Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

Step 1: Creating an Identity Provider in IAMYou first need to configure AWS to trust the external identity provider (IdP), which in this case supports OpenID Connect (OIDC). The IdP will handle the authentication, and AWS will handle the authorization based on the IdP ' s token.

Action: Create an IAM Identity Provider (IdP) in AWS using the existing provider ' s URL, audience, and signature. This step is essential for establishing trust between AWS and the external IdP.

Why: This allows AWS to accept tokens from your external IdP (auth.company.com) for authentication.

Verified Answer: A, C, and E.

Short Explanation: To improve the performance of the application, the DevOps engineer should use Amazon RDS Proxy, implement the database connection opening outside the Lambda event handler code, and connect to the proxy endpoint from the Lambda function.

Amazon RDS Proxy is a fully managed, highly available database proxy for Amazon Relational Database Service (RDS) that makes applications more scalable, more resilient to database failures, and more secure1. By using Amazon RDS Proxy, the DevOps engineer can reduce the overhead of opening and closing connections to the database, which can improve latency and throughput2.

The DevOps engineer should connect the proxy to the Aurora cluster reader endpoint, which allows read-only connections to one of the Aurora Replicas in the DB cluster3. This can help balance the load across multiple read replicas and improve performance for read-intensive workloads4.

The DevOps engineer should implement the database connection opening outside the Lambda event handler code, which means using a global variable to store the database connection object5. This can enable connection reuse across multiple invocations of the Lambda function, which can reduce latency and improve performance.

The DevOps engineer should connect to the proxy endpoint from the Lambda function, which is a unique URL that represents the proxy. This can allow the Lambda function to access the database through the proxy, which can provide benefits such as connection pooling, load balancing, failover handling, and enhanced security.

The other options are incorrect because:

Implementing database connection pooling inside the Lambda code is unnecessary and redundant when using Amazon RDS Proxy, which already provides connection pooling as a service.

Implementing the database connection opening and closing inside the Lambda event handler code is inefficient and costly, as it can increase latency and consume more resources for each invocation of the Lambda function.

Connecting to the Aurora cluster endpoint from the Lambda function is not optimal for read-only queries, as it can direct traffic to either the primary instance or one of the Aurora Replicas in the DB cluster. This can result in inconsistent performance and potential conflicts with write operations on the primary instance.

The requirement is specifically to validate critical user journeys and API endpoints after each deployment and before routing traffic . The most direct AWS-native way to test “real” user flows and endpoints automatically is CloudWatch Synthetics canaries , which can run scripted checks (HTTP/API and browser-style journeys).

Option D minimizes operational overhead because it uses a straightforward managed pattern:

Canaries run against the new deployment to validate endpoints and journeys.

CloudWatch alarms trigger when the canaries fail (objective signal of broken journeys/APIs).

The solution then uses alarm-driven rollback (the intent here is automated rollback without writing custom analysis code or managing multi-service workflows).

Why the other options have more overhead or miss the “user journey/API validation” goal as cleanly:

A focuses on ECS task states (healthy/unhealthy tasks). That can detect deployment failures, but it doesn’t validate critical user journeys or API correctness . Also requires custom Lambda logic for analysis + rollback control.

B adds even more moving parts (Application Insights + alarms + EventBridge + Step Functions). Also, monitoring KPIs is not the same as explicitly validating journeys/endpoints before routing traffic .

C is the highest overhead: canaries plus X-Ray instrumentation across all microservices, trace exporting, custom Lambda analysis, etc. That’s heavy compared to canary + alarm.

So D best matches: “validate journeys/endpoints” + “automated detect + rollback” with least operational overhead by relying on managed canaries and alarms rather than custom code/workflows.