing.
• B. Incorrect. AWS Schema Conversion Tool (SCT) is designed for heterogeneous database migrations, meaning it helps convert database schemas from one engine type to another (e.g., Oracle to PostgreSQL). It is not a tool for validating or testing incremental migration scripts within a CI/CD pipeline for the same database engine.
• C. Incorrect. AWS Database Migration Service (DMS) is a service for migrating data between databases, either for a one-time migration or for continuous data replication. It does not execute or test application-level schema migration scripts like those used for applying and reverting schema changes.
• D. Correct. This action describes the execution part of the testing strategy. AWS CodeBuild is a managed build service that can run commands and scripts as a stage in a CI/CD pipeline. It is the ideal place to run the migration tool (e.g., Flyway, Liquibase) to connect to the temporary database (from option A), apply the 'up' migration, and then apply the 'down' migration to ensure both scripts work correctly and the database returns to its original state.
• E. Incorrect. Connecting any test process to a production database is a major anti-pattern and highly risky, even in read-only mode. It violates the principle of environment isolation. Furthermore, a read-only connection would prevent the migration scripts from being applied, making the test impossible to perform as described.

Correct answers: A, D — Create a test listener on the Application Load Balancer that forwards traffic to the green target group.; Create an AWS Lambda function, specified in the CodeDeploy deployment group settings, to run as a lifecycle hook test.

• A. Correct. In an AWS CodeDeploy blue/green deployment for EC2 using an Application Load Balancer (ALB), a test listener is a crucial component. CodeDeploy registers the new green instances with this test listener, which allows test traffic to be routed exclusively to the new environment. This enables integration tests to run against the green fleet before any production traffic is shifted, directly addressing a key requirement of the question.
• B. Incorrect. The `AfterAllowTraffic` lifecycle hook runs *after* the production traffic has been rerouted to the new green environment. The requirement is to run tests *before* the traffic shift. The correct lifecycle hook for this purpose in the `appspec.yml` would be `BeforeAllowTraffic`.
• C. Incorrect. Running a CodeBuild test action before the CodeDeploy action would test the application code in an isolated build environment, not against the fully deployed green environment on EC2. This is not suitable for integration testing the newly provisioned infrastructure and application stack.
• D. Correct. This is a primary method for implementing automated tests in a CodeDeploy blue/green deployment. A Lambda function can be specified as a lifecycle hook in the deployment group settings. By triggering this Lambda function on the `BeforeAllowTraffic` event, it can execute automated tests against the green environment's test listener. If the tests fail, the Lambda returns a failure status to CodeDeploy, which then automatically initiates a rollback.
• E. Incorrect. Amazon Route 53 weighted routing is a DNS-level traffic management feature. While it can be used for canary deployments, it is not integrated with the CodeDeploy EC2 blue/green lifecycle hooks and does not provide the automated testing and rollback mechanism required by the scenario.

Correct answers: A, C, E — BeforeInstall; ValidateService; AfterInstall

• A. Correct. `BeforeInstall` is a valid and commonly used lifecycle event hook for EC2/On-Premises deployments. It allows you to run scripts before the new application revision files are copied to their destination. This hook is typically used for tasks like creating backups, stopping the application server, or cleaning up old files.
• B. Incorrect. `Start` is not a valid lifecycle event hook name. The correct hook for starting the application is `ApplicationStart`.
• C. Correct. `ValidateService` is a valid lifecycle event hook. It is the final hook in the deployment lifecycle and is used to run scripts that verify the deployment was successful and the application is healthy and serving traffic as expected.
• D. Incorrect. `AfterTestTraffic` is a lifecycle event hook, but it is not valid for EC2/On-Premises deployments. It is specifically used for AWS Lambda and Amazon ECS blue/green deployments to run validations after test traffic has been shifted to the new version.
• E. Correct. `AfterInstall` is a valid lifecycle event hook for EC2/On-Premises deployments. It runs after the application revision files have been successfully copied to the instance. This hook is often used for tasks like setting file permissions, installing dependencies, or running database migrations.
• F. Incorrect. While `DownloadBundle` is an event that occurs during the CodeDeploy lifecycle, you cannot specify custom scripts for this hook within the `appspec.yml` file. It is an internal step managed by the CodeDeploy agent to download the application revision. The question asks for valid hooks within the file, which implies hooks you can configure.

Correct answers: A, B — DeploymentPreference; AutoPublishAlias

• A. Correct. The `DeploymentPreference` property in an AWS SAM template is specifically designed to configure gradual deployments for Lambda functions, such as linear or canary strategies. It allows you to specify the deployment type (e.g., `Linear10PercentEvery1Minute`), and critically, it includes a sub-property for `Alarms`. This is where you list the CloudWatch alarms that, if triggered, will initiate an automatic rollback of the deployment.
• B. Correct. The `AutoPublishAlias` property is required to enable gradual deployments. It instructs AWS SAM to automatically publish a new version of the Lambda function upon each deployment and create/update an alias to point to it. The `DeploymentPreference` property then uses this alias to manage the traffic shifting between the old and the new function versions. Without an alias and versioning, traffic shifting is not possible.
• C. Incorrect. The `ProvisionedConcurrencyConfig` property is used to manage Lambda function performance by keeping a specified number of execution environments initialized and ready to respond, thereby reducing cold start latency. It is unrelated to deployment strategies or traffic shifting.
• D. Incorrect. The `Events` property is used to define the event sources that trigger the Lambda function, such as an API Gateway endpoint, an S3 bucket event, or an SQS queue. It does not control how the function is deployed.
• E. Incorrect. While CloudWatch Alarms are essential for triggering the automated rollback, `Alarms` is not a direct, top-level property of the `AWS::Serverless::Function` resource. Instead, the alarms are defined as separate `AWS::CloudWatch::Alarm` resources and then referenced within the `Alarms` list under the `DeploymentPreference` property.

Correct answers: C, D — Temporarily modify the consuming stack `App-Stack-A` to remove its dependency on the export before updating the networking stack.; Use AWS Systems Manager Parameter Store to share the VPC ID instead of using CloudFormation exports.

• A. This approach is incorrect because deleting the consuming stack is highly disruptive, causes application downtime, and is considered an anti-pattern for production environments. While it technically works, it does not 'maintain the relationship' during the update process; it completely severs it before re-establishing it.
• B. This approach is incorrect because CloudFormation will not allow you to update a stack to remove an export that is currently being used by another stack. Attempting this would result in a dependency error, failing the stack update.
• C. This is a correct approach. By first updating the consuming stack (`App-Stack-A`) to remove the `Fn::ImportValue` dependency (e.g., by temporarily hardcoding the old value), you break the link. This allows the networking stack update to proceed, as the export is no longer in use. After the networking stack is successfully updated with the new resource and new export value, the consuming stack can be updated again to re-establish the dependency using `Fn::ImportValue`.
• D. This is a correct and recommended architectural pattern. By using a centralized parameter management service like AWS Systems Manager (SSM) Parameter Store, you decouple the stacks. The networking stack writes the VPC ID to a well-known SSM parameter, and the consuming stack reads it using a dynamic reference (`{{resolve:ssm:parameter-name}}`). This eliminates the rigid dependency of CloudFormation exports, allowing the networking stack to be updated independently without causing failures in consuming stacks.
• E. This approach is incorrect. The `DeletionPolicy` attribute only determines whether AWS retains a resource when its stack is deleted or when the resource is removed from the template. It has no effect on the rules governing the update or replacement of an exported value that is in use by another stack.

Correct answers: B, C, E — Define the stacks in a region-agnostic way, allowing the CDK to automatically resolve pseudo parameters like `AWS::Region`.; Use the `cdk.json` context file to store region-specific key-value pairs (e.g., AMI IDs, capacity units) for each environment.; Use a CI/CD pipeline that executes `cdk deploy` multiple times, targeting a different region-specific environment configuration in each stage.

• A. Incorrect. Hardcoding values with conditional logic directly in the code tightly couples configuration and logic. This approach is not scalable, reduces maintainability, and requires code changes for simple configuration updates, which is considered a poor practice.
• B. Correct. This is a foundational best practice for writing reusable CDK code. By creating constructs that are not tied to a specific region, they can be instantiated multiple times for different environments. The constructs can use stack properties like `Stack.of(this).region` (which synthesizes to the `AWS::Region` pseudo parameter) while accepting region-specific values like AMI IDs as input properties. This keeps the codebase modular and clean.
• C. Correct. This is the idiomatic way to manage environment-specific configurations in the AWS CDK. Storing configuration values like AMI IDs and DynamoDB capacity settings in `cdk.json` cleanly separates configuration from the infrastructure code. The CDK application can then retrieve these values from the context at synthesis time based on the target environment, enabling a single codebase to support multiple regional configurations.
• D. Incorrect. This directly contradicts the requirement to maintain a single codebase. It leads to code duplication, increased maintenance overhead, and a high risk of configuration drift between regions, defeating the purpose of using an Infrastructure as Code tool.
• E. Correct. A CI/CD pipeline is the standard mechanism for automating multi-region CDK deployments. By creating separate stages for each target region, the pipeline can execute `cdk deploy` with the appropriate context parameters. This ensures consistent, repeatable, and automated deployments of the correct configuration to each region from a single codebase.
• F. Incorrect. While it's possible to use `cdk synth` to generate a template and then deploy it with AWS CloudFormation StackSets, this is not the most direct or idiomatic approach within the CDK ecosystem. The CDK framework has native multi-region deployment capabilities, and using a CI/CD pipeline with the `cdk deploy` command (as in option E) is the more common pattern that leverages the CDK toolkit's full capabilities.

Correct answer: B — To define the maximum permissions for IAM principals in member accounts.

• A. This is incorrect. SCPs do not grant any permissions. They function as guardrails that define the maximum allowable permissions. The actual permissions for IAM users and roles are granted by IAM policies within an individual account. An action is only allowed if it is permitted by both the IAM policy and the applicable SCPs.
• B. This is correct. The primary purpose of an SCP is to act as a permission boundary for all IAM principals (users and roles) within the accounts they are applied to. They are used to enforce organizational governance and ensure accounts stay within specific compliance guidelines by restricting which services and actions are available, regardless of the permissions granted by IAM policies in those accounts.
• C. This is incorrect. SCPs are a preventive control, meaning they block actions before they happen. Automatic remediation of non-compliant resources is a detective and corrective control mechanism, typically implemented using AWS Config Rules in combination with remediation actions via AWS Lambda or AWS Systems Manager Automation documents.
• D. This is incorrect. Service-Linked Roles (SLRs) are a type of IAM role that an AWS service assumes to perform actions on your behalf. While AWS Organizations uses an SLR to function, creating and managing SLRs is not the purpose of an SCP. SCPs are policy documents that control permissions.

Correct answer: B — Attach a Service Control Policy (SCP) to the organization root that denies the `iam:CreateUser` action.

• A. Incorrect. This is a detective control, not a preventative one. A detective guardrail in AWS Control Tower would only alert after an IAM user has been created. It does not proactively enforce the policy by preventing the creation, which is a key requirement of the question.
• B. Correct. Service Control Policies (SCPs) are the most effective and non-remediating method for this requirement. SCPs act as preventative guardrails at the AWS Organization level. By attaching a policy that denies the `iam:CreateUser` action to the organization root or a specific OU, you can ensure that no IAM users can be created in any of the member accounts, regardless of the permissions of the local account's root user or administrators.
• C. Incorrect. This approach is remediating and reactive, not preventative. The Lambda function would only delete IAM users *after* they have been created. This introduces a window of vulnerability and does not fulfill the requirement for a non-remediating enforcement mechanism.
• D. Incorrect. Similar to option A, using AWS Config is a detective control. It can detect the creation of an IAM user and trigger a notification, but it does not prevent the user from being created in the first place. This approach is for monitoring and alerting on non-compliance, not for proactive enforcement.

Correct answer: B — Configure the AWS Config rule with a remediation action that invokes a pre-defined SSM Automation document (`AWS-DisableS3BucketPublicRead`).

• A. Incorrect. While this approach is serverless and event-driven, it is not the most direct or efficient method. It introduces additional components like an SNS topic and a custom Lambda function, which increases complexity and operational overhead compared to using a built-in feature designed for this specific purpose.
• B. Correct. This is the most direct, efficient, and recommended solution. AWS Config has a native feature to automatically trigger a remediation action when a resource becomes non-compliant. Using a pre-defined AWS Systems Manager (SSM) Automation document like `AWS-DisableS3BucketPublicRead` is a serverless, event-driven mechanism that requires minimal configuration and no custom code, perfectly aligning with all the requirements.
• C. Incorrect. This solution is not event-driven based on the compliance change. A scheduled or polling mechanism introduces a delay between the detection of the non-compliant resource and its remediation, failing the requirement for immediate action. It is also less efficient as it would repeatedly scan all resources rather than acting on a specific event.
• D. Incorrect. This solution explicitly contradicts the requirement for an automated remediation system. AWS Systems Manager OpsCenter is designed to create operational work items (OpsItems) for engineers to investigate and resolve, which involves manual intervention. This approach does not provide immediate automated remediation.

Correct answers: C, E — An Amazon EventBridge rule that captures the 'EC2 Instance-terminate Lifecycle Action' event.; An Auto Scaling group lifecycle hook for the `autoscaling:EC2_INSTANCE_TERMINATING` state.

• A. Incorrect. While a CloudWatch alarm based on CPU utilization is a common trigger for an Auto Scaling scale-in policy, it does not provide a mechanism to intercept the termination process itself. The alarm initiates the termination, but it doesn't offer a hook to run a graceful shutdown script before the instance is terminated.
• B. Incorrect. AWS Systems Manager State Manager is used to enforce a desired configuration and maintain consistency across instances, such as ensuring software is installed or patches are applied. It is not designed to react to or manage instance lifecycle events like termination from an Auto Scaling group.
• C. Correct. When an Auto Scaling lifecycle hook is triggered, it publishes an event to Amazon EventBridge. An EventBridge rule can be configured to capture this specific 'EC2 Instance-terminate Lifecycle Action' event. This rule can then invoke a target, such as an AWS Lambda function, an AWS Step Functions state machine, or an SSM Run Command, to orchestrate the complex and lengthy graceful shutdown process.
• D. Incorrect. A script provided in the instance's user data runs only once when the instance is first launched. It does not execute during instance termination, making it unsuitable for performing shutdown tasks.
• E. Correct. An Auto Scaling group lifecycle hook for the `autoscaling:EC2_INSTANCE_TERMINATING` state is the primary mechanism to solve this problem. It pauses the termination process, putting the instance into a `Terminating:Wait` state. This provides the necessary time (with a configurable heartbeat timeout) for custom actions, like the graceful shutdown script, to complete before the instance is permanently terminated.

Correct answers: B, C, F — Amazon Route 53 with a latency-based or geoproximity routing policy.; Deployment of the application stack (e.g., EC2, ALB, ECS) in at least two AWS Regions.; A database with multi-region replication capabilities, such as Amazon Aurora Global Database or Amazon DynamoDB global tables.

• A. Incorrect. An Application Load Balancer with cross-zone load balancing enhances high availability within a single region by distributing traffic across multiple Availability Zones. However, it does not address the core requirement of withstanding the failure of an entire AWS Region or providing low-latency routing for a global user base.
• B. Correct. Amazon Route 53 is the global DNS service that sits at the front of a multi-region architecture. Using latency-based or geoproximity routing policies allows Route 53 to direct end-users to the AWS Region that provides the lowest latency. It is also essential for failover, as it can detect an unhealthy region and automatically reroute traffic to a healthy one.
• C. Correct. This is a fundamental principle of a multi-region design. To be resilient to a regional failure, the application stack must be deployed independently in at least two AWS Regions. This provides a failover target, ensuring the application remains available even if one region becomes completely inaccessible.
• D. Incorrect. An Amazon RDS Multi-AZ deployment provides high availability within a single region by maintaining a synchronous standby replica in a different Availability Zone. It protects against an AZ failure but not a complete regional outage, and it does not replicate data to other regions.
• E. Incorrect. Configuring a service within a single Availability Zone makes it a single point of failure, failing to provide high availability even within a single region. This configuration directly contradicts the requirements for a highly available, multi-region application.
• F. Correct. A multi-region application requires a multi-region data strategy to maintain consistency and availability. Services like Amazon Aurora Global Database or Amazon DynamoDB global tables provide managed, low-latency data replication across regions. This ensures that data is available for both serving local traffic and for recovery during a regional failure.

Correct answer: B — Implement a warm standby strategy by running a scaled-down version of the application on EC2 instances in the DR region and scale up during failover.

• A. This approach, similar to a Pilot Light or Backup and Restore strategy, involves multiple time-consuming steps: creating an AMI, waiting for it to become available, copying it to another region, and then launching new instances. This entire sequence would likely exceed the strict 30-minute RTO.
• B. A warm standby strategy maintains a scaled-down but fully functional version of the application infrastructure in the DR region. During a failover, recovery involves redirecting traffic and scaling up the existing EC2 instances. This process is very fast and can easily be completed within the 30-minute RTO. Since the RPO for the temporary instance store data is not a concern, this is the most effective and fastest strategy.
• C. This option is technically invalid. Instance store volumes are ephemeral storage, meaning their data is lost when an instance is stopped or terminated. They cannot be snapshotted using services like AWS Backup or by creating EBS snapshots. Therefore, this is not a viable recovery strategy.
• D. AWS Elastic Disaster Recovery (DRS) works by continuously replicating block-level storage, specifically EBS volumes, to a staging area in the DR region. It does not support the replication of instance store volumes. As the application in the scenario relies on instance stores, DRS is not a compatible solution.

Correct answers: A, D — Create a Route 53 health check associated with the primary ALB's endpoint.; Change the routing policy from weighted to failover.

• A. This is a correct and fundamental step. To automate failover, Route 53 must first determine the health of the primary endpoint. Creating a Route 53 health check provides this monitoring capability by periodically sending requests to the ALB to verify its availability. The status of this health check is then used by the failover routing policy to make routing decisions.
• B. This is incorrect. A latency-based routing policy directs users to the AWS region that provides the lowest network latency. It is designed for performance optimization, not for health-based failover. It will not automatically redirect all traffic to the standby region if the primary becomes unhealthy.
• C. This is incorrect. While technically feasible, this describes a custom, more complex, and often slower failover mechanism. Route 53 provides a native, fully managed, and faster solution with its failover routing policy and health checks. For the exam, you should always prefer the native, simpler AWS-managed solution when it meets the requirements.
• D. This is a correct and core requirement. The existing weighted routing policy is for distributing traffic based on predefined ratios, not for failover. A failover routing policy is specifically designed for active-passive scenarios. It allows you to designate a primary record and a secondary (failover) record, enabling Route 53 to automatically redirect traffic to the secondary record when the primary is unhealthy.
• E. This is incorrect as one of the two primary choices. This option describes the detailed configuration *within* the failover record set, making it a sub-step of the actions in options A and D. Additionally, it conflates two methods: associating a separate health check with a record and using 'Evaluate Target Health' (which applies to Alias records and uses the target's health). The two most distinct and fundamental configurations required are creating the health check (A) and changing to a failover policy (D).

Correct answer: B — Associate the existing Client VPN endpoint with subnets in at least two different Availability Zones within the same VPC.

• A. Incorrect. This describes a multi-region disaster recovery strategy, which is more complex and costly than required for high availability within a single region. It would introduce higher latency for users connecting to the remote region and create a poor user experience by forcing them to manage and switch between multiple connection profiles manually.
• B. Correct. This is the AWS-recommended and most effective method for achieving high availability for a Client VPN endpoint. By associating the endpoint with subnets in multiple Availability Zones, AWS automatically provisions redundant endpoint servers in those AZs. The client configuration file includes endpoints for all associated AZs, allowing the client software to automatically and seamlessly fail over to a healthy AZ if one becomes impaired.
• C. Incorrect. This is not a valid or supported architecture. AWS Client VPN is a managed service that does not allow for placing a load balancer, such as a Network Load Balancer, in front of its endpoints. The service manages its own high availability natively when configured across multiple AZs.
• D. Incorrect. While technically possible to implement, this solution is overly complex and less effective than the native multi-AZ capability. It requires provisioning and managing a separate VPC and a second Client VPN endpoint, increasing costs and operational overhead. Furthermore, DNS failover with Route 53 is subject to TTLs and caching, which can lead to longer recovery times compared to the seamless, built-in failover of a multi-AZ Client VPN.

Correct answer: D — Failover routing

• A. Incorrect. Simple routing is the most basic policy, used to route traffic to a single resource. It does not support the use of health checks or provide any failover capabilities, making it unsuitable for resilient architectures.
• B. Incorrect. Weighted routing distributes traffic across multiple resources based on specified proportions (weights). Its primary use cases are for load balancing, A/B testing, or canary deployments, not for a direct active-passive failover model based on health checks.
• C. Incorrect. Latency-based routing improves application performance by routing users to the AWS region that provides the lowest network latency. This policy is for performance optimization based on network conditions, not for achieving failover based on endpoint health.
• D. Correct. Failover routing is designed specifically for active-passive failover configurations. You configure a primary record set and a secondary (failover) record set. Amazon Route 53 monitors the health of the primary endpoint using health checks. If the primary endpoint becomes unhealthy, Route 53 automatically reroutes traffic to the secondary endpoint.

Correct answers: B, C — Ensure the CloudWatch agent is configured to communicate with the CloudWatch Logs service endpoint over HTTPS (the default behavior).; Create a customer-managed KMS key and associate it with the target CloudWatch log group.

• A. This action is incorrect and unnecessary. The CloudWatch agent communicates with the CloudWatch Logs service endpoints over HTTPS by default, which already provides SSL/TLS encryption for data in transit. There is no need to configure a custom endpoint for this purpose.
• B. This is a correct action that fulfills the encryption in transit requirement. The unified CloudWatch agent is designed to securely send log data to the CloudWatch Logs service using HTTPS. Verifying and relying on this default behavior is the standard practice for ensuring logs are encrypted during transmission.
• C. This is a correct action that fulfills the encryption at rest requirement. To encrypt log data within a CloudWatch log group using a customer-managed key, you must first create the key in AWS KMS and then associate it with the specific log group. This ensures that CloudWatch Logs uses your key to encrypt the data it stores.
• D. This action is incorrect. Manually encrypting logs on the EC2 instance's file system adds unnecessary complexity and operational overhead. The requirement is met by using the built-in AWS features for encryption in transit (HTTPS) and encryption at rest (KMS), which are more manageable and secure.
• E. This action is incorrect. The encryption at rest is performed by the CloudWatch Logs service itself after receiving the logs, not by the EC2 instance. Therefore, the CloudWatch Logs service principal needs permissions to use the KMS key, not the EC2 instance's IAM role. The EC2 role needs permissions to send logs (e.g., `logs:PutLogEvents`), but not `kms:Encrypt` for this scenario.

Correct answer: B — Create an IAM role with `cloudwatch:PutMetricData` permissions. Create an IAM user with permissions to call `sts:AssumeRole`. The on-premises application uses the IAM user's credentials to assume the role and get temporary security credentials.

• A. Incorrect. Embedding long-term IAM user credentials directly into an application is a significant security risk and an anti-pattern. These static credentials, if compromised, provide long-term access and are difficult to rotate securely without application downtime.
• B. Correct. This is the AWS recommended best practice for granting on-premises applications access to AWS services. By using the AWS Security Token Service (STS) `AssumeRole` action, the application can obtain temporary, short-lived security credentials. This method minimizes the risk of credential exposure because the credentials automatically expire and are rotated, adhering to the principle of least privilege and short-term access.
• C. Incorrect. While technically feasible, introducing an EC2 proxy adds unnecessary complexity, operational overhead, cost, and a potential single point of failure. It is a less direct and less efficient solution compared to leveraging STS for temporary credentials.
• D. Incorrect. Creating a public-facing API Gateway endpoint is not the most secure method, especially when a private connection via AWS Direct Connect already exists. This approach unnecessarily exposes an endpoint to the public internet, increasing the attack surface, and adds the complexity and cost of managing API Gateway and Lambda.

Correct answer: B — Implement an EC2 Auto Scaling lifecycle hook for the `autoscaling:EC2_INSTANCE_TERMINATING` state with a heartbeat timeout of 300 seconds.

• A. Incorrect. The health check grace period applies to newly launched instances. It defines the amount of time the Auto Scaling group waits before performing the first health check on a new instance, giving it time to initialize. This setting has no effect on the instance termination process during a scale-in event.
• B. Correct. This is the designated AWS mechanism for managing actions during instance termination. Implementing a lifecycle hook for the `autoscaling:EC2_INSTANCE_TERMINATING` state pauses the termination process and puts the instance into a `Terminating:Wait` state. Setting the heartbeat timeout to 300 seconds provides the required 5 minutes for a custom script to execute the graceful shutdown logic before the instance is fully terminated by the Auto Scaling group.
• C. Incorrect. Auto Scaling groups use the `TerminateInstances` API action during scale-in, not `StopInstances`. Furthermore, neither of these API calls has a parameter to introduce a delay before termination. This approach is not integrated with the automated lifecycle of an Auto Scaling group.
• D. Incorrect. While the operating system will attempt to run a shutdown script, there is no coordination with the Auto Scaling group's termination process. The Auto Scaling group can forcibly terminate the instance before the `sleep 300` command and the subsequent shutdown logic complete, which would still result in data corruption. This method is unreliable and does not guarantee the full 5 minutes.

Correct answer: B — The provisioned write capacity units (WCUs) for the DynamoDB table are insufficient to handle the request rate. The engineer should increase the provisioned WCUs or switch to on-demand capacity mode.

• A. Incorrect. A lack of IAM permissions would result in an `AccessDeniedException`, which is an authorization error. AWS X-Ray would typically flag this as a fault (red color), not a throttle (amber color).
• B. Correct. In AWS X-Ray, an amber node and a 'throttling' error flag are classic indicators of a `ProvisionedThroughputExceededException` from DynamoDB. This means the number of requests per second is higher than the table's provisioned capacity. The first and most direct action is to increase the provisioned Write Capacity Units (WCUs) or switch the table to on-demand capacity mode to handle the workload automatically.
• C. Incorrect. Network connectivity issues, such as misconfigured security groups or network ACLs, would typically cause connection timeouts or errors, not a specific throttling error from the DynamoDB service. The presence of the 'throttling' flag rules out a general network problem.
• D. Incorrect. Attempting to write an item larger than DynamoDB's 400 KB limit would result in a `ValidationException`. This is a client-side validation error, not a server-side throttling error related to request rate.

Correct answer: C — AWS Config to detect and an associated Systems Manager Automation document to run the `RevokeSecurityGroupIngress` action.

• A. This describes a valid event-driven pattern. AWS Config sends compliance change events to Amazon EventBridge, which can trigger a Lambda function for remediation. While functional and auditable, this approach is less direct than the native AWS Config remediation feature, as it involves configuring and maintaining three separate services and custom Lambda code.
• B. This option is incorrect because it proposes using the wrong Systems Manager capability. AWS Systems Manager Run Command is designed to execute scripts on managed instances, not to orchestrate AWS API actions like modifying security groups. The appropriate service for this task is Systems Manager Automation. This makes the proposed solution flawed.
• C. This is the correct and most direct solution. AWS Config provides a built-in feature to associate a remediation action directly with a rule. This feature uses a Systems Manager Automation document to perform the remediation steps. This is the AWS-recommended, purpose-built pattern that is the most direct, requires no custom code, and provides a tightly integrated and auditable solution within the AWS Config console.
• D. This approach is inefficient and not event-driven. A scheduled Lambda function that polls all security groups is not a timely or direct response to a specific non-compliance event. It fails to leverage the real-time detection capability of the existing AWS Config rule and introduces a potential delay between detection and remediation.

Correct answers: A, B, C — An Amazon EventBridge rule that filters for `ComplianceChange` events from AWS Config.; An AWS Systems Manager Automation document that contains the logic to modify the security group rules.; An IAM role granting necessary permissions for the services to interact (EventBridge to start Automation, Automation to modify EC2 security groups).

• A. Correct. This is the core of the event-driven architecture. AWS Config generates a `ComplianceChange` event whenever a resource's compliance status changes. An Amazon EventBridge rule is essential to capture this specific event, filter for non-compliant security groups, and trigger the remediation workflow automatically.
• B. Correct. This component contains the actual remediation logic. An AWS Systems Manager (SSM) Automation document (runbook) defines the step-by-step actions required to fix the non-compliant security group, such as using the `aws:executeAwsApi` action to call `RevokeSecurityGroupIngress`. This provides a centralized, versionable, and auditable way to manage the automated fix.
• C. Correct. Secure inter-service communication is impossible without proper permissions. An IAM role is essential to grant the principle of least privilege. Specifically, EventBridge needs permissions to start an SSM Automation execution, and the SSM Automation service needs an assume role with permissions to describe and modify EC2 security groups.
• D. Incorrect. Amazon Inspector is a vulnerability management service that scans EC2 instances for software vulnerabilities and network exposure. The detection of resource misconfiguration is the responsibility of AWS Config, as stated in the question.
• E. Incorrect. While CloudWatch alarms can trigger actions, using them here would be an inefficient and indirect approach. The native integration between AWS Config and Amazon EventBridge provides a direct, event-driven path for triggering remediation without the need for intermediate metrics or alarms.
• F. Incorrect. Although AWS Step Functions is a powerful orchestration service, it is not essential for this specific scenario. The required workflow (detect -> remediate) is straightforward and can be fully handled by the combination of EventBridge and a single SSM Automation document. Step Functions would be more appropriate for complex orchestrations with multiple steps, branching logic, or error handling routines.

Correct answer: C — Add the user ID as an annotation.

• A. Incorrect. A subsegment represents the work done by a downstream service or a specific part of the application code within a segment. While it captures timing and details, it is not indexed for searching or filtering based on custom data like a user ID.
• B. Incorrect. Metadata allows you to attach additional non-indexed data to a trace segment. It is useful for providing extra context when viewing trace details but cannot be used in filter expressions in the X-Ray console because it is not indexed.
• C. Correct. Annotations are key-value pairs that are indexed by AWS X-Ray. They are specifically designed to be used with filter expressions to search, filter, and group traces. Adding the user ID as an annotation is the correct method to enable efficient filtering by that identifier in the X-Ray console.
• D. Incorrect. Error messages are intended for capturing details about exceptions and failures within the application. They are not designed or indexed for filtering traces based on custom identifiers like a user ID. Using an error message for this purpose is semantically incorrect and would not work.

Correct answer: B — Review the stdout and stderr logs for the specific hook script execution, found in the deployment logs on the affected instance.

• A. Incorrect. AWS CloudTrail is a service that logs API calls made to your AWS account. It records actions taken by a user, role, or an AWS service. While it would show the API calls made by the CodeDeploy service (e.g., `CreateDeployment`), it does not capture the standard output or error streams from scripts executing on individual EC2 instances during a deployment.
• B. Correct. The AWS CodeDeploy agent, running on each target EC2 instance, captures the standard output (stdout) and standard error (stderr) for every script executed as part of a lifecycle hook. These logs are stored locally on the instance. Reviewing these logs is the most direct and effective way to get detailed error messages and understand the specific reason for a 'Script failed' error.
• C. Incorrect. VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC. While they can be used to diagnose network connectivity problems (which could potentially cause a script to fail), they do not contain any information about the script's execution itself, such as error messages or output. The script's logs should be checked first.
• D. Incorrect. Re-running a failed deployment or pipeline should not be the first step. The logs from the original failed deployment already exist on the affected instances. Checking these existing logs is a more direct and efficient troubleshooting method. Re-running the deployment introduces unnecessary complexity and delay without first understanding the root cause.

Correct answer: A — AWS Config

• A. Correct. AWS Config is the purpose-built service for assessing, auditing, and evaluating the configurations of AWS resources. It can continuously monitor resource configurations against desired compliance rules. AWS provides a managed rule called `restricted-ssh` that specifically checks for this exact violation. When a resource becomes non-compliant, AWS Config can trigger notifications via Amazon SNS, fulfilling the requirement for detection and notification within minutes.
• B. Incorrect. Amazon CloudWatch Logs is a service for collecting, monitoring, and analyzing log data. While it can ingest logs from services like AWS CloudTrail that record security group changes, it does not natively evaluate resource configurations against compliance rules. A complex custom solution would be required to parse logs and determine the configuration state, making it less direct and efficient than AWS Config.
• C. Incorrect. Amazon EventBridge is a serverless event bus that facilitates event-driven architectures. It responds to events generated by other services but does not, by itself, monitor or evaluate resource configurations. It would need to be used in conjunction with a service like AWS Config, which would detect the non-compliant state and then publish an event to EventBridge for further action.
• D. Incorrect. AWS CloudTrail records API activity within an AWS account, providing an audit log of actions taken. While it would record the `AuthorizeSecurityGroupIngress` API call that created the violating rule, it does not continuously evaluate the current state of existing resources for compliance. It records the event of a change, but not the ongoing compliance status of the resource.
• E. Incorrect. Amazon VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC. It is used for network traffic analysis and troubleshooting, showing which traffic was allowed or denied. It provides no insight into the configuration rules of security groups themselves, only the effect of those rules on actual traffic.

Correct answer: A — Pattern A: Orchestration, Pattern B: Choreography

• A. This is the correct answer. Pattern A accurately describes the Orchestration pattern, where a central controller (the 'conductor' or 'orchestrator'), such as an AWS Step Functions state machine, directs the flow of a business process by explicitly invoking different microservices. Pattern B describes the Choreography pattern, where services are decoupled and communicate through events, often using a message bus like Amazon EventBridge. In choreography, each service subscribes to events it's interested in and acts independently without a central coordinator.
• B. This option incorrectly reverses the definitions. Orchestration involves a central controller (Pattern A), whereas Choreography involves decentralized, event-driven communication (Pattern B).
• C. This option is incorrect. While Choreography (Pattern B) often uses a publish/subscribe (Pub-Sub) model which can lead to a fan-out of messages, these are messaging mechanisms rather than the overarching architectural patterns for coordinating business logic. Fan-out is not an accurate description for the centralized, sequential control of Orchestration (Pattern A).
• D. This option is incorrect. Queuing and Streaming are data handling and messaging patterns, but they do not describe the overall architectural control flow. Queuing (e.g., Amazon SQS) is used for decoupling components and ensuring message delivery, while Streaming (e.g., Amazon Kinesis) is for processing continuous data flows. Neither term defines the core distinction between centralized control (Orchestration) and decentralized event reaction (Choreography).

Correct answer: C — AWS GuardDuty

• A. Incorrect. Amazon Macie is a data security service that uses machine learning to discover and protect sensitive data, such as Personally Identifiable Information (PII), stored within AWS services like Amazon S3. It is not designed to scan external, public code repositories for exposed credentials.
• B. Incorrect. AWS Config is a service for assessing, auditing, and evaluating the configurations of your AWS resources. It tracks configuration changes and ensures compliance with rules, but it does not monitor external sources like GitHub for credential exposure.
• C. Correct. AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. It uses threat intelligence feeds and machine learning to identify various threats, including the exposure of IAM credentials on publicly accessible platforms like GitHub. When it detects such an exposure, it generates a high-priority security finding.
• D. Incorrect. IAM Access Analyzer helps you identify resources in your AWS accounts, such as S3 buckets or IAM roles, that are shared with an external entity. It analyzes resource-based policies to find unintended access but does not scan for or detect credentials that have been exposed outside of AWS.

Correct answer: B — AWS Config Rules and AWS Systems Manager Automation documents

• A. This is an incorrect choice. AWS CloudTrail is an auditing service that logs API calls, which is useful for tracking who did what, but it does not natively evaluate the compliance of a resource's configuration state. While a Lambda function could be triggered by a CloudTrail event (like `CreateBucket`) to perform remediation, this approach is less direct and robust than purpose-built compliance services.
• B. This is the correct solution. AWS Config is designed specifically to continuously monitor and record resource configurations and evaluate them against desired rules. When AWS Config detects a non-compliant resource (like an unencrypted S3 bucket), it can be configured to automatically trigger a remediation action. AWS Systems Manager (SSM) Automation documents provide a managed, secure, and repeatable way to define these remediation steps, making this combination the ideal solution for both detection and automated remediation.
• C. This is incorrect. Amazon GuardDuty is a threat detection service that analyzes logs to identify malicious or unauthorized behavior, not to check for configuration compliance. Amazon EventBridge can route events from various services to targets, but it does not have the built-in capability to evaluate resource configurations for compliance.
• D. This is incorrect. CloudFormation hooks are a preventative control, not a detective and corrective one. They can block the provisioning of non-compliant resources *before* they are created, but they only apply to resources managed by CloudFormation stacks. This solution would not detect or remediate non-compliant resources created manually or through other means.

Correct answer: B — Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) using a customer-managed key (CMK).

• A. Incorrect. Server-Side Encryption with S3-Managed Keys (SSE-S3) encrypts data at rest, but it uses encryption keys that are fully managed by Amazon S3. This method does not allow customers to manage access to the keys via policies or audit their usage in detail through AWS CloudTrail, failing to meet the security team's requirements.
• B. Correct. Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) using a customer-managed key (CMK) satisfies all the requirements. It provides strong encryption at rest. By using a customer-managed key, the team gains fine-grained control over who can use the key through KMS key policies and IAM policies. Most importantly, every use of the key is logged as an event in AWS CloudTrail, providing the necessary audit trail for the security team.
• C. Incorrect. Client-side encryption requires that the data be encrypted before it is sent to Amazon S3. This approach complicates the CI/CD pipeline by adding responsibility for key management and the encryption process to the client (e.g., CodeBuild). It does not natively integrate with AWS CloudTrail for centralized auditing of key usage, which is a specific requirement.
• D. Incorrect. With Server-Side Encryption with Customer-Provided Keys (SSE-C), the customer must provide the encryption key along with each request to S3. This places a significant burden on the customer to manage and securely transmit keys. Since AWS does not store or manage these keys, it cannot provide centralized access control or an audit trail of key usage in AWS CloudTrail.

Correct answer: A — AWS WAF for application layer filtering and AWS Shield Advanced for DDoS protection.

• A. This is the correct answer. AWS WAF (Web Application Firewall) integrates directly with API Gateway to provide application-layer (Layer 7) protection against common web exploits like SQL injection and cross-site scripting. AWS Shield Advanced offers enhanced, managed protection against sophisticated and large-scale Distributed Denial of Service (DDoS) attacks at the network, transport, and application layers. Together, they provide a comprehensive, layered security solution at the edge, directly addressing both requirements of the question.
• B. Incorrect. Security groups and Network ACLs are network-level controls that operate within a VPC. They are not designed to inspect application traffic for web exploits and are not the primary defense for a public edge service like API Gateway against sophisticated DDoS attacks. While useful for securing resources within a VPC, they don't provide the required application-layer protection at the edge.
• C. Incorrect. Amazon GuardDuty is a threat detection service, and Amazon Inspector is a vulnerability assessment service. Neither service provides real-time, preventative blocking or mitigation of web exploits or DDoS attacks. They are crucial for monitoring and assessing security posture but do not function as a direct, real-time defense mechanism at the edge.
• D. Incorrect. API Gateway resource policies are used for authorization (controlling who can access the API), and usage plans are for throttling (rate-limiting) and setting quotas. While throttling can help mitigate simple denial-of-service attacks, neither feature inspects request payloads for web exploits like SQL injection nor provides the comprehensive, automated protection against large-scale DDoS attacks that AWS Shield Advanced offers.

Correct answers: B, D — The `Principal` should be the CloudTrail service principal, `cloudtrail.amazonaws.com`.; A `Condition` using the `aws:SourceArn` key and the `aws:SourceOrgID` global condition key should be used to restrict access to trails from within the organization.

• A. Incorrect. Setting the `Principal` to `"AWS": "*"` is highly insecure as it would allow any AWS account to write to the S3 bucket. Bucket policies for log aggregation should always follow the principle of least privilege.
• B. Correct. To allow AWS CloudTrail to deliver logs, the S3 bucket policy must grant permissions to the CloudTrail service principal, `cloudtrail.amazonaws.com`. This is a fundamental requirement for the service to interact with the bucket.
• C. Incorrect. While using `aws:SourceAccount` to list individual account IDs would function, it is not a scalable or maintainable solution for an AWS Organization. Every time an account is added or removed, the policy would require manual updates, making it error-prone.
• D. Correct. This is the AWS best practice for securing an organization-wide log bucket. Using the `aws:SourceOrgID` global condition key ensures that only accounts within your specific organization can deliver logs, making the policy scalable and secure. Further restricting with `aws:SourceArn` limits access to specific CloudTrail trails, which helps prevent the confused deputy problem.
• E. Incorrect. The CloudTrail service needs permissions to write logs, which requires the `s3:PutObject` action. It also needs `s3:GetBucketAcl` to verify permissions before delivery. The `s3:GetObject` permission is for reading objects and is not required by the CloudTrail service to deliver log files.

Correct answers: B, C — Identity-based policies; Session policies

• A. Incorrect. 'Service-based policy' is not a formal IAM policy type defined by AWS. While policies can grant permissions to AWS services (e.g., through service-linked roles), the policies themselves are categorized as either identity-based or resource-based.
• B. Correct. Identity-based policies are one of the main types of IAM policies. They are attached directly to an IAM identity (a user, group, or role) and specify what actions that identity can perform on which resources under what conditions.
• C. Correct. Session policies are an advanced policy type. You pass a session policy as a parameter when you programmatically create a temporary session for a role or a federated user. The permissions of the session are the intersection of the identity's IAM policies and the session policy, effectively allowing you to scope down permissions for a specific session.
• D. Incorrect. 'Entity-based policy' is not a recognized term in AWS IAM. The correct terminology for policies attached to principals like users, groups, or roles is 'identity-based policies'.
• E. Incorrect. While policies contain an 'Action' element to define permissions, 'Action-based policy' is not a category of IAM policy. The structure of a policy includes elements like Effect, Principal, Action, and Resource, but the policy type itself is not named after one of these elements.