DOP-C02 Practice Test 12 — 15 Questions

Question 1

A company's application uses Amazon SQS to decouple microservices. During peak hours, the SQS queue backlog grows significantly, causing processing delays. The DevOps team wants to reduce latency without increasing costs unnecessarily. What should the team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Auto Scaling for the consumer fleet based on the ApproximateNumberOfMessagesVisible metric.. Scaling the consumer fleet based on the ApproximateNumberOfMessagesVisible metric directly addresses the backlog by adding more processing capacity when the queue grows. This approach reduces latency dynamically without incurring unnecessary costs during off-peak hours, as it only scales up when needed. Auto Scaling with SQS metrics is a cost-effective, elastic solution for handling variable workloads.

Answer

Increase the visibility timeout to allow consumers more time to process messages.

Answer

Use an SQS queue with priority settings to process high-priority messages first.

Answer

Increase the SQS queue's throughput by requesting a quota increase.

Question 2

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During an incident, the primary DB instance becomes unreachable. The failover to the standby instance succeeds, but application connections are failing with 'Access denied for user'. What is the most likely cause?

Accepted Answer

The application is using the old master user credentials that were changed on the primary but not replicated to the standby. The most likely cause is that the application is using credentials that were changed on the primary but not replicated to the standby. In RDS Multi-AZ, changes made via the RDS console or API (e.g., modifying the master password) are automatically replicated, but direct SQL modifications (e.g., ALTER USER) are not. After failover, the standby becomes the new primary with the old credentials, causing 'Access denied for user' errors. Option A is incorrect because DNS CNAME propagation delays cause connection timeouts, not authentication failures. Option B is incorrect because storage configuration differences do not affect authentication. Option D is incorrect because the security group remains associated with the RDS instance and the application's IP address does not change during failover.

Answer

The DNS CNAME for the RDS endpoint has not propagated to the application's DNS resolver

Answer

The standby instance has a different storage configuration than the primary

Answer

The security group for the RDS instance does not allow inbound traffic from the application's new IP address

Question 3

A DevOps engineer is designing a CI/CD pipeline that deploys code to an EC2 instance. The engineer needs to securely store and retrieve database credentials used by the application. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. WS Secrets Manager (Option C) because it is specifically designed for securely storing, managing, and automatically rotating database credentials and other secrets. Amazon S3 with server-side encryption (Option A) is an object storage service and not intended for secret management; it lacks automatic rotation and fine-grained access control for secrets. AWS Systems Manager Parameter Store (Option B) can store secrets but does not natively support automatic rotation, which is a key requirement for database credentials. AWS Key Management Service (Option D) manages encryption keys, not secrets themselves, and is used for encryption, not secret storage.

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Question 4

A company has a microservices architecture with 50 services running on Amazon ECS. The DevOps team wants to collect and analyze logs from all services centrally. They need to query logs across services and set up alerts for error patterns. Which solution is the most scalable and cost-effective?

Accepted Answer

Use the awslogs driver to send logs to Amazon CloudWatch Logs and use CloudWatch Logs Insights for querying and metric filters for alerts. Using the awslogs driver to send logs to Amazon CloudWatch Logs provides a fully managed, scalable, and cost-effective solution. CloudWatch Logs Insights enables querying across all services, and metric filters can trigger alarms for error patterns. Option A (CloudTrail) captures API activity, not application logs. Option B (Elasticsearch) requires managing infrastructure and is more expensive. Option D (S3 + Athena) is cheaper but lacks real-time alerting and has slower query performance.

Answer

Use AWS CloudTrail to capture all log events and store them in an S3 bucket for analysis

Answer

Deploy an Amazon Elasticsearch cluster and configure the ECS Fargate agent to send logs directly to Elasticsearch

Answer

Send logs to Amazon S3 and use Amazon Athena for querying, with scheduled queries for alerts

Question 5

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application stores session data in a shared Amazon ElastiCache for Redis cluster. The operations team reports that during a recent AZ failure, users experienced session loss and application errors. Which combination of actions should the company take to improve resilience and maintain session state during an AZ failure? (Choose TWO.)

Accepted Answer

Configure the ALB with cross-zone load balancing enabled and connection draining set to a suitable timeout.. Enabling cross-zone load balancing on the ALB ensures traffic is distributed evenly across all EC2 instances in all AZs, and connection draining with a suitable timeout allows in-flight requests to complete before instances are deregistered, preventing session loss during an AZ failure. Option C is correct because enabling cluster mode for ElastiCache for Redis with replica nodes in different AZs provides automatic sharding and replication, ensuring session data remains available and consistent even if a primary node in one AZ fails. Option E is incorrect because while ElastiCache for Redis supports Multi-AZ with automatic failover, it alone does not guarantee that replica nodes are placed in different Availability Zones for each shard; enabling cluster mode with replicas in different AZs (Option C) provides a more comprehensive solution for maintaining session state during an AZ failure.

Answer

Deploy an Auto Scaling group with a dynamic scaling policy that adds instances in the remaining AZs.

Answer

Configure the application to use a custom DNS name with a low TTL pointing to the ElastiCache cluster endpoint.

Answer

Enable Multi-AZ for the ElastiCache cluster to automatically fail over to a replica in another AZ.

Question 6

A company uses Amazon RDS Multi-AZ for disaster recovery. The primary DB instance in us-east-1a fails. What happens next?

Accepted Answer

The standby DB instance in us-east-1b is promoted automatically and the CNAME record is updated. RDS Multi-AZ automatically fails over to the standby in a different Availability Zone within minutes. The CNAME record is updated to point to the standby DB instance, so no manual intervention is needed. Option A is correct because this automatic failover and CNAME update occurs. Option B is wrong because no manual promotion is required. Option C is wrong because the primary is not rebuilt in the same AZ; it fails over to a standby in a different AZ. Option D is wrong because read replicas are not used for Multi-AZ failover; a standby instance is promoted.

Answer

The administrator must manually promote the standby instance

Answer

The primary instance is automatically rebuilt in the same AZ

Answer

A read replica in us-east-1b is automatically promoted to primary

Question 7

A DevOps engineer needs to automatically roll back a CodeDeploy deployment if the number of failed instances exceeds a threshold. Which deployment configuration should be used?

Accepted Answer

Set the minimum number of healthy instances in the deployment configuration to trigger automatic rollback.. Setting the minimum number of healthy instances in the deployment configuration directly controls when CodeDeploy triggers an automatic rollback. When the number of healthy instances falls below this threshold during a deployment, CodeDeploy automatically stops the deployment and rolls back to the last known good state, meeting the requirement to roll back based on failed instance count.

Answer

Configure the deployment group to ignore failed instances.

Answer

Use a CloudWatch alarm to trigger a rollback.

Answer

Use a custom deployment configuration that fails the deployment if any instance fails.

Question 8

A DevOps team is designing a centralized logging solution for multiple AWS accounts. The team needs to collect logs from EC2 instances, Lambda functions, and VPC Flow Logs, and store them in a central account for analysis. The solution must be cost-effective and support near real-time log aggregation. Which THREE steps should the team take? (Choose three.)

Accepted Answer

Deliver logs from the central account's CloudWatch Logs to Amazon Kinesis Data Firehose, which writes to Amazon S3.. Options B, D, and E are correct. CloudWatch cross-account subscription (Option E) allows streaming logs from source accounts to a central account's CloudWatch Logs for near real-time aggregation. From the central account, logs can be delivered to Amazon Kinesis Data Firehose (Option B), which buffers and writes them to Amazon S3 at low cost. Amazon Athena (Option D) can then query the S3 logs for analysis, supporting cost-effective ad-hoc queries. Option A is incorrect because VPC Flow Logs cannot be delivered directly to a Lambda function; they are delivered to CloudWatch Logs or S3. Option C (Amazon OpenSearch Service) is not one of the three required steps because the question specifies cost-effective storage and near real-time aggregation, and OpenSearch adds unnecessary cost and complexity for storage; the proposed solution uses S3 for cost-effective storage and Athena for querying.

Answer

Configure VPC Flow Logs to deliver to a Lambda function in each account, which forwards logs to the central account.

Answer

Use Amazon OpenSearch Service to index and search the logs in near real time.

Question 9

A DevOps team is designing a disaster recovery plan for a production RDS for PostgreSQL database. The RPO must be less than 5 minutes and the RTO less than 1 hour. The database size is 2 TB. Which solution is MOST cost-effective?

Accepted Answer

Create a cross-Region read replica and promote it during disaster. The most cost-effective solution that meets the RPO < 5 minutes and RTO < 1 hour for a 2 TB RDS PostgreSQL database. A cross-Region read replica uses asynchronous replication, typically with lag of seconds, ensuring RPO well under 5 minutes. Promoting the replica to a standalone instance takes minutes, satisfying the RTO. It leverages existing RDS features without additional services like DMS, and the replica instance can be sized smaller than the primary if not used, minimizing cost. Option A (cross-Region automated backups) only copies daily backups, resulting in RPO up to 24 hours, failing the requirement. Option B (manual snapshots every 5 minutes) is impractical and costly. Option C (DMS continuous replication) meets RPO but incurs extra compute and data transfer costs, making it less cost-effective than a read replica.

Answer

Enable cross-Region automated backups with a retention period of 1 day

Answer

Take manual snapshots every 5 minutes and copy them to another Region

Answer

Use AWS Database Migration Service (DMS) for continuous replication to another Region

Question 10

A company wants to design a highly available and fault-tolerant architecture for a stateless web application on AWS. Which TWO actions should they take? (Choose two.)

Accepted Answer

Launch EC2 instances in at least two Availability Zones. To achieve high availability and fault tolerance for a stateless web application, you should deploy EC2 instances in at least two Availability Zones (C) to eliminate a single point of failure, and use an Auto Scaling group (E) to automatically replace failed instances and maintain desired capacity. Option A is incorrect because a single large instance is a single point of failure and does not provide fault tolerance. Option B is incorrect because multiple Application Load Balancers per AZ are unnecessary; a single ALB can route traffic across multiple AZs. Option D is incorrect because RDS Multi-AZ is a database feature, not for the web server fleet.

Answer

Use a single large EC2 instance to simplify management

Answer

Deploy multiple Application Load Balancers in each AZ

Answer

Use an RDS Multi-AZ deployment for the web server fleet

Question 11

A DevOps engineer is designing an infrastructure as code solution for a microservices application that runs on Amazon ECS with Fargate. The application requires a shared Application Load Balancer (ALB) and multiple ECS services. Which CloudFormation resources are required to expose each service behind the ALB? (Choose THREE.)

Accepted Answer

AWS::ElasticLoadBalancingV2::Listener. AWS::ElasticLoadBalancingV2::Listener is correct because it defines the protocol and port (e.g., HTTP:80) on which the ALB accepts traffic. Without a listener, the ALB cannot receive incoming requests. This resource is essential for routing traffic to target groups that are associated with ECS services.

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Answer

AWS::AutoScaling::AutoScalingGroup

Question 12

A company uses AWS Lambda with an Amazon DynamoDB trigger. Recently, the Lambda function started failing with 'ProvisionedThroughputExceededException' errors. The DevOps team needs to mitigate the issue. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Increase the DynamoDB table's write capacity. To mitigate 'ProvisionedThroughputExceededException' errors when a Lambda function is triggered by DynamoDB Streams, two actions are effective. Option D: Increase the DynamoDB table's write capacity to handle the write demand from the stream processing. Option E: Reduce the batch size for the DynamoDB stream event source mapping to lower the number of writes per invocation, reducing the chance of exceeding throughput. Option A is wrong because Lambda reserved concurrency controls how many concurrent executions Lambda can run, but the issue is DynamoDB throttling, not Lambda capacity. Option B is wrong because disabling DynamoDB Streams would stop the trigger entirely, which is not a mitigation. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads, not writes, and does not affect write throughput.

Answer

Increase the Lambda function's reserved concurrency

Answer

Disable DynamoDB Streams on the table

Answer

Enable DynamoDB Accelerator (DAX) for the table

Question 13

A company is using Amazon RDS for MySQL and needs to monitor slow queries to optimize database performance. The team has enabled slow query logs and wants to centralize logging in Amazon CloudWatch Logs for real-time analysis and alerting. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Modify the DB parameter group to enable slow_query_log and set log_output to FILE, then configure the RDS instance to publish the slowquery log file to CloudWatch Logs.. RDS for MySQL can natively stream slow query logs to CloudWatch Logs. This is achieved by modifying the DB parameter group to set 'slow_query_log' to 1 and 'log_output' to 'FILE', then enabling the 'slowquery' log export in the RDS console or CLI. This approach requires no additional infrastructure, minimizing operational overhead. Option A is incorrect because Performance Insights focuses on database performance metrics and schema analysis, not slow query log streaming to CloudWatch. Option B is incorrect because Enhanced Monitoring provides OS-level metrics (CPU, memory, etc.), not slow query logs. Option D is incorrect because exporting logs to S3 and using Lambda adds unnecessary complexity and latency; the native CloudWatch integration is more efficient.

Answer

Enable Performance Insights on the RDS instance and use the Performance Insights dashboard to view slow queries.

Answer

Enable Enhanced Monitoring on the RDS instance and configure CloudWatch alarms based on the metrics.

Answer

Configure the RDS instance to export slow query logs to an S3 bucket, then set up a Lambda function to read the logs and send them to CloudWatch Logs.

Question 14

A company is building a multi-tier web application on AWS. The application must be resilient to the failure of an entire Availability Zone. The architecture includes an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group, and an Amazon RDS for MySQL database. Which TWO actions should be taken to achieve this resilience? (Choose two.)

Accepted Answer

Configure the Auto Scaling group to launch EC2 instances in at least two Availability Zones.. Configuring the Auto Scaling group to launch EC2 instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) can continue serving traffic. This is a fundamental pattern for building AZ-resilient compute tiers. Option E is correct because deploying Amazon RDS for MySQL in a Multi-AZ configuration automatically provisions and maintains a synchronous standby replica in a different AZ, providing automatic failover if the primary DB instance fails, thus ensuring database resilience.

Answer

Configure an RDS read replica in a different Availability Zone.

Answer

Use a Single-AZ RDS for MySQL database to keep costs low.

Answer

Place all EC2 instances in the same Availability Zone to reduce cross-AZ data transfer costs.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all CloudTrail trails across the organization are delivering events to a centralized S3 bucket in the management account. Currently, some member accounts have their own trails. Which THREE steps should the security team take to enforce this? (Choose three.)

Accepted Answer

Create an organization trail in the management account that applies to all accounts.. Creating an organization trail in the management account automatically applies to all accounts and delivers events to the specified S3 bucket. Option C is correct because AWS Config rules can detect non-compliant trails (e.g., trails not delivering to the central bucket) and trigger automatic remediation, such as disabling the non-compliant trail or applying a fix. Option E is correct because an SCP that denies 'cloudtrail:CreateTrail' and 'cloudtrail:UpdateTrail' prevents member accounts from creating or modifying their own trails, enforcing the use of the organization trail. Option A is incorrect because manually disabling CloudTrail in each member account is not scalable and does not prevent future trails. Option D is incorrect because enabling CloudTrail on the centralized S3 bucket (server access logging) logs access to the bucket itself, but does not ensure that CloudTrail trails deliver events to that bucket; it is not a necessary step for centralizing trail logs.

Answer

Manually disable CloudTrail in each member account.

Answer

Enable CloudTrail on the centralized S3 bucket to log access.