DOP-C02 Sample Questions & Answers

Amazon S3 caching mode is the best choice here. It allows you to store a cache in an S3 bucket. At the beginning of a build, the cache is downloaded to the local build environment. At the end, the cache is re-uploaded with any changes. This persists dependencies between builds. Local caching (source cache) reuses the Docker container on the build host, which can lead to stale file issues if not managed carefully, violating the 'clean environment' requirement. The Docker layer cache option is for caching layers of a Docker image being built, not general dependencies. 'No cache' is the current slow behavior.

This problem requires advanced CloudWatch functionality. A simple alarm will include all instances. A Lambda function adds complexity. The most elegant solution is to use CloudWatch metric math. By creating an expression like AVG(IF(AGE(m1) > 600, m1)), you can create a dynamic alarm. The METRICS() function can be used to select all CPUUtilization metrics from the Auto Scaling group. The AGE() function returns the age of a metric's latest datapoint in seconds. The IF statement then includes only metrics older than 600 seconds (10 minutes) in the final AVG calculation. This allows a single alarm to dynamically adjust to the fleet while ignoring new instances for a specified period.

This is true. For EC2/On-Premises deployments, AWS CodeDeploy requires the Application Specification File (AppSpec file), which must be named appspec.yml or appspec.yaml, to be located in the root of the directory structure of an application's source code.

Service Control Policies (SCPs) are the correct tool for proactively enforcing permissions boundaries across an entire AWS Organization. By creating an SCP with a Deny effect for the ec2:CreateVolume action and using a condition key aws:RequestTag/ebs:VolumeType with StringNotEquals for gp3, you can prevent the creation of any non-compliant EBS volumes before they are even provisioned. This is a proactive control. AWS Config is a detective control; it detects non-compliance after the resource is created. CloudFormation hooks are specific to CloudFormation and won't prevent manual creation. IAM permissions boundaries apply to entities but are not as broad as SCPs for organizational enforcement.

The correct workflow for deploying a SAM application with a manual review step is as follows: 1. Source: Get the SAM template and code. 2. Build: Use AWS CodeBuild to run sam package. This command packages the application artifacts, uploads them to S3, and produces a new template file (packaged.yaml) with S3 references. 3. Deploy (Create Change Set): Use the AWS CloudFormation provider in CodePipeline with the action CREATE_CHANGESET. This uses the packaged.yaml to create a change set, which shows the proposed changes without applying them. 4. Manual Approval: A manual approval gate is inserted for review. 5. Deploy (Execute Change Set): After approval, use another AWS CloudFormation action with EXECUTE_CHANGESET to apply the previously created changes.

When you use an alias record to point to an Elastic Load Balancer, Route 53 can use the health checks that are part of the load balancer itself. By setting Evaluate Target Health to true on the alias record, Route 53 will consider the record healthy only if the ALB is healthy (i.e., it has at least one healthy target instance). If the ALB in a region becomes unhealthy, Route 53 will automatically stop sending traffic to it, effectively failing over to the next-best latency region that is healthy. This is the most direct and efficient way to integrate ALB health with Route 53 routing decisions.

S3 Object Lock is the AWS feature designed to meet Write-Once-Read-Many (WORM) requirements. When enabled on a bucket, you can set retention periods on objects. In Compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account, for the duration of the retention period. This provides the strongest guarantee of immutability. Governance mode is similar but allows users with special permissions to bypass the lock. MFA Delete adds a layer of protection against accidental deletion but doesn't provide true immutability like Object Lock.

CloudFormation Drift Detection is the feature specifically designed to solve this problem. It allows you to detect whether a stack's actual configuration has 'drifted' from its expected configuration as defined in the template. Running drift detection will show which resources have been modified, added, or deleted outside of CloudFormation's control. Change Sets are for previewing changes before updating a stack, and Stack Policies are for preventing certain updates to stack resources.

The AWS-RunPatchBaseline document in Systems Manager has built-in support for pre- and post-patching hooks. By specifying a script for the post-reboot hook, the team can automate the verification of the application's health immediately after the instance reboots from patching. If this verification script fails (returns a non-zero exit code), the overall patching task for that instance will fail, making it easy to identify problematic instances in the execution history. This is the most integrated and direct way to add verification to the existing Patch Manager workflow.