EventBridge rules and event-driven responses: DOP-C02 study notes and practice questions
What to know about EventBridge rules and event-driven responses for the DOP-C02 exam, from the Incident and Event Response domain (14% of the exam guide), then 3 free questions to test it. Part of the DOP-C02 study guide.
EventBridge is the backbone of automated responses on this exam. Questions ask how to react to something the moment it happens, with no polling.
Rules and patterns
An event pattern matches fields in the event, such as "source": ["aws.codepipeline"] and "detail": {"state": ["FAILED"]}. Content filters support prefixes, numeric ranges, anything-but and exists.
Targets include Lambda, Step Functions, SQS, SNS, Kinesis, ECS tasks, CodePipeline, CodeBuild, Systems Manager Automation, API destinations and other event buses.
Input transformers reshape the event for the target.
Many AWS services emit events for free, such as EC2 state changes, Auto Scaling, CodeDeploy, Config compliance changes, GuardDuty findings and Health events. CloudTrail API calls appear as events too.
Reliability
Each target has a retry policy (up to 24 hours, 185 attempts by default) and a dead-letter queue for events that can’t be delivered.
Lambda is invoked asynchronously: once Lambda accepts the event, failures are handled by Lambda’s own retries and on-failure destinations, not the rule’s retry policy.
Archive and replay store events to reprocess later.
Across accounts and Regions
Send events to an event bus in another account or Region; the target bus’s resource policy must allow it (for example by organization ID).
Centralize security findings or deployment events in one account.
Scheduling and integration
EventBridge Scheduler runs one-time or recurring schedules (rate, cron, with time zones) on many targets, with no servers.
EventBridge Pipes connect a source (SQS, Kinesis, DynamoDB Streams) to a target with filtering and enrichment.
Schema registry discovers event structures.
Common traps
Polling an API for status changes that already arrive as events.
Changing the rule’s retry policy to fix Lambda function errors.
A logistics company's fleet service publishes a ShipmentStatusChanged event to the default event bus in Amazon EventBridge for every status update. The event detail includes a status field such as IN_TRANSIT, DELIVERED or EXCEPTION.
A support Lambda function must open a ticket only when the status is EXCEPTION. Operations also wants to see each event in the rule's metrics and logs. The fleet service team cannot change its code, and the ticketing function should not receive the other events.
Which approach meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Create a Lambda function that reads every ShipmentStatusChanged event from an S3 export, checks the status field, and opens a ticket for each exception.
BB. Create an EventBridge rule on the default event bus with an event pattern that matches the detail-type and the detail status value EXCEPTION, and set the support Lambda function as its target.
CC. Have the fleet service call the ticketing Lambda function directly for every status update, and let the function return early when the status is not EXCEPTION.
DD. Create an SNS topic, subscribe the support function, and publish every ShipmentStatusChanged event to the topic with a filter policy on the message body.
Show the answer and explanation
Answer: B
A. Wrong: The events are not exported to S3 in this design, so the function would have no input. Even if they were, a batch export adds a delay and a function that the team maintains.
B. Right: Correct. The event pattern filters on the detail's status field, so the rule invokes the function only for exceptions and the fleet service is unchanged. EventBridge does the filtering, with no code to maintain. Learn more: Amazon EventBridge event patterns (opens in a new tab)
C. Wrong: The fleet service would have to change its code, which the team cannot do. The function would also be invoked for every update, which adds cost and noise.
D. Wrong: SNS can filter on the message body, but something would have to republish each event from the bus to the topic, which adds a path to build and maintain. The EventBridge rule already filters the events where they arrive. Learn more: Amazon SNS message filtering (opens in a new tab)
Explanation
An EventBridge rule with an event pattern matches on the detail's status field, so only EXCEPTION events invoke the support function. The fleet service keeps its code, and nothing polls. Exports and direct calls add work or change the producer, and republishing to SNS adds a second path to maintain.
A game studio needs a small job to run every 10 minutes to clear expired matchmaking tickets from a DynamoDB table. The table holds about 200,000 tickets, and the job takes about 20 seconds per run. The job is written as an AWS Lambda function.
The studio does not want to run a server or a cron host for the job, and it wants the schedule itself to be managed by AWS. Operations should also be able to see and change the schedule in the console.
Which approach meets these requirements?
Choose one answer.
AA. Create an EventBridge schedule with the expression rate(10 minutes) that invokes the Lambda function as its target.
BB. Install a cron job on a small EC2 instance that calls the Lambda function's Invoke API every 10 minutes, and keep the instance running.
CC. Create a Step Functions state machine with a Wait state of 10 minutes that calls the function and loops forever.
DD. Put a message on an SQS queue with a 10-minute delay each time the function finishes, and let the function re-send the message when it completes.
B. Wrong: This works, but it needs an instance to run, patch and monitor. The studio asked for no server or cron host.
C. Wrong: A looping state machine can run this job, but it keeps an execution open and adds a workflow to maintain for a simple schedule. The schedule service is the simpler managed choice. Learn more: What is Step Functions? (opens in a new tab)
An EventBridge schedule with a rate expression invokes Lambda at the set interval, and AWS manages the timing with no server. A cron host, a looping workflow and a self-rescheduling queue each add something the studio asked to avoid or a point of failure.
An insurance firm publishes ClaimSubmitted events to an EventBridge event bus. A rule sends each event to an AWS Lambda function that validates the claim and writes it to a claims database.
During a database maintenance window, the function returned errors for about 20 minutes, and some claims were lost after the retries ran out. The claims team needs failed claims to be retried for a time, and any event that still cannot be processed must be kept for later reprocessing.
The team wants a configuration change only, without changing the producer or the function's code.
Which change meets these requirements?
Choose one answer.
AA. Set the function's reserved concurrency to a higher number, so that more invocations can run at once and fewer events are dropped during a busy period.
BB. Wrap the handler in a try block that logs any database error and returns a success response, so that the invocation never counts as failed and is never retried.
CC. Configure the function's asynchronous invocation retry attempts and maximum event age, and add an Amazon SQS on-failure destination for events that still fail.
DD. Configure the rule's target with a retry policy for the maximum event age and retry count, and an Amazon SQS dead-letter queue that receives any event the rule cannot deliver.
Show the answer and explanation
Answer: C
A. Wrong: Reserved concurrency controls how many copies of the function can run, and it does not retry events that fail during a database outage. It also changes the function's scaling behavior, which is not what the claims team asked for. Learn more: Configuring reserved concurrency for a function (opens in a new tab)
EventBridge invokes Lambda asynchronously, so once Lambda accepts an event, function errors are handled by Lambda's own retries, not by the rule's retry policy. Configuring the function's asynchronous retry settings and an SQS on-failure destination keeps every event that still fails. Rule-level dead-letter queues, reserved concurrency and swallowed errors leave the claims lost.
Lambda's own async retries handle the failures, and the SQS on-failure destination keeps every event that still fails.
Want more on EventBridge rules and event-driven responses? The 5 full-length practice sets have 13 more EventBridge rules and event-driven responses questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study EventBridge rules and event-driven responses