Amazon Web Services DOP-C02 - AWS Certified DevOps Engineer - Professional

Comprehensive and Detailed Explanation From Exact Extract of DevOps Engineer documents only:

During an Amazon ECS service deployment, if tasks fail the Elastic Load Balancing target group health checks, Amazon ECS considers those tasks unhealthy and stops and replaces them. This behavior can cause the deployment to remain incomplete because healthy replacement tasks never become available.

Also, if an essential container in the task exits, the entire task stops. Since the question states that the new tasks enter a stopped state soon after launch, an essential container failure is a direct and highly likely cause.

Why the other options are incorrect:

B. The IAM role used by the DevOps engineer to update the ECS service does not need RunTask permission for the tasks to remain running after launch. A permission issue here would more likely affect the update action itself rather than cause launched tasks to stop shortly afterward.

C. Although CloudWatch Logs configuration problems can affect logging, the missing log group is not the most likely direct reason for ECS tasks to repeatedly stop in this deployment scenario.

D. The task role provides permissions to the application code running inside the container. It is not the role primarily responsible for launching the task. Task startup is typically related to the task execution role, ECS service behavior, container health, and load balancer checks.

AWS Control Tower provides Account Factory and Account Factory Customizations (AFC) as the lowest-overhead and most scalable method for creating and configuring new accounts. AFC allows you to define blueprints that include mandatory baseline resources such as IAM roles, logging configurations, guardrails, network settings, and tagging standards. When accounts are created through Account Factory using a customization blueprint, all controls and baseline configurations are applied automatically during provisioning, without any additional automation steps or StackSet deployments.

Option B requires running StackSets after the account is created, which adds manual management overhead and defeats the built-in automation advantages of Control Tower. Options C and D rely on manually provisioning accounts via AWS Organizations, which bypasses Control Tower’s governance and would require custom Lambda or StackSet automation to replicate controls that Control Tower already provides automatically.

Because the question explicitly asks for the least operational overhead, the correct answer is to use the Control Tower AFC blueprint, ensuring every account is born compliant with the required guardrails and baseline configuration.

CloudFormation modules are the best fit because the requirement is reusable, portable infrastructure configuration that can be shared across multiple AWS member accounts with low administrative overhead. AWS describes CloudFormation modules as reusable resource configurations that can be included across stack templates in a repeatable and manageable way. This is stronger than nested stacks because modules are designed as standardized building blocks and can be published and versioned through the CloudFormation registry. CDK is powerful, but option A only stores source code and does not provide a registry-based sharing mechanism. AWS SAM is focused on serverless applications and is not the cleanest fit for EKS, FSx for Lustre, and S3 infrastructure patterns.

================

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html#appspec-hooks-lambda

When deploying to a private Amazon EKS cluster, the Kubernetes API server endpoint is not accessible from the public internet, meaning standard CodePipeline deploy actions that use public endpoints cannot directly connect to the cluster. The correct approach is to use AWS CodeBuild running inside a VPC that has connectivity to the private EKS cluster. CodeBuild runs kubectl commands to apply Kubernetes manifests or Helm charts to update the application. Authentication credentials, specifically a kubeconfig file containing the cluster endpoint, certificate authority data, and an authentication token or exec plugin configuration, should be stored securely in AWS Secrets Manager and retrieved by the CodeBuild build environment at runtime. This approach provides secure, auditable, and repeatable deployments without exposing the EKS API server publicly. Options B and D incorrectly assume CodePipeline has a native action that can reach private EKS endpoints directly.

================

The requirement is to create automation that deletes unattached EBS volumes that have been unattached for 14 days. To do this, the DevOps engineer needs to use the following steps:

Create an Amazon CloudWatch Events rule to execute an AWS Lambda function daily. CloudWatch Events is a service that enables event-driven architectures by delivering events from various sources to targets. Lambda is a service that lets you run code without provisioning or managing servers. By creating a CloudWatch Events rule that executes a Lambda function daily, the DevOps engineer can schedule a recurring task to check and delete unattached EBS volumes.

The Lambda function should find unattached EBS volumes and tag them with the current date, and delete unattached volumes that have tags with dates that are more than 14 days old. The Lambda function can use the EC2 API to list and filter unattached EBS volumes based on their state and tags. The function can then tag each unattached volume with the current date using the create-tags command. The function can also compare the tag value with the current date and delete any unattached volume that has been tagged more than 14 days ago using the delete-volume command.

API Gateway supports canary deployment on a deployment stage before you direct all traffic to that stage. A parallel environment means we will create a new ALB and a target group that will target a new set of EC2 instances on which the newer version of the app will be deployed. So the canary setting associated to the new version of the API will connect with the new ALB instance which in turn will direct the traffic to the new EC2 instances on which the newer version of the application is deployed.

Amazon S3 can generate server access logs that record detailed information about each request, including requester, bucket, key, operation, time, and status. These logs are written as objects to an S3 bucket. To analyze access patterns, the simplest and most serverless approach is to use Amazon Athena directly on those logs without building ingestion pipelines or databases.

Option B enables S3 server access logging and then creates an Athena external table over the log bucket. AWS provides standard log formats and even example schemas for S3 access logs. The analytics team can run ad hoc SQL queries to count the number of accesses per object per time period, filter by user, and perform aggregations, all without provisioning compute or managing databases.

Option A requires ingesting logs into Aurora, which adds ETL complexity and ongoing database management. Option C requires a Lambda function for every access event plus DB writes, which is more complex and potentially expensive at scale. Option D uses CloudWatch Logs and Managed Flink, which is more suited for streaming analytics and is significantly more complex than necessary for monthly summary reports.

Therefore, Option B provides the required analysis with the least development and operational effort.