DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

To enable cross-account backup, the company needs to grant permissions to both the backup vault and the KMS key in the destination account. The backup vault access policy in the destination account must allow the primary account to copy backups into the vault. The key policy of the KMS key in the destination account must allow the primary account to use the key to encrypt and decrypt the backups. These steps are described in the AWS documentation12. Therefore, the correct answer is A and E.

1: Creating backup copies across AWS accounts - AWS Backup

2: Using AWS Backup with AWS Organizations - AWS Backup

Comprehensive and Detailed Explanation From Exact Extract of DevOps Engineer documents only:

The correct answer is D because AWS Secrets Manager supports automatic secret rotation and provides built-in rotation templates for supported services, including Amazon ElastiCache for Redis OSS. This gives the least operational overhead for rotating the secret every 60 days.

The requirement also states that employees and applications must access secrets and parameters through AWS Systems Manager Parameter Store. Parameter Store can reference Secrets Manager secrets by using a reserved path, which allows the application to retrieve the secret through Parameter Store while the secret is actually stored and rotated in Secrets Manager.

Why the other options are incorrect:

A. This option correctly uses Secrets Manager rotation, but it does not specifically use the reserved Parameter Store reference path approach that satisfies the access requirement through Parameter Store as clearly as option D.

B. Parameter Store does not provide native automatic rotation for secrets in the same way that Secrets Manager does.

C. This option is possible, but it requires custom Lambda and EventBridge automation, which creates more operational overhead than using native Secrets Manager rotation with the provided template.

API Gateway supports canary deployment on a deployment stage before you direct all traffic to that stage. A parallel environment means we will create a new ALB and a target group that will target a new set of EC2 instances on which the newer version of the app will be deployed. So the canary setting associated to the new version of the API will connect with the new ALB instance which in turn will direct the traffic to the new EC2 instances on which the newer version of the application is deployed.