Free DOP-C02 flashcards

For a cross-account AWS CodePipeline deploy where the artifact store uses a customer managed KMS key, what two grants does the target account's deploy role need?

The deploy role needs assume-role trust from the tooling-account pipeline role plus key-usage rights as a key user in the KMS key policy. Without the KMS grant the role cannot decrypt the encrypted artifacts in Amazon S3, so the deploy action returns access denied even though the IAM role and S3 read access exist.

What is the best way to provision standardised AWS CodePipeline pipelines so they stay identical and changes roll out through a managed update path?

Declare the pipeline, its stages such as the security-scan stage, and its IAM roles in an AWS CloudFormation template. Teams instantiate identical pipelines by deploying stacks from the versioned template, and changes to the standard propagate through controlled stack updates, which prevents the drift manual builds cause.

Common misconceptionThat a wiki and PR review keep pipeline definitions consistent. Manual copying still drifts; only a shared template enforces it.

Which AWS CloudFormation feature lets you preview exactly which resources an update would add, modify or replace, and gate execution behind manual approval?

A change set computes the resource-level diff, including any replacements, without touching the live stack. Creating the change set and executing it are separate steps, so a pipeline can pause for sign-off after the affected resources are listed and only proceed once approved. This gives the preview-then-approve workflow that guards against unintended database replacement.

How do you stop one logical resource in an AWS CloudFormation stack from being altered or deleted by routine updates while the rest of the stack stays updatable?

Attach a stack policy, a JSON document CloudFormation evaluates on every update. An explicit Deny on Update:Modify and Update:Delete scoped to that resource's logical ID blocks changes to it, while Allow statements keep every other resource updatable. The guardrail lives with the stack and needs no human reviewer to catch risky diffs.

Common misconceptionThat DeletionPolicy: Retain protects a resource from being modified during a stack update. It only governs deletion, not in-place changes.

How can a self-service pipeline cap developer-created IAM roles to approved services and block privilege escalation automatically at creation?

Attach an IAM permission boundary to each role at creation. The boundary is a managed policy defining the maximum permissions an identity-based policy can grant; effective permissions are the intersection of boundary and attached policies. Allowing only approved services and denying iam:Attach and iam:Put lets developers add scoped policies while no role can reach unapproved services or attach an administrator policy.

What control guarantees that no principal in a member account, even an account administrator, can run cloudtrail:StopLogging or cloudtrail:DeleteTrail?

A service control policy attached to the organisational unit in AWS Organizations. An SCP sets the maximum permissions for every principal in the targeted accounts, including local administrators, and is managed only from the management account. Denying those CloudTrail actions there is a preventive guardrail that local IAM policies, permission boundaries, or detective tools cannot remove.

Common misconceptionThat a permission boundary is a guardrail an account administrator cannot undo. It is set inside the account, so a local admin can edit or detach it at will.

How can a single Amazon RDS database survive an Availability Zone failure with automatic failover and no application code changes?

Convert it to an RDS Multi-AZ deployment. AWS keeps a synchronous standby in a second Availability Zone and, when the primary is impaired, automatically updates the same DNS endpoint to point at the standby. Applications reconnect to the unchanged endpoint, recovery takes minutes, and operational overhead stays low.

Which Amazon Route 53 routing automatically shifts public API traffic from a healthy primary Region to a secondary Region with no manual DNS edit during an incident?

Route 53 failover routing pairs a primary and a secondary record, each tied to a health check on its regional endpoint. While the primary health check passes, Route 53 answers with the primary; on failure it automatically returns the secondary. This gives hands-off active-passive failover within DNS time-to-live windows.

Common misconceptionThat latency-based Route 53 routing fails over automatically when a Region goes down. It optimises for speed, not health, so it can keep sending traffic there.