Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

Option B is the correct choice and has the least operational overhead because ECR lifecycle policies are the native, managed feature built specifically to automate image cleanup:

ECR lifecycle policies can expire images based on image age (e.g., images older than X days) and can also enforce retaining a minimum number of images (count-based retention), which directly matches the requirement “retain at least a specified number of images.”

Lifecycle policies work for both tagged and untagged images using rule selection and tagging status filters, so the repository stays clean without custom automation.

Why the other options are not appropriate / higher overhead:

A is invalid: ECR is not S3; S3 lifecycle policies do not manage ECR images .

C and D introduce custom automation (Lambda or SSM scripting), scheduling, permissions, error handling, retries, logging, and ongoing maintenance—higher overhead than a managed lifecycle policy.

RDS Multi-AZ cluster deployments with cross-Region read replicas support near real-time replication ( < 1 min RPO) and fast promotion ( < 10 min RTO). Route 53 CNAME failover redirects application traffic automatically. This is the AWS-recommended DR pattern.

When deploying to a private Amazon EKS cluster, the Kubernetes API server endpoint is not accessible from the public internet, meaning standard CodePipeline deploy actions that use public endpoints cannot directly connect to the cluster. The correct approach is to use AWS CodeBuild running inside a VPC that has connectivity to the private EKS cluster. CodeBuild runs kubectl commands to apply Kubernetes manifests or Helm charts to update the application. Authentication credentials, specifically a kubeconfig file containing the cluster endpoint, certificate authority data, and an authentication token or exec plugin configuration, should be stored securely in AWS Secrets Manager and retrieved by the CodeBuild build environment at runtime. This approach provides secure, auditable, and repeatable deployments without exposing the EKS API server publicly. Options B and D incorrectly assume CodePipeline has a native action that can reach private EKS endpoints directly.

================