AWS Certified Professional DOP-C02 Reddit Questions

The best solution to log and review all stopped tasks for errors is to use Amazon EventBridge and Amazon CloudWatch Logs. Amazon EventBridge allows the DevOps engineer to create a rule that matches task state change events from Amazon ECS. The rule can then send the event data to Amazon CloudWatch Logs as the target. Amazon CloudWatch Logs can store and monitor the log data, and also provide CloudWatch Logs Insights, a feature that enables the DevOps engineer to interactively search and analyze the log data. Using CloudWatch Logs Insights, the DevOps engineer can filter and aggregate the log data based on various fields, such as cluster, task, container, and reason. This way, the DevOps engineer can easily identify and investigate the stopped tasks and their errors.

The other options are not as effective or efficient as the solution in option A. Option B is not suitable because the embedded metric format is designed for custom metrics, not for logging task state changes. Option C is not feasible because the EC2 instances do not store the task state change events in their logs. Option D is not relevant because the EC2_INSTANCE_TERMINATING lifecycle hook is triggered when an EC2 instance is terminated by the Auto Scaling group, not when a task is stopped by Amazon ECS.

Creating a CloudWatch Events Rule That Triggers on an Event - Amazon Elastic Container Service

Sending and Receiving Events Between AWS Accounts - Amazon EventBridge

Working with Log Data - Amazon CloudWatch Logs

Analyzing Log Data with CloudWatch Logs Insights - Amazon CloudWatch Logs

Embedded Metric Format - Amazon CloudWatch

Amazon EC2 Auto Scaling Lifecycle Hooks - Amazon EC2 Auto Scaling

In CodePipeline’s execution mode,

PARALLEL mode for pull_request pipelines ensures that multiple feature branches can be tested simultaneously for quick feedback.

QUEUED mode for main_branch ensures deployments run sequentially — each must finish before the next begins, preventing overlap. This configuration aligns with AWS CodePipeline best practices for trunk-based development and concurrent test pipelines.

 Ensure that Amazon GuardDuty is Enabled:

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior.

It can detect port scans and generate findings for these events.

 Create an Amazon CloudWatch Alarm for Detected EC2 and Port Scan Findings:

Configure GuardDuty to monitor for port scans and other threats.

Create a CloudWatch alarm that triggers when GuardDuty detects port scan activities.

 Connect the Alarm to the SNS Topic:

The CloudWatch alarm should be configured to send notifications to the SNS topic subscribed by the security team.

This setup ensures that the security team receives near-real-time notifications when a port scan is detected on the EC2 instances.

Example configuration steps:

Enable GuardDuty and ensure it is monitoring the relevant AWS accounts.

Create a CloudWatch alarm:

{

" AlarmName " : " GuardDutyPortScanAlarm " ,

" MetricName " : " ThreatIntelIndicator " ,

" Namespace " : " AWS/GuardDuty " ,

" Statistic " : " Sum " ,

" Dimensions " : [

{

" Name " : " FindingType " ,

" Value " : " Recon:EC2/Portscan "

}

],

" Period " : 300,

" EvaluationPeriods " : 1,

" Threshold " : 1,

" ComparisonOperator " : " GreaterThanOrEqualToThreshold " ,

" AlarmActions " : [ " arn:aws:sns:region:account-id:SecurityAlerts " ]

}