DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

Comprehensive and Detailed Explanation From Exact Extract of DevOps Engineer documents only:

The correct answer is D because AWS Secrets Manager supports automatic secret rotation and provides built-in rotation templates for supported services, including Amazon ElastiCache for Redis OSS. This gives the least operational overhead for rotating the secret every 60 days.

The requirement also states that employees and applications must access secrets and parameters through AWS Systems Manager Parameter Store. Parameter Store can reference Secrets Manager secrets by using a reserved path, which allows the application to retrieve the secret through Parameter Store while the secret is actually stored and rotated in Secrets Manager.

Why the other options are incorrect:

A. This option correctly uses Secrets Manager rotation, but it does not specifically use the reserved Parameter Store reference path approach that satisfies the access requirement through Parameter Store as clearly as option D.

B. Parameter Store does not provide native automatic rotation for secrets in the same way that Secrets Manager does.

C. This option is possible, but it requires custom Lambda and EventBridge automation, which creates more operational overhead than using native Secrets Manager rotation with the provided template.

Activate AWS Control Tower Guardrail:

Use AWS Control Tower to activate a detective guardrail that checks whether RDS storage is encrypted.

Create SNS Topic for Notifications:

Set up an Amazon Simple Notification Service (SNS) topic in the audit account to receive notifications about non-compliant databases.

Create EventBridge Rule to Filter Non-compliant Events:

Create an Amazon EventBridge rule that filters events related to the guardrail ' s findings on non-compliant RDS instances.

Configure the rule to send notifications to the SNS topic when non-compliant events are detected.

Subscribe Security Engineer ' s Email to SNS Topic:

Subscribe the security engineer ' s email address to the SNS topic to receive notifications when non-compliant databases are detected.

By using AWS Control Tower to activate a detective guardrail and setting up SNS notifications for non-compliant events, the company can efficiently monitor and ensure that all RDS databases are encrypted at rest.

 The correct solution is to create a new assertion safety rule in Route 53 ARC and apply it to the two routing controls. An assertion safety rule is a type of safety rule that ensures that a minimum number of routing controls are always enabled. The ATLEAST type of assertion safety rule specifies the minimum number of routing controls that must be enabled for the rule to evaluate as healthy. By setting the threshold to 1, the rule ensures that at least one routing control is always turned on. This prevents the scenario where both routing controls are accidentally turned off and the application becomes unavailable in both Regions.

The other solutions are incorrect because they do not use safety rules to prevent both routing controls from being turned off. A gating safety rule is a type of safety rule that prevents routing control state changes that violate the rule logic. The OR type of gating safety rule specifies that one or more routing controls must be enabled for the rule to evaluate as healthy. However, this rule does not prevent a user from turning off both routing controls manually. A resource set is a collection of resources that are tested for readiness by Route 53 ARC. A readiness check is a test that verifies that all the resources in a resource set are operational. However, these concepts are not related to routing control states or safety rules. Therefore, creating a new resource set and a new readiness check will not ensure that at least one routing control is turned on at all times. References:

Routing control in Amazon Route 53 Application Recovery Controller

Viewing and updating routing control states in Route 53 ARC

Creating a control panel in Route 53 ARC

Creating safety rules in Route 53 ARC