Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

The correct answer is A.

Option A is correct because it meets the requirements with the most operational efficiency. Updating the ecommerce application to emit a JSON object to a CloudWatch log group for each processed transaction is a simple and cost-effective way to collect the data needed for the dashboard. Using CloudWatch Logs Insights to query the log group and to visualize the results in a pie chart format is also a convenient and integrated solution that leverages the existing CloudWatch dashboards. Attaching the results to the desired CloudWatch dashboard is straightforward and does not require any additional steps or services.

Option B is incorrect because it introduces unnecessary complexity and cost. Updating the ecommerce application to emit a JSON object to an Amazon S3 bucket for each processed transaction is a valid way to store the data, but it requires creating and managing an S3 bucket and its permissions. Using Amazon Athena to query the S3 bucket and to visualize the results in a pie chart format is also a valid way to analyze the data, but it incurs charges based on the amount of data scanned by each query. Exporting the results from Athena and attaching them to the desired CloudWatch dashboard is also an extra step that adds more overhead and latency.

Option C is incorrect because it uses AWS X-Ray for an inappropriate purpose. Updating the ecommerce application to use AWS X-Ray for instrumentation is a good practice for monitoring and tracing distributed applications, but it is not designed for aggregating product transaction details. Creating a new X-Ray subsegment and adding an annotation for each processed transaction is possible, but it would clutter the X-Ray service map and make it harder to debug performance issues. Using X-Ray traces to query the data and to visualize the results in a pie chart format is also possible, but it would require custom code and logic that are not supported by X-Ray natively. Attaching the results to the desired CloudWatch dashboard is also not supported by X-Ray directly, and would require additional steps or services.

Option D is incorrect because it introduces unnecessary complexity and cost. Updating the ecommerce application to emit a JSON object to a CloudWatch log group for each processed transaction is a simple and cost-effective way to collect the data needed for the dashboard, as in option A. However, creating an AWS Lambda function to aggregate and write the results to Amazon DynamoDB is redundant, as CloudWatch Logs Insights can already perform aggregation queries on log data. Creating a Lambda subscription filter for the log file is also redundant, as CloudWatch Logs Insights can already access log data directly. Attaching the results to the desired CloudWatch dashboard would also require additional steps or services, as DynamoDB does not support native integration with CloudWatch dashboards.

Option B is the correct choice and has the least operational overhead because ECR lifecycle policies are the native, managed feature built specifically to automate image cleanup:

ECR lifecycle policies can expire images based on image age (e.g., images older than X days) and can also enforce retaining a minimum number of images (count-based retention), which directly matches the requirement “retain at least a specified number of images.”

Lifecycle policies work for both tagged and untagged images using rule selection and tagging status filters, so the repository stays clean without custom automation.

Why the other options are not appropriate / higher overhead:

A is invalid: ECR is not S3; S3 lifecycle policies do not manage ECR images .

C and D introduce custom automation (Lambda or SSM scripting), scheduling, permissions, error handling, retries, logging, and ongoing maintenance—higher overhead than a managed lifecycle policy.

AWS Control Tower provides an integrated governance framework that combines both preventive controls, implemented as Service Control Policies at the OU level, and detective controls, implemented as AWS Config rules applied across all enrolled accounts. Control Tower automatically applies these guardrails to all accounts in enrolled OUs. When new accounts are provisioned through Account Factory, they are automatically enrolled in the assigned OU and receive all applicable preventive and detective controls immediately without manual intervention. Option A uses only SCPs, covering only preventive controls without built-in detective capabilities. Option C requires manually updating stack sets when new accounts are created and does not provide preventive controls via SCPs. Option D provides only detective controls through Config rules with no preventive guardrails. Control Tower is the only option that natively handles both control types and automatically governs newly created accounts.

================