DOP-C02 Exam Questions and Answers

Upload the recipe to a custom cookbook repository and assign it to the 'Configure' lifecycle event in the stack settings.

Upload the cookbook containing the recipe to a repository (S3, Git, or HTTP), then in the OpsWorks stack settings enable 'Use custom Chef cookbooks' and add the recipe name to the Configure lifecycle event. The OpsWorks agent then executes that recipe on every Configure event, which fires when any instance enters the online state or when instances are added to or removed from the stack. This is the documented, supported method for attaching custom configuration logic to OpsWorks lifecycle events.

Configure the CloudFormation deployment action in CodePipeline with 'ActionMode' set to 'CREATE_UPDATE' and check the 'Rollback on failure' option.

In CodePipeline, the CloudFormation deployment action requires an explicit ActionMode such as CREATE_UPDATE to create a new stack or update an existing one. When 'Rollback on failure' is selected, CloudFormation automatically rolls back the stack to its last known good state if the deployment fails, restoring both resources and stack outputs. This is the correct mechanism because it leverages CloudFormation's native rollback capability within the pipeline execution, preserving the integrity of the deployed infrastructure.

Immutable update.

Immutable update deploys the new application version to a completely new set of instances (or a fully separate environment) that runs alongside the old fleet. It waits for all new instances to pass health checks before shifting traffic to them, and if any fail, the old environment remains untouched, enabling an immediate, zero-impact rollback. This provides the strongest availability and isolation, making it the safest deployment policy.

DBInstanceClass and Engine

In CloudFormation's AWS::RDS::DBInstance resource, DBInstanceClass and Engine are mandatory properties for every instance. DBInstanceClass defines the instance's compute and memory capacity, while Engine specifies the database engine (e.g., mysql, postgres). Without these, the resource automatically fails validation because CloudFormation can't provision a database without a compute class and an engine type. This makes this pair the correct answer for the property required universally.

Use the 'aws cloudformation continue-update-rollback' command with the '--resources-to-skip' parameter to skip the DB instance, allowing the stack to reach 'UPDATE_ROLLBACK_COMPLETE'. Then apply a change set with the desired parameter change.

The continue-update-rollback command is the designed mechanism to recover from a failed rollback. By specifying --resources-to-skip, you tell CloudFormation to ignore the RDS DB instance that is blocking the rollback, allowing the stack to transition to UPDATE_ROLLBACK_COMPLETE. Once stable, you can use a change set to reapply the desired parameter change in a controlled, reversible way, ensuring the stack's template and live resources are aligned.

Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.

AutoScalingReplacingUpdate is only supported for AWS::AutoScaling::AutoScalingGroup and cannot be applied to an AWS::RDS::DBInstance resource.

Deploy EC2 instances across multiple Availability Zones using an Auto Scaling group.

Deploying EC2 instances across multiple Availability Zones with an Auto Scaling group is the standard pattern for high availability. If one AZ becomes unavailable, the load balancer routes traffic to instances in the remaining healthy AZs, and the Auto Scaling group maintains instance count across AZs to replace any that are terminated. This eliminates the single-AZ point of failure and ensures application availability during an AZ outage.

Enable S3 Object Lock with Governance mode and a retention period of 365 days, and set a lifecycle policy to transition to S3 Glacier Deep Archive after 30 days.

S3 Object Lock with Governance mode applies a Write-Once-Read-Many (WORM) policy that guarantees the backup objects cannot be modified or deleted by any ordinary user—even an account administrator with full S3 access—until the 365-day retention period expires. Governance mode does allow users with the s3:BypassGovernanceRetention permission to override the lock if needed, but a typical backup scenario doesn't grant that to regular IAM roles, so the data remains immutable for the entire year. Pairing this with a lifecycle rule that transitions the objects to S3 Glacier Deep Archive after 30 days satisfies both the need for protection and cost efficiency: the transition preserves Object Lock metadata and the object stays protected through the transition, after which Storage Costs drop to the lowest tier while retention still applies for the remaining 335 days.

Replace the NLB with an ALB and enable sticky sessions (session affinity) using the ALB's cookie.

Replacing the NLB with an ALB and enabling sticky sessions via the ALB's load balancer-generated cookie is the correct minimal-change solution. The ALB inserts a stickiness cookie on the first response, and all subsequent requests from that client are routed to the same EC2 instance, preserving the locally stored session state without any application modifications. This leverages the ALB's Layer 7 capabilities to achieve session affinity while keeping the existing web application code unchanged.

Use a multi-Region application with Route 53 latency-based routing and RDS read replicas in the DR Region.

Cross-Region RDS read replicas provide asynchronous replication with an RPO of seconds to minutes, meeting the 1-hour RPO. Promoting a read replica and redirecting traffic via Route 53 can be done within minutes, meeting the 15-minute RTO. This is a valid warm standby configuration.

Configure Auto Scaling for the consumer fleet based on the ApproximateNumberOfMessagesVisible metric.

Scaling consumers on ApproximateNumberOfMessagesVisible directly matches fleet capacity to the actual backlog, so added workers drain the queue during peaks and terminate when it empties. This satisfies the latency constraint without over-provisioning, since capacity tracks demand rather than a fixed schedule or CPU proxy.

Deploy the RDS instance in a Multi-AZ configuration.

Deploying RDS in a Multi-AZ configuration creates a synchronous standby replica in a different Availability Zone, and Amazon RDS automatically fails over to the standby if the primary instance becomes unhealthy or the AZ fails. The DNS name stays the same, so the ECS order service can reconnect without code changes, and the standby is continuously updated with synchronous replication to prevent data loss. This directly addresses the database as a single point of failure, which is necessary because the order service depends on durable transactions to record orders.

Configure the ECS service to run tasks in multiple Availability Zones.

Configuring the ECS service to run tasks in multiple Availability Zones spreads the stateless order service compute across isolated infrastructure, so if an entire AZ becomes unavailable, the Application Load Balancer can route traffic only to healthy targets in the remaining AZs. ECS orchestrates task placement across the subnets you specify in different AZs, and with Service Auto Scaling you can maintain desired task counts and replace failed tasks. For complete resilience, the RDS database must also be Multi-AZ so both tiers of the application can survive an AZ outage.

Use CloudWatch Logs Insights to query application logs for error patterns or deployment markers that coincide with the metric spike.

CloudWatch Logs Insights lets you run SQL-like queries against application logs stored in CloudWatch Logs, allowing you to filter for specific error codes, exception stack traces, or deployment markers that align with the exact timestamp of the metric spike. By correlating log timestamps with the scaling activity, you can identify events like a failed code release, a dependency outage, or a traffic surge that pushed the metric above the alarm threshold. This is the only option that gives access to application-level evidence needed to diagnose the upstream cause of the spike.

Increase the task definition memory to 2048 MiB while keeping CPU at 512 units.

Raising the task memory to 2048 MiB while keeping CPU at 512 units is the minimal change that removes the hard memory limit causing the container's OOM kill. ECS enforces task memory as a cgroup limit, so the kernel terminates the process once the container's resident memory reaches that configured cap. This directly provides the application runtime sufficient headroom, uses the valid Fargate 0.5 vCPU / 2 GiB combination, and avoids wasting spend on CPU that was never the bottleneck.

Check the security group and network ACL rules to ensure inbound traffic is allowed.

Security groups act as a stateful firewall at the instance level, while network ACLs are stateless at the subnet level, so both must allow the relevant inbound traffic and the NACL must also allow the corresponding outbound return traffic. An incorrect deny rule, an overly restrictive CIDR, or a missing allow for the source IP/port pairs will cause exactly this kind of unreachability even when the instance is running and healthy, making this the correct first troubleshooting step.

Use a DynamoDB table to store a record of processed S3 object keys and check for existence before processing.

Recording processed S3 object keys in a DynamoDB table and checking for existence before processing makes the Lambda function idempotent. Use a conditional write, such as PutItem with ConditionExpression: attribute_not_exists(partition_key), so the first invocation for a given object key proceeds and subsequent duplicates fail the condition and exit without side effects. This is the recommended pattern because it works regardless of how many duplicate events S3 delivers and does not depend on delivery semantics.

Use the 'ContinueUpdateRollback' API to skip the resource that caused the failure.

The `ContinueUpdateRollback` API is the designed recovery action when a CloudFormation stack is stuck in the `UPDATE_ROLLBACK_FAILED` state. By invoking it with the `ResourcesToSkip` parameter, you explicitly instruct CloudFormation to skip the specific resource that caused the rollback failure, allowing the stack to return to a stable `UPDATE_COMPLETE` state. This bypasses the problematic resource without requiring manual intervention. It is the recommended and least disruptive method to recover from a failed stack update.

Check the ALB's idle timeout settings and compare with CloudFront origin timeout.

The correct root cause is a timeout mismatch: CloudFront waits for an origin response within its configured origin timeout (default 30 seconds), while the ALB has an idle timeout (default 60 seconds) that can close the connection to the backend if no bytes flow. If the ALB idle timeout is shorter than CloudFront’s timeout, the ALB can terminate a long-running request before the backend finishes, causing CloudFront to receive no response and return 504. Since the ALB logs show 200 for completed requests, the occasional slow requests are being cut off by this idle setting; aligning the ALB idle timeout to be greater than CloudFront’s origin timeout (or tuning backend latency) is the fix.

Use CloudWatch ALB metrics (HTTPCode_ELB_5XX_Count) and create a CloudWatch Alarm on the Sum statistic with a threshold based on total request count.

Correct: The Application Load Balancer natively emits the HTTPCode_ELB_5XX_Count metric to CloudWatch, representing the number of 5xx responses returned by the load balancer itself. Create a CloudWatch Alarm on this metric using the Sum statistic over a period (e.g., 5 minutes) and set a threshold, optionally using a math expression to divide by RequestCount to track the error ratio. This is the simplest and most direct method because it uses existing metrics with no additional setup, latency, or cost.

Amazon CloudWatch Alarms

Amazon CloudWatch Alarms are the correct choice because they continuously monitor a specified CloudWatch metric—such as ApproximateNumberOfMessagesVisible for an SQS queue—against a defined threshold over a configured period. When the metric crosses the threshold, the alarm changes state (OK, ALARM, or INSUFFICIENT_DATA) and can trigger an action like an SNS notification, EC2 Auto Scaling, or an arbitrary EC2 stop/terminate action. This provides the exact metric-threshold monitoring required.

Create a cross-region CloudWatch dashboard and add metrics from each region using metric math.

CloudWatch dashboards are not region-bound artifacts: each widget can explicitly specify a different source region, and metric math can combine those cross-region metrics within a single expression, for example summing SuccessPercent or averaging Duration across all canary regions. This natively aggregates the existing Synthetics metrics without duplicating canaries, running Lambda functions, or parsing logs. It is the intended, low-operational-overhead mechanism for a consolidated cross-region view and requires no custom infrastructure.

Examine the trace map to see the connection between services.

The AWS X-Ray trace map is the correct tool because it visualizes each service as a node and the connections between them as edges, with latency metrics for each edge. This directly reveals whether the identified slowness stems from network communication between services (for example, high I/O wait or retries) rather than from code execution inside a single service, allowing the DevOps team to pinpoint the exact segment of the request path that is underperforming.

No additional configuration is needed; RDS automatically sends metrics to CloudWatch.

RDS automatically emits the CPUUtilization metric to CloudWatch in the AWS/RDS namespace for every database instance, with no setup or configuration required. This metric is collected from the hypervisor at the instance level and is available in the CloudWatch console, enabling alarms and dashboards immediately after the database is provisioned. Basic monitoring is included as part of the service, and you can optionally use detailed monitoring or Enhanced Monitoring for faster granularity.

Run the CloudWatch agent as a sidecar container in the ECS task definition, configured to collect StatsD metrics from the application container.

The CloudWatch agent can run as a sidecar container in the same ECS task, and with the default awsvpc network mode all containers share a localhost network namespace. Configure the agent with a StatsD stanza so it listens on port 8125, and the application simply sends UDP messages in the StatsD format—no SDK, no logging changes, and no application code modifications. The agent buffers, batches, and forwards these metric points to CloudWatch as a single API consumer, preserving the existing application behavior.

Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.

The best practice is to attach an IAM role to the EC2 instance; the instance profile exposes temporary security credentials via the Instance Metadata Service (IMDSv2), which the AWS SDKs automatically load and refresh. These credentials are short-lived, rotated automatically, and never written to disk, so no secret material is present in the file system, environment variables, or configuration files. This eliminates the need to manage access keys manually and reduces the risk of exposure if the instance is compromised.

AWS CloudTrail

AWS CloudTrail is the correct answer because it is the native AWS service designed to record all API activity across your account. Every management event, including calls made by users, roles, or AWS services, is captured with details like the identity of the caller, source IP address, event time, request parameters, and response elements. By creating a trail, you can deliver these audit logs to an S3 bucket for long-term storage and enable CloudTrail Insights to detect anomalous API activity, which directly satisfies the requirement to ensure all API calls are audited.

Modify the KMS key policy to include a condition that allows kms:Decrypt only if the SAML assertion contains the specific attribute.

KMS key policies are resource-based policies attached directly to the customer master key, and they are evaluated for every KMS API action against that key. The policy can include a Condition block that references SAML-derived session attributes, such as a session tag mapped from an attribute in the SAML assertion, to allow kms:Decrypt only when the expected attribute value is present. This is the correct approach because it centralizes the decryption restriction at the key resource itself, ensuring that any principal attempting to use the key must satisfy the condition regardless of their IAM permissions.

Configure Secrets Manager to automatically rotate the secret every 30 days using a Lambda rotation function, and have the application retrieve the secret using the Secrets Manager API.

Secrets Manager natively supports rotation for RDS credentials through a managed Lambda function. The rotation function updates the password in the RDS database and then stores the new value in the secret, using staging labels like AWSCURRENT and AWSPENDING to ensure applications can always retrieve valid credentials. The application retrieves the current secret via the Secrets Manager API (for example, GetSecretValue), and effective caching keeps this cost-efficient. This exactly meets the requirement of rotating the database every 30 days while keeping the application functional.

Create an SCP to deny s3:DeleteObject on the CloudTrail log bucket.

Denying s3:DeleteObject via an SCP on the CloudTrail log bucket is correct because it directly protects the integrity of historical audit logs. Even if a user in a member account has IAM permissions to call cloudtrail:StopLogging or cloudtrail:DeleteTrail, they cannot destroy the existing evidence stored in S3, and the trail will continue to deliver new logs as long as it is active. This is a critical safeguard because attackers often attempt to delete logs to hide their activity, and SCPs provide a central, unchangeable control across all member accounts.

Create an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail.

Creating an SCP to deny both cloudtrail:StopLogging and cloudtrail:DeleteTrail is an effective preventive control because it forbids the two principal operations that would disable or remove the trail itself. Unlike an IAM policy, an SCP applies as an organization-wide boundary that member account administrators cannot override, and denying these actions ensures the trail continues to record events. This control is directly aligned with maintaining continuous CloudTrail delivery, though it does not by itself protect the historical log files already stored in S3.

Enable AWS CloudTrail and Amazon ECS logs to capture all API calls and container logs.

AWS CloudTrail records every API call made against the AWS account, including ECS, ECR, and other service actions, which is essential for auditing who did what and when. Amazon ECS logs, collected via the awslogs driver, capture container stdout/stderr for operational auditing and forensic analysis. Together they provide the necessary audit trail to verify compliance and detect unauthorized access or changes, directly addressing the requirement to capture all API calls and container logs.

Enable ECS task definition encryption using AWS KMS for environment variables and sensitive data.

Enabling ECS task definition encryption with AWS KMS ensures that sensitive data such as environment variables and other embedded secrets are encrypted at rest. KMS keys manage the encryption/decryption process, and IAM policies control who can use the key to decrypt those values. This meets the requirement for protecting sensitive data at rest, complementing the other controls for in-transit encryption and logging.

Configure an Application Load Balancer (ALB) with an HTTPS listener using an SSL/TLS certificate.

Configuring an Application Load Balancer with an HTTPS listener using an SSL/TLS certificate from ACM (or imported) encrypts all traffic between clients and the load balancer. This protects data in transit from eavesdropping and tampering, satisfying the requirement for encryption of data moving across the network. It is a distinct layer of defense, separate from the encryption-at-rest and auditing controls provided by KMS and CloudTrail/ECS logs.

Configure CodeBuild to cache dependencies in an Amazon S3 bucket.

Configure CodeBuild with cache.type set to S3 and specify an S3 bucket as cache.location, then declare the Java dependency directory (e.g., /root/.m2 for Maven) in the buildspec cache.paths. This creates a persistent, shared cache that is uploaded at the end of each build and downloaded at the start of the next, so dependencies are fetched from S3 instead of being downloaded one-by-one from public repositories on every run. By keying the cache appropriately (e.g., including a hash of the buildspec or source), you retain a valid cache while invalidating it when dependencies or build parameters change.

Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.

Creating a separate pipeline per allowed branch makes the pipeline definition itself the security boundary. Only branches that have an explicitly defined pipeline can ever proceed through the release stages, so committing to an unauthorized branch simply does not trigger a deployment even if the code is structurally valid. The production pipeline includes a manual approval step, and because that pipeline sources solely from an approved branch (e.g., main), the approval verifies the intended deployable artifact rather than attempting to check a branch name at runtime. This isolation prevents accidental or malicious deployment from unapproved branches without relying on inline validation or easily modified Lambda actions.

Configure a CodeCommit trigger that invokes an AWS Lambda function to validate file sizes and reject the push.

A CodeCommit trigger configured for push events can launch a Lambda function that inspects the incoming commits's metadata and calculates the size of each file. While native triggers are asynchronous, the Lambda can quickly delete the offending branch reference or tag, effectively rejecting the large-file push from a server-side governance perspective. This is the only option that applies custom validation logic that actually sees file content and can act to block the push, unlike IAM conditions, which cannot inspect Git payloads, or pre-receive hooks, which CodeCommit does not support.

The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.

For cross-account deployments, the pipeline service role in the source account must contain a policy that explicitly grants the `sts:AssumeRole` action on the ARN of the destination account's cross-account role. This is in addition to the trust policy on the cross-account role that allows the service role to assume it. Without this permission, CodePipeline's attempt to switch into the production account fails with a 403 AccessDenied at the AssumeRole step, which is exactly the described symptom. This is the root cause of the deployment failure.

The target group associated with the Auto Scaling group is not properly configured to route traffic.

The target group tied to the Auto Scaling group acts as the traffic-routing endpoint for the load balancer. If its health check path, port, or timeout settings are misconfigured—or if it is not attached to the appropriate listener rule—the newly deployed instances will be registered but immediately marked unhealthy and deregistered, so no user traffic reaches them. CodeDeploy itself successfully completes its scripts, but the deployment outcome appears as a routing failure, not an instance-level failure.

Ensure the external system does not overwrite the object after the pipeline execution starts.

CodePipeline's S3 source action resolves the artifact by object key at the moment the pipeline execution starts. If an external system overwrites or deletes that object during the run, the pipeline may fetch a different revision or fail entirely because the original content no longer exists. Enforcing immutability through a write-once policy or access controls prevents this race condition and guarantees the pipeline operates on a stable artifact.

Enable versioning on the S3 bucket and configure the pipeline to use the specific version ID.

Enabling S3 versioning preserves every upload as a distinct version ID, and CodePipeline's S3 source action can be configured to use a specific version ID via the S3ObjectVersion field. This lets the pipeline download the exact immutable object revision even if the external system later overwrites the same key. Without specifying the version ID, the pipeline would still pick the latest version, so this configuration must be explicitly set to provide deterministic builds.