DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

AWS CodeDeploy natively supports automatic rollback based on CloudWatch alarms . To use this capability, you define an alarm that indicates unhealthy behavior (for example, increasing application error rate) and attach that alarm to the deployment group in CodeDeploy. If the alarm goes into ALARM state during or after a deployment, CodeDeploy automatically rolls back to the last known good revision when auto rollback is enabled.

Option A correctly implements this pattern:

Derive a CloudWatch metric from application logs (e.g., count of error-level log entries or HTTP 5xx responses).

Create a CloudWatch alarm on that metric with appropriate thresholds.

Configure the deployment group to use the alarm as part of its alarm configuration and enable auto rollback .

Option B uses CodeDeploy agent logs, which may not directly reflect true application health and couples rollback logic tightly to deployment internals rather than application behavior. Options C and D implement custom rollback logic with Lambda and EventBridge, which re-create behavior that CodeDeploy already provides natively and add unnecessary operational and code complexity.

Therefore, Option A is the simplest and most aligned with built-in CodeDeploy features for automated rollback based on application errors.

The problem has two distinct requirements: securely managing rotating external API credentials and encrypting CodeBuild artifacts with a specific KMS key.

For credentials that must be reset each month and are sensitive, AWS Secrets Manager is the appropriate service, not Parameter Store. Secrets Manager provides built-in support for secret rotation, versioning, access control, and auditability. The external API credentials can be updated monthly either manually or via an automated rotation Lambda. CodeBuild can read the secret at build time by assuming an IAM role that allows secretsmanager:GetSecretValue .

To encrypt CodeBuild outputs, the correct pattern is to set the CODEBUILD_KMS_KEY_ID environment variable (or CodeBuild project setting) to the desired KMS key. The CodeBuild IAM service role must be granted kms:Encrypt , kms:Decrypt , and related actions on that KMS key via the key policy or IAM policy. This ensures build artifacts and logs are encrypted using the specified customer managed key.

Option C captures both requirements precisely: store credentials in Secrets Manager and update the KMS key policy for the CodeBuild role , not the CodePipeline role. Options A and B misuse Parameter Store and/or the wrong IAM principal. Option D updates the wrong role and does not connect the KMS key to CodeBuild’s artifact encryption.

CodeDeploy supports TimeBasedLinear traffic shifting for ECS blue/green deployments. Traffic increments by linearPercentage every linearInterval until 100%. This provides zero-downtime gradual rollout — as per CodeDeploy ECS Blue/Green Traffic Shifting documentation.