DOP-C02 Practice Test 11 — 15 Questions

Question 1

A company uses AWS Systems Manager to manage hybrid servers. They want to automate the patching of Windows servers using Patch Manager. However, some servers are not showing up in the compliance reporting. What should the DevOps engineer check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the SSM Agent is installed and running on the servers. The SSM Agent is the core component that enables a server to communicate with AWS Systems Manager. Without the agent installed and running, the server cannot register with the service, receive patch commands, or report its compliance status. Therefore, this is the most fundamental prerequisite to check first when servers are missing from compliance reporting.

Answer

Verify that the servers have the correct patch baseline tags

Answer

Check that the Patch Baseline is configured to include the missing servers

Answer

Confirm that the servers have an IAM service role for Systems Manager

Question 2

A DevOps engineer notices that an EC2 instance in an Auto Scaling group is repeatedly failing health checks and being terminated. The engineer needs to capture the root cause by collecting memory dumps and system logs before termination. What should the engineer do?

Accepted Answer

Use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period.. EC2Rescue is specifically designed to collect memory dumps and system logs from EC2 instances, and by configuring it to run at startup and extending the Auto Scaling health check grace period, the engineer ensures diagnostics are captured before the instance is terminated for failing health checks. This approach directly addresses the need to gather root cause data from a failing instance that is about to be replaced.

Answer

Configure the CloudWatch Agent to collect memory and system logs and publish them to CloudWatch Logs.

Answer

Use AWS Systems Manager Run Command to execute a script on the instance that collects diagnostics before it is terminated.

Answer

Enable EC2 instance metadata service (IMDS) to capture diagnostic data that persists after termination.

Question 3

A team uses AWS CodeBuild to run integration tests that require access to an Amazon RDS database. The database is in a private subnet. The CodeBuild project is configured to use a VPC. However, the builds are failing with a timeout connecting to the database. What could be the issue?

Accepted Answer

The security group for the RDS database does not allow inbound traffic from the security group assigned to the CodeBuild project.. The RDS database is in a private subnet and its security group must explicitly allow inbound traffic from the CodeBuild project's security group. Even though CodeBuild is configured with a VPC, the default security group rules deny all inbound traffic; without an inbound rule for the database port (e.g., 3306 for MySQL) from the CodeBuild security group, the connection is blocked, causing a timeout.

Answer

The CodeBuild project's VPC configuration does not include the subnet IDs where the database resides.

Answer

The security group for the CodeBuild project does not allow outbound traffic to the RDS database.

Answer

The CodeBuild project does not have a route to the internet via an internet gateway, so it cannot reach the RDS endpoint.

Question 4

An organization wants to ensure that all API calls made in their AWS account are logged for security analysis. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. (AWS CloudTrail) is correct because it records all API calls made in the AWS account, providing a log of actions for security analysis. Option B (AWS Config) is incorrect because it tracks resource configuration changes, not API calls. Option C (Amazon CloudWatch Logs) is incorrect because it stores logs from various sources but does not natively capture API calls; CloudTrail is the service designed for that purpose. Option D (VPC Flow Logs) is incorrect because it captures IP traffic information for network interfaces, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 5

A company uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is experiencing intermittent HTTP 503 errors. The DevOps team needs to diagnose the cause. Which THREE of the following should the team investigate? (Choose THREE.)

Accepted Answer

Auto Scaling group minimum capacity and scaling policy. The correct options are C, D, and E. Option C is correct because if the Auto Scaling group's minimum capacity is too low or scaling policies are not responsive, there may be insufficient instances to handle the load, causing HTTP 503 errors. Option D is correct because a low idle timeout setting on the ALB can cause premature closure of idle connections, leading to 503 errors for long-lived requests. Option E is correct because if health checks are misconfigured or instances are unhealthy, the ALB will route traffic to unhealthy targets or have no healthy targets, resulting in 503 errors. Option A is incorrect because security group inbound rules affect whether traffic can reach the ALB; if they block traffic, the client would receive a timeout or connection refused, not a 503 from the ALB. Option B is incorrect because SSL certificate expiration causes SSL handshake failures, resulting in 502 Bad Gateway or connection errors, not 503.

Answer

Security group inbound rules for the ALB

Answer

SSL certificate expiration on the ALB

Question 6

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. What should be done? (Choose TWO.)

Accepted Answer

Modify the KMS key policy to include a condition that requires the kms:ViaService to be from the VPC endpoint.. Options B and E are correct. To restrict KMS key usage to within the VPC, you first create a VPC endpoint for AWS KMS (Option E) to allow private connectivity. Then, you modify the KMS key policy to include a condition that requires the request to originate from that VPC endpoint, using the kms:ViaService condition key (Option B). Option A is wrong because security groups do not apply to KMS keys; they are used for EC2 instances and network interfaces. Option C is wrong because S3 bucket policies cannot restrict which KMS key is used for encryption; they can only restrict S3 actions. Option D is wrong because service control policies (SCPs) apply at the organizational level and cannot restrict KMS key usage to a specific VPC; key policies are the correct mechanism.

Answer

Attach a security group to the KMS key.

Answer

Configure the S3 bucket policy to allow only requests from the VPC.

Answer

Create a service control policy (SCP) that denies KMS operations from outside the VPC.

Question 7

A company uses AWS CloudTrail to record API calls across multiple accounts and regions. The security team needs to be alerted immediately when an IAM user creates a new access key. Which combination of services should be used to achieve this with minimal latency?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a metric filter, and set up a CloudWatch Alarm to publish to an SNS topic.. CloudTrail can stream logs to CloudWatch Logs, where a metric filter can be configured to match the 'CreateAccessKey' API call. This metric filter triggers a CloudWatch Alarm, which publishes to an SNS topic for immediate notification, providing minimal latency. Option B is incorrect because S3 event notifications on the CloudTrail bucket notify on object creation, but CloudTrail delivers log files in batches (e.g., every 5 minutes), causing delays beyond the required minimal latency. Option C is incorrect because while Amazon EventBridge can match CloudTrail events in near real-time, the question's intended solution (and the one that best fits 'minimal latency') is the metric filter + alarm pattern; however, EventBridge is a valid alternative, but the correct answer as per options is A. Option D is incorrect because polling the CloudTrail API every minute is inefficient, introduces latency, and does not provide real-time alerting.

Answer

Enable S3 event notifications on the CloudTrail S3 bucket to trigger a Lambda function.

Answer

Use Amazon EventBridge to match the CloudTrail event and invoke an AWS Lambda function that sends an email.

Answer

Configure a Lambda function to poll the CloudTrail API every minute and check for new access keys.

Question 8

A company needs to ensure that all API calls made to AWS are encrypted in transit. Which of the following is the correct way to enforce this?

Accepted Answer

Use an IAM policy with a condition that denies access unless the request uses HTTPS.. All AWS API endpoints support HTTPS (TLS) by default. To enforce that all API calls are encrypted in transit, you can use an IAM policy with a condition that denies access unless the request uses HTTPS. Specifically, you can use the `aws:SecureTransport` condition key to require encrypted connections. Option A is correct. Option B is incorrect because security groups control network traffic at the instance level but do not enforce encryption for API calls. Option C is incorrect because AWS KMS is used for managing encryption keys, not for enforcing HTTPS. Option D is incorrect because AWS CloudTrail logs API activity but does not enforce encryption.

Answer

Configure security groups to allow only HTTPS traffic.

Answer

Use AWS Key Management Service (KMS) to create a key and require encryption.

Answer

Enable AWS CloudTrail to log all API calls.

Question 9

A company uses multiple AWS accounts: one for development, one for testing, and one for production. They want to implement a CI/CD pipeline using AWS CodePipeline that deploys the same application to all three accounts. The source code is stored in a CodeCommit repository in the development account. The pipeline should first build the application, then deploy to development, then after approval, deploy to testing, and finally after another approval, deploy to production. The deployment uses AWS CodeDeploy to deploy to EC2 instances in each account. The pipeline will be created in the development account. Which configuration will allow the pipeline to deploy to the testing and production accounts?

Accepted Answer

Create IAM roles in the testing and production accounts that grant CodeDeploy permissions, and configure the pipeline to assume those roles using the CodePipeline cross-account action.. The pipeline can assume IAM roles in the testing and production accounts to perform cross-account deployments. CodePipeline's cross-account action requires you to specify the ARN of an IAM role in the target account that has the necessary permissions for CodeDeploy. This is the secure and recommended method for cross-account access. Option B is incorrect because VPC peering does not provide cross-account IAM permissions; it only allows network connectivity. Option C is incorrect because using IAM users with programmatic access is not a best practice for service-to-service authentication; roles are more secure and manageable. Option D is incorrect because AWS Organizations does not automatically grant cross-account access; you still need to configure IAM roles and trust policies.

Answer

Establish VPC peering between the accounts and allow the pipeline to communicate directly with CodeDeploy in the other accounts.

Answer

Create IAM users in testing and production accounts with programmatic access, and configure the pipeline to use those credentials.

Answer

Use AWS Organizations to create a shared service and grant the pipeline full access to all accounts.

Question 10

A company runs a containerized web application on Amazon ECS with AWS Fargate. The application is critical and requires high availability. The DevOps team has set up an Amazon CloudWatch alarm that triggers an auto scaling action when the average CPU utilization exceeds 75% for 5 minutes. However, during a recent traffic spike, the application became slow and some requests timed out, even though the CloudWatch alarm did not fire. The team checked the ECS service auto scaling configuration and found that the target tracking scaling policy based on average CPU utilization is set with a target value of 75%. The ECS service is configured with a minimum of 2 tasks and a maximum of 10 tasks. Upon investigation, they noticed that the CPU utilization metric for the service remained below 75% during the spike, but the memory utilization was high (over 90%). The application logs show that the tasks were running out of memory, causing garbage collection pauses and slow responses. Which course of action should the DevOps engineer take to prevent this issue in the future?

Accepted Answer

Add a second target tracking scaling policy based on average memory utilization with a target value of 75%.. The issue is memory pressure, not CPU. Adding a target tracking scaling policy based on average memory utilization with a target value of 75% will cause the ECS service to automatically scale out when memory utilization exceeds the target, preventing performance degradation due to high memory usage. Option B (decreasing CPU target to 50%) is incorrect because CPU utilization was not the bottleneck. Option C (increasing minimum tasks to 5) provides static capacity but does not dynamically respond to memory spikes, leading to wasted resources or insufficient scaling. Option D (increasing task memory limit) is a static change that may help temporarily but does not provide dynamic scaling; auto scaling based on memory is the recommended approach.

Answer

Decrease the CPU target value to 50% to trigger scaling earlier.

Answer

Increase the minimum number of tasks from 2 to 5 to provide more capacity upfront.

Answer

Increase the task memory limit in the task definition to 8 GB.

Question 11

During a security incident, a DevOps engineer discovers that an EC2 instance has been compromised. The instance has an IAM role with permissions to access S3 and DynamoDB. Which THREE immediate actions should the engineer take to contain the incident?

Accepted Answer

Stop the EC2 instance. To contain the incident, immediate actions should focus on isolating the instance and revoking its permissions to prevent further damage. Stopping the instance (C) preserves its state for later forensics while halting current malicious activity. Updating the security group (D) blocks all network traffic to and from the instance, cutting off communication. Removing the IAM role (E) revokes the instance's access to S3 and DynamoDB, preventing data exfiltration or unauthorized actions. Terminating the instance (A) is not recommended because it destroys volatile data and evidence, hindering investigation. Creating an AMI (B) is a forensic step that should be done after containment; it does not immediately stop the compromise.

Answer

Terminate the instance immediately

Answer

Create an AMI of the instance for forensic analysis

Question 12

A company is using AWS CodeBuild to compile a Java application. The build takes over 30 minutes, causing timeouts. The team has already increased the build timeout to the maximum. Which action would MOST effectively reduce the build time?

Accepted Answer

Enable dependency caching in the buildspec file.. Enabling dependency caching in the buildspec file allows CodeBuild to reuse previously downloaded dependencies (e.g., Maven or Gradle artifacts) across builds, significantly reducing the time spent on dependency resolution and download. Since the build already times out at the maximum timeout, caching directly addresses the bottleneck of repeated dependency fetching, which is a common cause of long build times in Java applications.

Answer

Use a smaller instance type to reduce provisioning time.

Answer

Use a larger compute type in CodeBuild.

Answer

Split the build into multiple parallel CodeBuild projects.

Question 13

A DevOps engineer needs to ensure that all API calls made to AWS are logged for compliance. The logs must be stored in S3 for at least 7 years. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity, source IP, and timestamp, and can deliver log files to an S3 bucket for long-term retention. The requirement to store logs for at least 7 years aligns with CloudTrail's ability to integrate with S3 lifecycle policies for archival or deletion after a specified period.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 14

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must be resilient to regional outages. Which THREE steps should the company take to achieve multi-Region resilience? (Choose THREE.)

Accepted Answer

Configure Route 53 with a failover routing policy to direct traffic to the secondary Region if the primary fails.. Amazon Route 53 with a failover routing policy allows the company to route traffic to a secondary Region when health checks detect a failure in the primary Region. This provides DNS-level failover, which is a fundamental component of multi-Region resilience for HTTP-based applications.

Answer

Use Amazon CloudFront with multiple origins pointing to each Region's API Gateway.

Answer

Deploy Lambda@Edge functions to handle requests at edge locations.

Question 15

A DevOps engineer is setting up a CI/CD pipeline for a microservices application using AWS CodePipeline. The pipeline includes a Test stage that runs integration tests against a staging environment. The engineer wants to ensure that manual approval is required before deploying to production. Which action should be taken?

Accepted Answer

Add a manual approval action in the pipeline stage before production deployment.. AWS CodePipeline supports a manual approval action that can be added to any stage. By placing this action in the stage immediately before the production deployment, the pipeline will pause and require an authorized user to manually approve the transition, ensuring that integration tests have passed before any production release occurs.

Answer

Configure a CodeCommit approval rule template to block the merge.

Answer

Use CloudWatch Events to send a notification and wait for a custom signal.

Answer

Set the pipeline to only run on manual invocation.