‹ All DOP-C02 questions

DOP-C02 Practice Question 39: Step Functions Remediation Retry Catch

AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 4 · question 9 of 10

Incident and Event Responsehard

An automated response to an Amazon GuardDuty finding must snapshot the affected instance's Amazon EBS volumes, replace the instance's security group with an isolation group, open a ticket in an external system, and notify the security channel. Today a single AWS Lambda function performs all four steps in sequence. When the EBS snapshot API throttles, the function raises an exception and the whole response fails; re-running it creates a duplicate ticket for the steps that already succeeded. The team needs each step retried independently with backoff, any unrecoverable failure routed to a quarantine path for a human, and a per-step execution history for the post-incident review.

What should the team do?

Select one answer
Show answer and explanation

Answer:

  • B. Replace the function with an AWS Step Functions state machine in which each action is a Task state with its own Retry block (ErrorEquals, IntervalSeconds, BackoffRate, MaxAttempts) and a Catch block that transitions to a quarantine state

Step Functions puts retry and failure handling in the workflow definition instead of in application code. Task, Parallel, and Map states "can have a field named Retry, whose value must be an array of objects known as *retriers*", where IntervalSeconds sets the first wait, MaxAttempts the cap, and BackoffRate "the multiplier by which the retry interval... increases after each retry attempt". A Catch block then routes an error that retries could not resolve: "when the error name appears in the value of a catcher's ErrorEquals field, the state machine transitions to the state named in the Next field." Because retries are scoped to the state that failed, a throttled snapshot call is retried on its own without re-running the ticket step, and the execution history records every state and attempt for the review.

Option A keeps the all-or-nothing structure. The function is still one unit of work, so any unhandled failure restarts everything, sleeping inside a Lambda function is billed time, and there is no per-step history beyond whatever the code happens to log.

Option C retries at the wrong granularity. SQS redelivery re-invokes the whole function, so the steps that already succeeded run again, which is exactly how the duplicate tickets are being created today.

Option D loses ordering and shared state. The isolation step should not race the snapshot, four independent rules give no way to route a partial failure to quarantine, and each function would still need its own retry logic hand-written.

Reference: Handling errors in Step Functions workflows

Practice Test 4 ›

Study guides for DOP-C02

AWS Service Control Policies Explained: SCPs and DenialsAWS service control policies explained: how SCPs cap permissions, why admins still get access denied, inheritance, deny vs allow lists and the exam traps.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon RDS? Multi-AZ, Read Replicas and BackupsWhat is Amazon RDS? Engines, Multi-AZ, read replicas, backups, RDS Proxy, Aurora and pricing explained, with the traps that AWS exams set around each one.
Best DevOps certification: AWS, Azure, Google or CKAThe best DevOps certification for your stack: AWS DOP-C02, Azure AZ-400, Google Cloud DevOps Engineer and CKA compared on cost, level and prerequisites.
What Is AWS Lambda? Triggers, Concurrency and Cold StartsWhat is AWS Lambda? How functions run, cold starts, triggers vs event source mappings, concurrency, layers, aliases, pricing and the exam traps.
AWS CloudOps Engineer Associate (SOA-C03) exam guideAWS Certified CloudOps Engineer – Associate (SOA-C03) replaced SysOps Administrator. Format, cost, the five domains, what changed and how to prepare.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is Amazon EC2? Instances, AMIs, EBS and Auto ScalingAmazon EC2 explained: instances, AMIs, instance types, security groups, EBS, Auto Scaling groups and pricing options, with the traps AWS exams set.
SQS vs SNS vs EventBridge on AWSWhen to use an SQS queue, an SNS topic or an EventBridge bus, plus fan-out, FIFO ordering, visibility timeouts and dead-letter queues for AWS exams.