Free Practice Questions for Amazon Web Services DOP-C02 Exam

The startup delay occurs because large container images must be pulled from Amazon ECR when pods are scheduled, especially on newly added nodes that do not have cached images. To consistently reduce pod startup time to seconds, container images must be prefetched directly onto the worker nodes that run the pods, not the EKS control plane.

Amazon EKS control plane nodes are fully managed by AWS and cannot be accessed or modified using AWS Systems Manager. Therefore, any solution that attempts to run Systems Manager commands on control plane nodes is invalid. Prefetching must target the EKS worker nodes (EC2 instances in managed node groups) where container images are actually stored and used.

Option C correctly creates an IAM role that allows Amazon EventBridge to invoke AWS Systems Manager to run commands on the EKS worker nodes. By using Systems Manager State Manager associations with node tags , the automation dynamically targets both existing nodes and newly added nodes that inherit the same tags. This ensures that container images are pulled immediately when a new image is pushed to ECR or when new nodes join the cluster.

Option B incorrectly targets nodes based on machine size, which is not reliable for lifecycle automation. Options A and D incorrectly reference control plane nodes, which cannot be managed with Systems Manager.

Therefore, Option C is the correct and AWS-aligned solution to ensure fast pod startup times across all nodes.

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#appspec-hooks-lambda

Systems Manager State Manager with Automation documents allows running scripts sequentially and reliably with built-in retry and status tracking.

Using EventBridge with SNS for notifications leverages managed services with minimal custom development.

Using SES (Options B, D) requires more setup and custom logic for email formatting and sending.

Lambda (Options C, D) can run scripts but might have limitations on execution time and complexity compared to Systems Manager Automation.

Amazon CloudWatch Logs now supports data protection policies that can mask sensitive data in logs at ingestion time using custom data identifiers. By creating a custom data identifier matching the employee ID pattern (Emp-\d{6}), the administrator can mask those patterns in new log entries automatically.

Assigning an IAM policy that denies the logs:Unmask action to engineers prevents them from seeing unmasked sensitive data, enforcing least privilege access.

This approach is operationally efficient because it uses built-in CloudWatch Logs data protection capabilities without the need for complex custom code or manual log filtering.

Option C requires writing and managing Lambda functions for log transformation, increasing operational overhead. Option D is more complex and reactive rather than preventing the sensitive data exposure. Option B incorrectly references NotAction and managed identifiers that may not match the custom pattern.

Amazon GuardDuty is the purpose-built AWS threat detection service that continuously analyzes CloudTrail, VPC Flow Logs, and DNS logs to identify suspicious activity such as compromised EC2 instances, command-and-control traffic, and malicious behavior. By enabling GuardDuty and creating an Amazon EventBridge rule that filters for EC2-related GuardDuty findings, the company can drive a fully automated, event-driven response. A Lambda function triggered by EventBridge can extract the affected instance ' s IP address from the finding and programmatically update the VPC network ACL to block all inbound and outbound traffic from that host. This approach requires no custom polling logic, no threat lists to maintain, and no additional security service subscriptions. Amazon Inspector is a vulnerability scanner, not a real-time threat detector, making Option C incorrect. Option D requires Shield Advanced subscription and does not use GuardDuty.

================

Container restart failures require detailed observability into pod-level, node-level, and container-level metrics and logs. CloudWatch Container Insights is purpose-built for Kubernetes operational diagnostics and provides granular visibility into CPU, memory, network I/O, disk I/O, container restarts, OOM kills, throttling, pod lifecycle issues, and Kubernetes control plane behaviors.

The CloudWatch Observability add-on deploys Fluent Bit and the CloudWatch Agent directly into the EKS cluster as DaemonSets. These components automatically collect:

Container logs

Pod metrics

Node metrics

Cluster events

OOM errors

CrashLoopBackOff restart cycles

Control plane request anomalies

With this data, the DevOps engineer can easily identify misconfigurations, resource bottlenecks, unhealthy nodes, failing containers, or image pull issues.

Option A (dashboards only) lacks per-container diagnostic data.

Option B (CloudTrail) only logs API calls — not useful for restart debugging.

Option C (CloudTrail Insights) only detects anomalous API usage, not container failures.

Therefore, CloudWatch Container Insights is the correct and AWS-recommended solution for diagnosing container restart failures in EKS.

When a Lambda function processes an SQS batch and a subset of messages fail, the default behavior re-queues the entire batch, causing already-successfully-processed messages to be delivered and processed again. The ReportBatchItemFailures feature in the Lambda event source mapping allows the function to return a partial failure response, indicating only the specific message IDs that failed. Lambda then deletes the successfully processed messages from the queue and re-queues only the failed items, preventing duplicate processing of successful messages. This approach maintains high concurrency because it does not restrict parallelism. Setting batch size to 1 (Option B) avoids batching entirely but eliminates the concurrency and throughput benefits. Reserved concurrency of 1 (Option D) severely restricts scalability. A 1-second batch window (Option A) affects how long Lambda waits to form a batch but does not prevent duplicate processing.

================

The requirements describe a classic attribute-based access control (ABAC) model using AWS IAM. The company already has consistent tagging across users and resources, which is ideal for ABAC and least-privilege enforcement at scale.

First, Option A is required because IAM roles should represent job functions (developer vs. database administrator) and be scoped per project. Creating separate roles per project and job function allows permissions to be isolated cleanly and prevents cross-project access.

Second, Option B enforces project-level isolation at the policy level . By modifying the existing job-function policies to include a StringEquals condition that compares aws:ResourceTag/Project with aws:PrincipalTag/Project, access is automatically limited to only those resources that belong to the same project as the user. This is an AWS-recommended ABAC pattern and avoids policy sprawl.

Third, Option C is required so users can assume roles only when their tags match the role’s tags . An IAM policy attached to users that allows sts:AssumeRole only if both project and job function tags match ensures users cannot assume roles outside their assigned scope.

Options D, E, and F either misapply policies to the wrong entities, misuse tagging on policies (which IAM does not evaluate for authorization), or introduce unnecessary group-based management that conflicts with the ABAC design.

Therefore, A, B, and C together provide least privilege, project isolation, and scalable access control with minimal ongoing administration.

Using an organization trail with logs centralized in the audit account’s S3 bucket ensures compliance and isolation. An EventBridge rule in the audit account triggers on failed login events (ConsoleLogin failed) and sends SNS notifications in near real time.