Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

Amazon CloudWatch metric streams are designed to deliver metrics in near real time to downstream services like Amazon Data Firehose with minimal configuration and management overhead. By configuring a metric stream to include all metrics, you ensure that any newly created performance or custom metrics are automatically included without needing to update filters or code when namespaces or metrics change.

Option B uses a CloudWatch metric stream → Firehose → Lambda → S3 pattern. Firehose natively supports invoking a Lambda function for in-flight transformation of the metric data before final delivery to S3. This satisfies the requirement to transform metrics before storing them and provides a fully managed, serverless pipeline with very little ongoing operational burden.

Option A mentions including metrics from “the application and the CloudWatch namespace,” which implies more manual selection and maintenance, potentially missing new metrics if not explicitly added. Options C and D work at the log level, not at the metric level, and would require building additional logic to derive metrics from logs. This is more complex and not aligned with “least operational overhead.”

Therefore, Option B is the most efficient and scalable solution.

 Step 1: Using AWS IAM Identity Center for SAML-based Identity Federation

To ensure that all users accessing the AWS Management Console are authenticated via the corporate identity provider (IdP), the best approach is to set up identity federation with AWS IAM Identity Center (formerly AWS SSO) using SAML 2.0.

Action: Use AWS IAM Identity Center to configure identity federation with the corporate IdP that supports SAML 2.0.

Why: SAML 2.0 integration enables single sign-on (SSO) for users, allowing them to authenticate through the corporate IdP and gain access to AWS resources.

AWS Config offers a managed rule called CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK to detect stack drift automatically.

Creating an SNS topic and subscribing the DevOps lead enables simple notification without custom Lambda functions.

An EventBridge rule that triggers on NON_COMPLIANT status (when drift is detected) can send alerts directly to SNS.Option B adds complexity by requiring custom rules and Lambda. Option C incorrectly triggers on COMPLIANT, not NON_COMPLIANT. Option D needs a Lambda for email, while SNS can send email directly.Hence, Option A offers the least operational effort.