DOP-C02 Practice Test 11 — 15 Questions

Question 1

A company uses AWS CodePipeline with Amazon S3 as the source stage. The pipeline triggers on object creation events in the S3 bucket. The development team notices that the pipeline does not trigger when multiple files are uploaded simultaneously. What is the most likely cause?

Accepted Answer

The S3 event notification filter is set to only include objects with a specific prefix or suffix that does not match the uploaded files.. Option B is correct because Amazon S3 event notifications can be filtered by prefix and suffix. If the filter is configured to only match objects with a specific prefix or suffix (e.g., `images/` or `.zip`), and the uploaded files do not match that filter, the event notification will not be sent to CodePipeline, causing the pipeline not to trigger. This is the most likely cause when the pipeline fails to trigger on simultaneous uploads, as the filter configuration is a common misconfiguration.

Answer

Amazon S3 event notifications are not guaranteed to be delivered for bulk operations.

Answer

CodePipeline does not support triggering from S3 event notifications when multiple files are uploaded simultaneously.

Answer

The S3 bucket versioning is not enabled, causing events to be lost.

Question 2

A DevOps team is designing a CI/CD pipeline that deploys a web application on Amazon ECS. The application must be compliant with PCI DSS, which requires encryption of data at rest and in transit, and logging of all access. Which THREE actions should the team implement to meet these requirements? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail and Amazon ECS logs to capture all API calls and container logs.. Option A is correct because AWS CloudTrail captures all API calls to the AWS environment, providing an audit trail of who accessed what and when, which is required for PCI DSS logging. Amazon ECS logs (via CloudWatch Logs or FireLens) capture container-level access and application logs, ensuring comprehensive logging of all access to the application and underlying infrastructure.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Answer

Use VPC endpoints to access ECS and ECR APIs.

Question 3

An AWS Lambda function that processes sensitive data writes objects to an S3 bucket. The security team requires that all objects be encrypted at rest using SSE-S3. The Lambda execution role uses the above IAM policy. Despite the policy, some objects are uploaded without server-side encryption. What is the most likely cause?

Accepted Answer

The Lambda function does not include the x-amz-server-side-encryption header in the PutObject request.. Option A is correct because the IAM policy only allows the PutObject action when the request includes the `x-amz-server-side-encryption` header set to `AES256` (SSE-S3). If the Lambda function omits this header in its PutObject call, the request does not satisfy the IAM condition key `s3:x-amz-server-side-encryption`, and the policy denies the upload. However, the question states that objects are uploaded without encryption, which implies the policy is not being enforced as intended—likely because the Lambda function is not including the required header, and the bucket's default encryption or another mechanism is allowing the upload to succeed despite the policy.

Answer

The bucket has a default encryption policy that overrides the IAM policy.

Answer

The Lambda function is using a KMS key instead of SSE-S3.

Answer

The Lambda function is specifying a different encryption algorithm, such as aws:kms.

Question 4

Match each AWS service or feature to its correct description in the context of SDLC automation. Drag and drop the items on the left to the matching descriptions on the right.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodePipeline

Answer

AWS CloudFormation

Answer

Amazon EventBridge

Question 5

A DevOps engineer is managing a CI/CD pipeline using AWS CodePipeline with multiple stages: Source (CodeCommit), Build (CodeBuild), Test (CodeBuild), and Deploy (CodeDeploy). The engineer wants to add manual approval steps before the Test and Deploy stages. Additionally, the pipeline should automatically roll back the deployment if the Deploy stage fails. Which two actions should the engineer take to implement these requirements? (Choose two.)

Accepted Answer

Insert a new stage between Build and Test, and add an Approval action to that stage.. Option B is correct because manual approval actions in AWS CodePipeline must be added as a separate stage, not within an existing stage. By inserting a new stage between Build and Test and adding an Approval action, the pipeline pauses before the Test stage, allowing manual review. Option C is correct because CodeDeploy deployment groups support automatic rollback on deployment failure, which can be enabled in the deployment group configuration to revert to the last known good revision.

Answer

Add an Approval action in the Test stage before the Test build action.

Answer

Add a Lambda function in the pipeline that triggers a rollback if the Deploy stage fails.

Answer

Configure the pipeline's Deploy stage to have a 'Rollback' action that runs on failure.

Question 6

A company runs a stateless web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer. The operations team needs to ensure that the application remains available if one AZ fails. Which solution is MOST resilient?

Accepted Answer

Configure the Auto Scaling group to launch instances in three Availability Zones with a desired capacity of 3.. Option C is correct because distributing instances across three Availability Zones (AZs) with a desired capacity of 3 ensures that even if one AZ fails, the remaining two AZs still have at least 2 instances running, maintaining service capacity. The Application Load Balancer (ALB) automatically routes traffic away from the failed AZ, and the Auto Scaling group will replace lost instances in the healthy AZs, providing the highest resilience against a single-AZ failure.

Answer

Configure the Auto Scaling group to launch instances in a single Availability Zone with a desired capacity of 6.

Answer

Configure the Auto Scaling group to launch instances in two Availability Zones with a desired capacity of 4.

Answer

Configure the Auto Scaling group to launch instances in two Availability Zones with a desired capacity of 6, all in one AZ.

Question 7

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team needs to monitor application performance and troubleshoot slow API responses. They currently use Amazon CloudWatch Logs for container logs and have enabled Container Insights. However, they are unable to see detailed latency breakdowns per API endpoint. Which solution would provide the most granular visibility into API performance?

Accepted Answer

Use AWS X-Ray to instrument the application and collect trace data.. AWS X-Ray provides end-to-end tracing of requests as they travel through microservices, capturing detailed latency breakdowns per API endpoint, including downstream calls, database queries, and external HTTP requests. This gives the operations team the granular visibility needed to pinpoint exactly where slow responses occur, unlike aggregated metrics or log-based queries.

Answer

Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.

Answer

Enable CloudWatch Logs Insights to query API logs for slow requests.

Answer

Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.

Answer

Set up VPC Flow Logs to analyze network latency between services.

Question 8

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.. Option B is correct because using an SCP to deny the ability to disable the AWS Config rule ensures the rule remains active across all accounts, while the custom AWS Config rule evaluates EBS encryption compliance. This combination enforces the requirement automatically for new member accounts with minimal operational overhead, as SCPs are applied at the organization level and AWS Config rules can be deployed via AWS Config conformance packs or organization-level rules without manual intervention.

Answer

Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.

Answer

Use an AWS Config aggregator in the management account to monitor compliance across accounts.

Answer

Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.

Question 9

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. During a security incident, the security team needs to isolate a compromised instance for forensic analysis without affecting the application's availability. What is the MOST effective action to take?

Accepted Answer

Deregister the instance from the target group and stop the instance for forensic analysis.. Deregistering the instance from the target group removes it from the Application Load Balancer's routing, ensuring no new traffic is sent to it while existing connections drain (connection draining). Stopping the instance preserves its memory and disk state for forensic analysis without impacting application availability, as the remaining healthy instances continue to serve traffic.

Answer

Modify the security group of the instance to deny all inbound and outbound traffic.

Answer

Terminate the compromised instance immediately to prevent further damage.

Answer

Change the subnet route table to route traffic away from the compromised instance.

Question 10

A DevOps team is investigating a production incident where an Amazon RDS for MySQL database experienced a sudden spike in connections and CPU utilization. The team suspects a SQL injection attack. Which TWO actions should the team take to investigate and mitigate the incident?

Accepted Answer

Enable automated backups and ensure point-in-time recovery is configured.. Option B is correct because enabling automated backups and point-in-time recovery ensures that the database can be restored to a state before the suspected SQL injection attack, preserving data integrity and enabling forensic analysis. Option C is correct because RDS Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) to correlate with the spike, while audit logs capture actual SQL queries, which are essential for identifying malicious patterns and confirming the attack vector.

Answer

Delete the error logs to free up storage space.

Answer

Create a read replica to offload traffic from the primary instance.

Answer

Increase the DB instance size to handle the increased load.

Question 11

An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.. The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed. This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.

Answer

The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.

Answer

The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.

Answer

The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.

Question 12

A financial services company is migrating its applications to AWS. The compliance team requires that all Amazon S3 buckets containing personally identifiable information (PII) must have server-side encryption enabled and block public access. The DevOps team discovers that some S3 buckets are not compliant. Which TWO actions should the team take to enforce these requirements automatically for all current and future buckets? (Select TWO.)

Accepted Answer

Use AWS Config managed rules to detect noncompliant buckets and automatically remediate by applying encryption and blocking public access.. AWS Config managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-public-read-prohibited) can automatically detect noncompliant S3 buckets. Combined with AWS Config auto-remediation using Systems Manager Automation documents, the team can enforce encryption and block public access without manual intervention, ensuring all current and future buckets remain compliant.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts when noncompliant buckets are created.

Answer

Attach an IAM permissions boundary to all users that prevents them from creating or modifying S3 buckets.

Answer

Apply an S3 bucket policy to each existing bucket that denies all access unless encryption is enabled.

Question 13

A company runs a critical application on Amazon ECS with Fargate. The application is deployed across multiple Availability Zones and uses an Application Load Balancer (ALB) as the front-end. During a recent incident, users experienced intermittent connectivity failures. The DevOps team suspects that tasks are being stopped due to resource exhaustion. Which combination of metrics and actions should the team use to diagnose and prevent recurrence?

Accepted Answer

Monitor CPU and memory utilization metrics in CloudWatch; increase the task size (CPU and memory) in the task definition.. Option A is correct because CPU and memory utilization metrics in CloudWatch directly indicate resource exhaustion, which is the suspected cause of tasks being stopped. Increasing the task size (CPU and memory) in the task definition provides more resources per task, preventing the OOM killer or CPU throttling from stopping tasks, without changing the number of tasks or scaling logic.

Answer

Set up CloudWatch Logs for the application and check for out-of-memory errors; then increase the number of tasks.

Answer

Monitor NetworkPacketsIn and NetworkPacketsOut metrics in CloudWatch; increase the number of tasks.

Answer

Monitor the ALB error metrics (5xx count) and scale the ECS service based on request count.

Question 14

Drag and drop the steps to configure an AWS Auto Scaling group with a launch template and scaling policies.

Question 15

A company is using AWS Organizations with multiple accounts. The Security team wants to centrally manage IAM roles that can be assumed by users in member accounts. Which solution should be used to enforce that only specific roles can be assumed across accounts, while ensuring that the policy updates are automatically applied to all accounts?

Accepted Answer

Create an IAM role in the Security account with a trust policy that references a service control policy (SCP) in AWS Organizations.. Option C is correct because it leverages AWS Organizations and Service Control Policies (SCPs) to centrally enforce which IAM roles can be assumed across member accounts. An SCP applied to an OU or account can explicitly deny the `sts:AssumeRole` action for any role that does not match a specific ARN pattern, ensuring that only the Security account's designated roles are assumable. Since SCPs are automatically inherited by all accounts in the organization, policy updates are applied without manual intervention.

Answer

Create an IAM role in each member account with a trust policy that allows the Security account, and use AWS CloudFormation StackSets to deploy the roles.

Answer

Use AWS Single Sign-On (SSO) to assign permissions to users across accounts.

Answer

Create a resource-based policy on each IAM role in the member accounts that allows the Security account to assume the role.