Amazon Web Services · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
17% of exam · 6 sample questions below
A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?
Modify the stack's CloudFormation template to include the recipe.
Upload the recipe to a custom cookbook repository and assign it to the 'Configure' lifecycle event in the stack settings.
This is the standard way to run custom recipes on OpsWorks lifecycle events.
Add the recipe commands to the instance's user data script.
Use AWS CodeDeploy to trigger the recipe during the Configure event.
An organization uses AWS Elastic Beanstalk for application deployments. They want to implement immutable updates to minimize downtime and ensure that if the new environment fails health checks, the old environment remains intact. Which deployment policy should they choose?
Traffic splitting.
Immutable update.
Immutable updates create a completely new environment and only swap when healthy.
All at once.
Rolling update based on health.
A DevOps team is designing a CI/CD pipeline using AWS CodeBuild and CodePipeline. They want to use infrastructure as code to define the build environment. Which TWO options are valid approaches to define the build environment in CodeBuild?
Configure CodeDeploy to set up the build environment before the build starts.
Define the build environment using a buildspec.yml file that includes runtime versions and environment variables.
The buildspec file is the primary way to define build commands and environment.
Use an Elastic Beanstalk environment to run the build.
Use a custom Docker image stored in Amazon ECR as the build environment.
CodeBuild allows you to specify a custom image to run builds in.
Use an AWS CloudFormation template to specify the build environment configuration.
A company manages its infrastructure using AWS CloudFormation. They have a production stack that includes an Amazon RDS Multi-AZ DB instance. The stack was created using the 'aws cloudformation create-stack' command with default settings. The DB instance uses a custom DB parameter group. A DevOps engineer needs to modify a parameter in the DB parameter group and update the stack. The engineer updates the template to change the parameter value and runs 'aws cloudformation update-stack'. The update fails with a 'ROLLBACK_IN_PROGRESS' status. The engineer checks the CloudFormation console and sees that the DB instance was successfully modified, but the stack is rolling back. The rollback fails because the DB instance cannot be reverted to the original parameter value. The stack is now in 'UPDATE_ROLLBACK_FAILED' state. What should the engineer do to resolve this situation and apply the desired parameter change?
Run 'aws cloudformation update-stack' again with the original template to revert the changes.
Use the 'aws cloudformation continue-update-rollback' command with the '--resources-to-skip' parameter to skip the DB instance, allowing the stack to reach 'UPDATE_ROLLBACK_COMPLETE'. Then apply a change set with the desired parameter change.
This is the recommended approach to recover from a failed rollback without deleting the stack.
Revert the parameter value manually in the RDS console and then resume the rollback.
Delete the stack and recreate it with the updated template.
A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?
Set the CreationPolicy attribute on the database resource.
Configure a Stack Policy to protect the database resource.
Set the UpdatePolicy to AutoScalingRollingUpdate.
Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.
AutoScalingReplacingUpdate is only supported for AWS::AutoScaling::AutoScalingGroup and cannot be applied to an AWS::RDS::DBInstance resource.
A DevOps engineer is designing an AWS CloudFormation template to deploy a three-tier web application. The application must be highly available across multiple Availability Zones. The engineer needs to ensure that the database layer uses a Multi-AZ deployment. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)
Define a separate 'AWS::RDS::DBSubnetGroup' resource with subnets from at least two Availability Zones.
Deploy the database with multiple read replicas in different Availability Zones.
Select a database engine that supports Multi-AZ deployments.
Not all engines support Multi-AZ; e.g., Microsoft SQL Server requires specific editions.
Configure the database to use a DB subnet group with subnets in a single Availability Zone.
Set the 'MultiAZ' property of the 'AWS::RDS::DBInstance' resource to 'true'.
This enables Multi-AZ deployment with automatic failover.
Want more Configuration Management and IaC practice?
Practice this domain15% of exam · 6 sample questions below
A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. During a recent traffic spike, the application became unavailable for 10 minutes. Analysis shows that the ALB's healthy host count dropped to zero because the instances failed health checks due to high CPU load. What is the MOST effective design change to improve resilience during future traffic spikes?
Use predictive scaling with a scheduled scaling policy for known peak times.
Predictive scaling anticipates demand and scales out in advance, preventing overload.
Increase the instance size to handle higher load.
Configure step scaling policies based on CPU utilization.
Set a higher CPU threshold for health checks.
A company's application runs on EC2 instances in a single Availability Zone. The operations team wants to improve resilience without redesigning the application. Which action is the MOST effective?
Use a larger instance type to handle more traffic.
Enable EC2 Auto Recovery to automatically restart the instance if it fails.
Deploy EC2 instances across multiple Availability Zones using an Auto Scaling group.
Multi-AZ deployment ensures application availability even if one AZ fails.
Place the instance in a placement group to ensure low latency.
A company's application uses Amazon SQS to decouple microservices. During peak hours, the SQS queue backlog grows significantly, causing processing delays. The DevOps team wants to reduce latency without increasing costs unnecessarily. What should the team do?
Increase the visibility timeout to allow consumers more time to process messages.
Use an SQS queue with priority settings to process high-priority messages first.
Increase the SQS queue's throughput by requesting a quota increase.
Configure Auto Scaling for the consumer fleet based on the ApproximateNumberOfMessagesVisible metric.
Auto Scaling adds consumers as queue depth increases, reducing processing time.
A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes orders and stores them in an RDS PostgreSQL database. The company wants to ensure that the order service is resilient to AZ failures and can handle a sudden increase in order volume. Which TWO actions should the DevOps engineer take? (Choose TWO.)
Increase the CPU and memory limits for the ECS task definition.
Place an Amazon CloudFront distribution in front of the order service.
Deploy the RDS instance in a Multi-AZ configuration.
Multi-AZ RDS provides automatic failover to a standby in another AZ.
Configure the ECS service to run tasks in multiple Availability Zones.
Multi-AZ task placement ensures that if one AZ fails, tasks in other AZs continue.
Use RDS Proxy to manage database connections.
A company's application uses Amazon DynamoDB as its primary data store. The application experiences occasional throttling errors during traffic spikes. The DevOps team needs to implement a solution that ensures consistent performance without manual intervention. Which TWO actions should the team take? (Choose TWO.)
Use eventually consistent reads for all queries.
Move the data to Amazon RDS with read replicas.
Implement DynamoDB Accelerator (DAX) to cache read requests.
DAX reduces read load on DynamoDB, mitigating throttling for read-heavy workloads.
Enable DynamoDB Auto Scaling for read and write capacity.
Auto Scaling automatically adjusts capacity based on traffic, preventing throttling.
Switch DynamoDB to On-Demand capacity mode.
A company wants to design a highly available web application using AWS services. The application must be resilient to the failure of an entire AWS Region. Which THREE components should the architecture include? (Choose THREE.)
An Application Load Balancer (ALB) deployed in one Region.
Amazon Route 53 with a failover routing policy.
Failover routing directs traffic to a secondary Region if the primary fails.
Auto Scaling groups in each Region with appropriate instance types.
Auto Scaling ensures that the application can handle traffic in each Region.
Amazon EC2 instances in a single Region.
Amazon RDS Multi-AZ deployment with a cross-Region read replica.
Cross-Region read replicas provide disaster recovery across Regions.
Want more Resilient Cloud Solutions practice?
Practice this domain15% of exam · 6 sample questions below
A DevOps team is using Amazon CloudWatch Logs to collect application logs from multiple EC2 instances. They notice that some log entries are missing and that the CloudWatch agent is consuming high CPU. The log group has a retention policy of 30 days. Which action should the team take to reduce CPU usage without losing log data?
Increase the batch size in the CloudWatch agent configuration.
Correct: Larger batch size reduces API calls and CPU usage.
Use JSON format for logs instead of plain text.
Set the agent's timezone to UTC.
Change the log group retention policy to 7 days.
A company wants to monitor the number of messages in an Amazon SQS queue and send an alert if the queue depth exceeds 1000 for more than 5 minutes. Which AWS service should be used to create the alarm?
Amazon EventBridge
Amazon CloudWatch Alarms
Correct: CloudWatch Alarms monitor metrics and trigger actions.
AWS X-Ray
Amazon CloudWatch Logs
A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are deployed in multiple AWS regions. The team wants to aggregate the canary results into a single dashboard in the US East (N. Virginia) region. What is the MOST efficient way to achieve this?
Replicate the canaries to US East (N. Virginia) and run them from there.
Create a cross-region CloudWatch dashboard and add metrics from each region using metric math.
Correct: Cross-region dashboards natively support displaying metrics from different regions.
Set up a Lambda function in each region to push canary results to a central S3 bucket, then create a dashboard from S3.
Create a CloudWatch Logs Insights query across all regions and visualize results.
A DevOps team is troubleshooting a slow application. They enabled AWS X-Ray tracing and see that one of the downstream services has a high average response time. However, the traces show that the service itself is fast; the delay is in the network call from the upstream service. Which X-Ray feature should the team use to identify the root cause?
Examine the trace map to see the connection between services.
Correct: The trace map visualizes service connections and latency.
Add annotations to the traces for better filtering.
View the raw segments of the upstream service.
Adjust the sampling rules to capture more traces.
A company needs to monitor the CPU utilization of its Amazon RDS for PostgreSQL instance. The metric should be available in Amazon CloudWatch with a granularity of 1 minute. Which action should the team take?
Install the CloudWatch agent on the RDS instance.
Enable Enhanced Monitoring for the RDS instance.
No additional configuration is needed; RDS automatically sends metrics to CloudWatch.
Correct: RDS publishes CPU utilization to CloudWatch by default.
Enable Performance Insights for the RDS instance.
A company runs a containerized application on Amazon ECS Fargate. The DevOps team wants to collect custom application metrics (e.g., request count, error rate) and send them to Amazon CloudWatch. The team wants to minimize changes to the application code. Which solution should be used?
Have the application call the CloudWatch PutMetricData API directly.
Run the CloudWatch agent as a sidecar container in the ECS task definition, configured to collect StatsD metrics from the application container.
Correct: The CloudWatch agent can collect StatsD metrics without code changes.
Use the ECS agent's built-in metric collection feature.
Modify the application to send logs using the embedded metric format.
Want more Monitoring and Logging practice?
Practice this domain14% of exam · 6 sample questions below
A company uses an Auto Scaling group with a dynamic scaling policy based on a custom CloudWatch metric. After a recent deployment, the metric spikes unexpectedly, causing the Auto Scaling group to launch several EC2 instances. The operations team wants to quickly determine whether the spike was caused by a real load increase or a deployment issue. What is the MOST efficient way to investigate this?
Check the SNS topic that the scaling policy publishes to for notifications.
Use CloudWatch Logs Insights to query application logs for error patterns or deployment markers that coincide with the metric spike.
CloudWatch Logs Insights allows querying logs to find patterns related to the spike.
Use AWS CloudTrail to review API calls that modified the scaling policy.
Temporarily disable the scaling policy and manually increase the desired capacity to handle the load.
A company runs a critical application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) in front. During a load test, the team notices a sudden increase in 5xx errors from the ALB, and some tasks become unhealthy. The task logs show occasional 'OutOfMemoryError' exceptions. The task definition currently has 512 CPU units and 1024 MiB memory. What should the team do to mitigate the issue while maintaining a cost-effective approach?
Increase the task definition CPU to 1024 units and memory to 2048 MiB.
Increase the task definition memory to 2048 MiB while keeping CPU at 512 units.
This directly addresses the memory error without wasting resources on extra CPU.
Configure the ECS service to use a rolling update with a longer health check grace period.
Decrease the task definition memory to 512 MiB to force garbage collection more frequently.
A DevOps engineer is investigating an incident where an EC2 instance became unreachable. The engineer checks the AWS Management Console and finds the instance is running, but the status check shows '2/2 checks passed' and the system log shows no errors. What should the engineer do NEXT to diagnose the connectivity issue?
Review the CloudWatch metrics for CPU utilization and network throughput.
Reboot the instance to reset the network interface.
Stop and start the instance to move it to new underlying hardware.
Check the security group and network ACL rules to ensure inbound traffic is allowed.
Connectivity issues often stem from network permissions.
A company has an AWS Lambda function that processes S3 events. The function is invoked multiple times for the same S3 object, causing duplicate processing. The engineer suspects the issue is related to retries from the S3 event notification or Lambda's built-in retry behavior. What is the MOST effective way to ensure idempotent processing?
Modify the S3 bucket event notification configuration to use a prefix filter that excludes duplicate objects.
Use a DynamoDB table to store a record of processed S3 object keys and check for existence before processing.
This pattern ensures idempotency by tracking processed objects.
Set the Lambda function's ReservedConcurrency to 1 to prevent concurrent executions.
Use an Amazon SQS FIFO queue as the event source and enable content-based deduplication.
An organization uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with 'UPDATE_ROLLBACK_FAILED' status. The engineer needs to bring the stack to a consistent state without losing data. What is the BEST approach?
Use the 'ContinueUpdateRollback' API to skip the resource that caused the failure.
This is the designed method to resolve rollback failures.
Create a new stack from the same template and migrate resources.
Manually correct the resource configuration that caused the failure, then perform a stack update.
Delete the stack and then recreate it from the same template.
A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database instance fails and AWS automatically fails over to the standby. After the failover, the application cannot connect to the database. The engineer checks the RDS console and sees that the instance status is Available. What is the MOST likely cause of the connectivity issue?
The security group for the RDS instance has changed during failover.
The application is using the database's DNS endpoint for the old primary, which is no longer the writer.
After failover, the writer endpoint points to the new primary, but if the application caches the old endpoint, it may fail.
The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.
The database instance is still in the process of failover and is not yet accepting connections.
Want more Incident and Event Response practice?
Practice this domain17% of exam · 6 sample questions below
A DevOps engineer needs to ensure that all API calls made to AWS are recorded for auditing purposes. Which AWS service should be used?
AWS CloudTrail
CloudTrail records all AWS API calls for auditing.
AWS Config
Amazon CloudWatch Logs
Amazon VPC Flow Logs
A company uses AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific attribute in their SAML assertion can decrypt the data. Which KMS key policy should be used?
Create an S3 bucket policy that denies kms:Decrypt unless the request includes a specific tag.
Modify the KMS key policy to include a condition that allows kms:Decrypt only if the SAML assertion contains the specific attribute.
KMS key policies can use conditions based on SAML attributes to control decryption.
Attach a resource-based policy to the S3 bucket that allows decryption only for users with the specific attribute.
Use an IAM policy that grants kms:Decrypt only if the user has the specific attribute.
A company has a requirement to rotate database credentials every 30 days for an Amazon RDS for MySQL instance. The credentials are currently stored in AWS Secrets Manager. The DevOps engineer needs to implement automatic rotation without modifying the application code. Which solution should be used?
Create a scheduled job that runs every 30 days to update the secret in Secrets Manager with a new password.
Store the credentials in AWS Systems Manager Parameter Store and configure automatic rotation using a Lambda function.
Use the AWS RDS automatic password rotation feature, which automatically updates the password every 30 days.
Configure Secrets Manager to automatically rotate the secret every 30 days using a Lambda rotation function, and have the application retrieve the secret using the Secrets Manager API.
Secrets Manager provides built-in rotation for RDS with a Lambda function, and the application can retrieve credentials on-the-fly.
A company uses AWS Organizations to manage multiple accounts. The Security team wants to prevent member accounts from disabling AWS CloudTrail or deleting CloudTrail log files. Which TWO actions should the Security team take in the organization's management account? (Choose TWO.)
Create an SCP to deny cloudtrail:UpdateTrail.
Create an IAM policy in each member account to deny cloudtrail:StopLogging.
Create an SCP to deny s3:DeleteObject on the CloudTrail log bucket.
This prevents deletion of log files.
Enable AWS CloudTrail from the management account with organization trail.
Create an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail.
This prevents disabling or deleting the trail.
A DevOps team is designing a CI/CD pipeline that deploys a web application on Amazon ECS. The application must be compliant with PCI DSS, which requires encryption of data at rest and in transit, and logging of all access. Which THREE actions should the team implement to meet these requirements? (Choose THREE.)
Enable AWS CloudTrail and Amazon ECS logs to capture all API calls and container logs.
Logging is required for auditing access.
Store database credentials in AWS Systems Manager Parameter Store.
Use VPC endpoints to access ECS and ECR APIs.
Enable ECS task definition encryption using AWS KMS for environment variables and sensitive data.
KMS encryption ensures data at rest is encrypted.
Configure an Application Load Balancer (ALB) with an HTTPS listener using an SSL/TLS certificate.
HTTPS ensures encryption in transit.
A financial services company is migrating its applications to AWS. The compliance team requires that all Amazon S3 buckets containing personally identifiable information (PII) must have server-side encryption enabled and block public access. The DevOps team discovers that some S3 buckets are not compliant. Which TWO actions should the team take to enforce these requirements automatically for all current and future buckets? (Select TWO.)
Enable AWS CloudTrail to log all S3 API calls and send alerts when noncompliant buckets are created.
Use AWS Config managed rules to detect noncompliant buckets and automatically remediate by applying encryption and blocking public access.
AWS Config can detect and auto-remediate.
Attach an IAM permissions boundary to all users that prevents them from creating or modifying S3 buckets.
Apply an S3 bucket policy to each existing bucket that denies all access unless encryption is enabled.
Create an SCP that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions when the required settings are not specified.
SCPs can deny bucket creation if required settings are missing.
Want more Security and Compliance practice?
Practice this domainA development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?
Configure CodeBuild to cache dependencies in an Amazon S3 bucket.
Caching avoids re-fetching dependencies every build.
Move the build process to a local developer machine to avoid CodeBuild overhead.
Reduce the number of unit tests executed in the build phase.
Increase the compute type of the build environment to a larger instance.
A company uses AWS CodePipeline with multiple stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The build stage runs a series of tests, and if they pass, the pipeline proceeds to deploy. Recently, a developer committed a change that passed all tests but caused a production outage. The team wants to add an approval step before the deploy stage, but they also want to ensure that only changes from specific branches can be deployed. What is the MOST secure and maintainable way to enforce this?
Use a Lambda function in the pipeline to check the branch name and fail if not allowed.
Add a manual approval step in the pipeline and rely on the approver to verify the branch.
Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.
Isolating pipelines prevents direct deployment from unauthorized branches.
Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.
A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled JARs) to the repository, causing the repository size to grow rapidly and slowing down clone operations. The team wants to enforce a policy to reject pushes that contain files larger than 50 MB. Which approach should be used?
Configure a CodeCommit trigger that invokes an AWS Lambda function to validate file sizes and reject the push.
CodeCommit triggers allow custom validation before accepting a push.
Set up an Amazon CloudWatch Events rule to monitor repository size and alert when it exceeds a threshold.
Create an IAM policy that denies the `codecommit:GitPush` action if the file size exceeds 50 MB.
Use a pre-receive hook in the repository to reject large files by generating an S3 pre-signed URL.
A company uses AWS CodePipeline with a source stage from Amazon S3 and a deploy stage to AWS Elastic Beanstalk. The pipeline has been working for months, but recently the deploy stage started failing with the error 'The S3 object does not exist.' The source artifact is uploaded to the S3 bucket by an external system. Which TWO actions should be taken to resolve this issue? (Choose TWO.)
Ensure the external system does not overwrite the object after the pipeline execution starts.
Preventing overwrites ensures the object remains available.
Change the source stage to use AWS CodeCommit instead of S3.
Enable versioning on the S3 bucket and configure the pipeline to use the specific version ID.
Versioning allows the pipeline to reference a fixed version of the artifact.
Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.
Increase the timeout for the deploy stage in the pipeline.
A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own code repository and build artifacts. The team wants to use AWS CodePipeline with multiple parallel actions to build and test all microservices simultaneously. They also want to ensure that if one microservice's build fails, the pipeline does not block other microservices. Which THREE steps should the team take? (Choose THREE.)
Use a parallel action group with separate build actions for each microservice.
Parallel actions allow simultaneous builds.
Create a separate pipeline for each microservice to fully isolate failures.
Separate pipelines prevent cross-microservice impact.
Configure the pipeline to block subsequent stages if any build action fails.
Configure a single build action that sequentially builds all microservices.
Set the 'RunOrder' field for each build action to the same number to run them in parallel.
Same RunOrder runs actions in parallel.
A large enterprise uses a multi-account AWS strategy with a centralized DevOps account. The DevOps account hosts an AWS CodePipeline that deploys a critical application to production account (111111111111) using AWS CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy). The deploy stage uses a cross-account role (arn:aws:iam::111111111111:role/CrossAccountDeployRole) to perform the deployment. The trust policy on that role allows the DevOps account's CodePipeline service role (arn:aws:iam::222222222222:role/CodePipelineServiceRole) to assume it. The pipeline has been working for months, but after a recent security audit, the security team tightened permissions. Now the deploy stage fails with the error: 'User: arn:aws:sts::222222222222:assumed-role/CodePipelineServiceRole/AWS-CodePipeline-xxx is not authorized to perform: codedeploy:CreateDeployment on resource: arn:aws:codedeploy:us-east-1:111111111111:deploymentgroup:MyApp/MyDG'. The DevOps team has verified that the CrossAccountDeployRole has a permissions policy that allows 'codedeploy:*' on all resources. The CodePipelineServiceRole has a permissions policy that allows 'sts:AssumeRole' on the CrossAccountDeployRole. What is the most likely cause and what action should be taken to resolve the issue?
Add 'sts:AssumeRole' to the permissions policy of CodePipelineServiceRole.
Create the deployment group in the production account again to reset permissions.
Check the permissions boundary on CrossAccountDeployRole and add a boundary that allows CodeDeploy actions.
A permissions boundary can override the permissions policy and must explicitly allow required actions.
Update the trust policy of CrossAccountDeployRole to include the DevOps account ID.
Want more SDLC Automation practice?
Practice this domainThe DOP-C02 exam has 75 questions and must be completed in 180 minutes. The passing score is 750/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Configuration Management and IaC, Resilient Cloud Solutions, Monitoring and Logging, Incident and Event Response, Security and Compliance, SDLC Automation. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Amazon Web Services DOP-C02 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.