DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

RDS Multi-AZ cluster deployments with cross-Region read replicas support near real-time replication ( < 1 min RPO) and fast promotion ( < 10 min RTO). Route 53 CNAME failover redirects application traffic automatically. This is the AWS-recommended DR pattern.

The company requires an organization-wide, centralized, and automated solution to detect sensitive data in Amazon S3, aggregate findings in one location, and quarantine affected objects with minimal operational overhead. AWS provides a native service specifically designed for this purpose: Amazon Macie .

Option A is essential because Amazon Macie automatically discovers and classifies sensitive data such as PII in S3 buckets using managed machine learning models. When enabled at the organization level , Macie scans buckets across all accounts and Regions. Integrating Macie with AWS Security Hub centralizes all findings in a single dashboard, allowing the company’s security officer to review and manage sensitive data alerts across the organization without building custom aggregation pipelines.

Detection alone is not sufficient; remediation is also required. Option C completes the solution by using Amazon EventBridge , which natively receives Macie findings in near real time. An EventBridge rule can trigger a Lambda function whenever Macie identifies sensitive data. The Lambda function can then copy the affected object to a quarantine S3 bucket and delete the original object, meeting the remediation requirement automatically and consistently.

Option D requires custom sensitive data detection logic, which is complex, error-prone, and unnecessary given Macie’s capabilities. Option E is invalid because SCPs cannot inspect or move data. Option B does not detect sensitive information.

Therefore, A and C together provide the most efficient, scalable, and AWS-recommended solution.

AWS recommends centralizing CodeDeploy agent logs in Amazon CloudWatch Logs for efficient analysis. By configuring the CloudWatch agent or using the CodeDeploy console integration, you can stream logs in near-real time and query them with CloudWatch Logs Insights. This enables filtering by deployment lifecycle events, saving time versus manually connecting to instances. Refer to AWS documentation section “Monitoring and troubleshooting deployments with CodeDeploy and CloudWatch.”