Amazon Web Services Updated DOP-C02 Exam Questions and Answers by kamil

By default, the AWSCodeCommitPowerUser managed policy allows users to push changes to any branch in any repository in the AWS account. To restrict the developers ' ability to push changes to the main branch directly, an additional policy is needed that explicitly denies these actions for the main branch.

The Deny rule should be included in a policy statement that targets the specific repositories and includes a condition that references the main branch. The policy statement should look something like this:

{

" Effect " : " Deny " ,

" Action " : [

" codecommit:GitPush " ,

" codecommit:PutFile "

],

" Resource " : " arn:aws:codecommit: < region > : < account-id > : < repository-name > " ,

" Condition " : {

" StringEqualsIfExists " : {

" codecommit:References " : [

" refs/heads/main "

]

}

}

This hook runs before the new application version is installed on the replacement instances. This is the best place to run the script because it ensures that the license file is downloaded and installed before the replacement instances start to handle request traffic. If you use any other hook, you may encounter errors or inconsistencies in your application.

The correct answer is B and E. Configuring a higher provisioned concurrency for the Lambda functions will ensure that the functions are ready to respond to the initial burst of requests without any cold start latency. Using Amazon RDS Proxy to create a proxy for the Aurora database will enable the Lambda functions to reuse existing database connections and reduce the overhead of establishing new ones. This will also improve the scalability and availability of the database by managing the connection pool size and handling failovers. Option A is incorrect because reserved concurrency only limits the number of concurrent executions for a function, not pre-warms them. Option C is incorrect because converting the DB cluster to an Aurora global database will not address the issue of database connection latency, and may introduce additional costs and complexity. Option D is incorrect because moving the code blocks that initialize database connections into the function handlers will not improve the performance or scalability of the Lambda functions, and may actually worsen the cold start latency. References:

AWS Lambda Provisioned Concurrency

Using Amazon RDS Proxy with AWS Lambda

Certified DevOps Engineer - Professional (DOP-C02) Study Guide (page 173)

Amazon GuardDuty is the purpose-built AWS threat detection service that continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify suspicious activity such as compromised EC2 instances, command-and-control traffic, and malicious behavior. By enabling GuardDuty and creating an Amazon EventBridge rule that filters for EC2-related GuardDuty findings, the company can drive a fully automated, event-driven response. A Lambda function triggered by EventBridge can extract the affected instance ' s IP address from the finding and programmatically update the VPC network ACL to block all inbound and outbound traffic from that host. This approach requires no custom polling logic, no threat lists to maintain, and no additional security service subscriptions. Amazon Inspector is a vulnerability scanner, not a real-time threat detector, making Option C incorrect. Option D requires Shield Advanced subscription and does not use GuardDuty.

================