Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

Failed interactive logins such as ConsoleLogin are part of CloudTrail management events , not data events. The most direct, low-overhead design is to stream management events to CloudWatch Logs , then create a metric filter that matches failed ConsoleLogin events (for example, $.eventName = " ConsoleLogin " and $.responseElements.ConsoleLogin = " Failure " or $.errorMessage ). That metric is then used as the basis for a CloudWatch alarm . When the alarm threshold (e.g., N failures in a period) is breached, the alarm triggers and sends a notification to the already created SNS topic, which alerts the security team.

Option A follows this recommended pattern: CloudTrail → CloudWatch Logs → Metric Filter → Alarm → SNS. It is fully managed, near real-time, and requires minimal custom logic.

Option B uses Athena with EventBridge to periodically query CloudTrail logs in S3. This introduces more moving parts, more configuration, higher latency, and more operational overhead.

Options C and D incorrectly reference CloudTrail data events and S3 event notifications, which are not the right mechanisms to detect ConsoleLogin failures. Console logins are not S3 events, and using data events would miss these management actions.

Therefore, Option A is the correct and simplest solution.

The best solution to implement failover for the application is to use CloudFront origin groups. Origin groups allow CloudFront to automatically switch to a secondary origin when the primary origin is unavailable or returns specific HTTP status codes that indicate a failure1. This way, CloudFront can serve the requests from the secondary ALB in the secondary Region without any delay or redirection. To set up origin groups, the DevOps engineer needs to create a new origin on the distribution for the secondary ALB, create a new origin group with the original ALB as the primary origin and the secondary ALB as the secondary origin, and configure the origin group to fail over for HTTP 5xx status codes. Then, the DevOps engineer needs to update the default behavior to use the origin group instead of the single origin2.

The other options are not as effective or efficient as the solution in option B. Option A is not suitable because creating a second CloudFront distribution will increase the complexity and cost of the application. Moreover, using Route 53 alias records with a failover policy will introduce some delay in detecting and switching to the secondary CloudFront distribution, which may not meet the zero-second RTO requirement. Option C is not feasible because CloudFront does not support using Route 53 alias records as origins3. Option D is not advisable because using a CloudFront function to redirect the requests to the secondary ALB will add an extra round-trip and latency to the failover process, which may also not meet the zero-second RTO requirement.

1: Optimizing high availability with CloudFront origin failover - Amazon CloudFront

2: Creating an origin group - Amazon CloudFront

3: Values That You Specify When You Create or Update a Web Distribution - Amazon CloudFront

The question focuses on detecting supply chain attacks that bypass CI/CD controls and result in malicious runtime behavior in the deployed serverless application. This requires runtime threat detection , not just static scanning or infrastructure validation.

Amazon GuardDuty is AWS’s managed threat detection service. GuardDuty now includes Lambda Protection , which analyzes Lambda function behavior, including network calls, IAM API usage, and other signals to detect compromised functions, crypto-mining, data exfiltration, and other malicious activity. GuardDuty automatically ingests CloudTrail, VPC Flow Logs (if enabled), and other telemetry without requiring code changes or agents. Findings are published and can be routed to Amazon EventBridge for near real-time notifications or automated remediation.

Option A (AWS WAF) only inspects HTTP requests to API Gateway and is focused on known bad patterns, not deeper behavioral anomalies. Option C (CloudFormation Guard) is focused on infrastructure-as-code validation in the pipeline, which explicitly does not help once malicious code is deployed. Option D (Network Firewall with Emerging Threats rules) protects VPC traffic, but serverless components like Lambda and API Gateway may not all traverse that firewall, and it is not targeted at function-level behavior.

Hence, enabling GuardDuty with Lambda Protection and using EventBridge notifications is the correct solution.