AWS Certified DevOps Engineer - Professional (DOP-C02) practice questions

A company runs its AWS CodePipeline in a shared tooling account but deploys the built artifacts into a separate production account using a CloudFormation deploy action. The pipeline currently fails at the deploy stage with an access denied error, even though a cross-account IAM role exists in the production account. The team encrypts the pipeline artifact store with a customer managed AWS KMS key. They want the most reliable way to let the production-account role read the artifacts and deploy them. Which change resolves the failure while keeping access scoped?

• AGrant the production-account deploy role permission to use the customer managed KMS key in the key policy, and allow the tooling-account pipeline role to assume that role, so the role can decrypt and read the artifacts.check_circle Correct
• BReplace the customer managed KMS key on the artifact bucket with the default Amazon S3 managed key, because cross-account CodePipeline actions cannot decrypt artifacts protected by a customer managed key under any configuration.
• CMake the artifact S3 bucket public-read so the production account can fetch the artifacts directly, then attach an administrator policy to the cross-account role so it has enough permissions to deploy.
• DMove the entire pipeline into the production account so no cross-account artifact access is needed, then have developers push source directly into that account to avoid configuring any assume-role trust.

Why A is correct: Cross-account actions fail when the deploy role cannot decrypt the artifacts; adding the role as a key user in the KMS key policy plus the assume-role trust lets it read the encrypted artifact and deploy, with access scoped to that one role.

Why B is wrong: Cross-account decryption with a customer managed key is fully supported once the key policy and bucket grants are correct, so downgrading encryption sacrifices control to fix a problem that is really a missing grant.

Why C is wrong: A public bucket and an administrator policy both breach least privilege and expose build output, and neither addresses the KMS decryption grant that is the actual cause of the access denied error.

Why D is wrong: Collapsing accounts removes the separation the company chose and is a large re-architecture, when the failure is simply a missing KMS key grant on the existing cross-account role.

A security team wants every change to an Amazon S3 bucket policy across the account to trigger an automated response. The team has confirmed that AWS CloudTrail management events are delivered to the default event bus. They need an Amazon EventBridge rule that runs only when a PutBucketPolicy API call occurs, and they want the matched event passed to an AWS Lambda function that evaluates the new policy. With the least custom code, how should the rule be built?

• ACreate an EventBridge rule with an event pattern that matches the aws.s3 event source and the PutBucketPolicy event name, then add the Lambda function as a target so the function receives the matched CloudTrail event directly.check_circle Correct
• BCreate an EventBridge rule with a schedule expression that fires every five minutes and targets a Lambda function that scans CloudTrail logs for any recent PutBucketPolicy call before evaluating the bucket policy.
• CConfigure an Amazon S3 event notification on each bucket for the s3:ObjectCreated event type and route it to the Lambda function, which then reads the current bucket policy and evaluates it.
• DCreate an EventBridge rule that matches all events from the aws.s3 source, then have the Lambda target inspect each event and discard anything that is not a PutBucketPolicy call before evaluating the policy.

Why A is correct: An event pattern keyed on the source and the specific eventName matches only the PutBucketPolicy call, and naming the function as a target delivers the matched event as the payload, so EventBridge does the filtering and invocation with no extra code.

Why B is wrong: A scheduled rule polling CloudTrail can find the call eventually, but it adds latency and log-scanning code, whereas the requirement is an event-driven match on the API call with the least custom logic.

Why C is wrong: S3 event notifications report object-level activity such as ObjectCreated, not bucket policy changes, so this never fires on PutBucketPolicy and fails to detect the management action in scope.

Why D is wrong: Matching every S3 event then filtering inside the function works but invokes Lambda needlessly on unrelated calls and pushes filtering into code, when an event pattern can match only PutBucketPolicy at the rule.

A team runs a stateless web service in a single Amazon EC2 Auto Scaling group fronted by an Application Load Balancer, but every instance and both load balancer nodes currently sit in one Availability Zone. An architecture review flags that the loss of that Availability Zone would take the whole service offline, and the business now requires the tier to keep serving if any single Availability Zone fails. The team wants the most direct configuration changes to make the existing tier survive a zonal failure. Which TWO actions together meet this requirement? (Select TWO.)

• AExtend the Auto Scaling group to span subnets in at least two more Availability Zones so it launches and balances instances across multiple zones.check_circle Correct
• BAdd the subnets of the additional Availability Zones to the Application Load Balancer so it provisions nodes and routes to targets in every chosen zone.check_circle Correct
• CReplace the Application Load Balancer with a Gateway Load Balancer so that traffic is inspected by appliances before it reaches the web instances in the zone.
• DEnable termination protection on the running instances so the Auto Scaling group cannot remove them when an Availability Zone becomes impaired.

Why A is correct: Spreading the Auto Scaling group across multiple Availability Zone subnets means a zonal failure removes only part of the fleet, and the group relaunches the lost capacity in the surviving zones.

Why B is correct: Enabling extra Availability Zone subnets on the load balancer gives it nodes in each zone, so the public endpoint stays reachable and can route to healthy targets even when one zone is lost.

Why C is wrong: A Gateway Load Balancer fronts third-party inspection appliances rather than balancing web traffic, so it is tempting as a load balancer swap but does nothing to spread the web tier across Availability Zones.

Why D is wrong: Termination protection looks like a way to keep capacity, but it only blocks manual termination and cannot keep instances alive when their Availability Zone fails, leaving the single-zone exposure in place.