DOP-C02 Practice Test 15 — 15 Questions

Question 1

An organization uses AWS CloudFormation to manage infrastructure across multiple accounts using AWS Organizations. They want to enforce that all S3 buckets are encrypted with SSE-S3. A DevOps engineer creates a service control policy (SCP) to deny the creation of any S3 bucket without encryption. However, CloudFormation stack creation fails with an access denied error even when the template includes encryption. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CloudFormation template specifies SSE-KMS encryption, which is not allowed by the SCP.. The SCP denies the creation of S3 buckets without encryption, but it specifically allows only SSE-S3 encryption. If the CloudFormation template specifies SSE-KMS encryption, the SCP will deny the request, causing an access denied error—even though encryption is present. This mismatch between the encryption type required by the SCP (SSE-S3) and what the template requests (SSE-KMS) is the most likely cause of the failure.

Answer

The SCP is denying the s3:PutBucketPublicAccessBlock action, which is required for all bucket creation requests.

Answer

The SCP is incorrectly scoped to the management account instead of the member accounts.

Answer

The CloudFormation service role does not have permissions to create buckets in the target account.

Question 2

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. During a recent traffic spike, the application became unavailable for 10 minutes. Analysis shows that the ALB's healthy host count dropped to zero because the instances failed health checks due to high CPU load. What is the MOST effective design change to improve resilience during future traffic spikes?

Accepted Answer

Use predictive scaling with a scheduled scaling policy for known peak times.. Predictive scaling uses historical traffic data to forecast future demand and proactively adjust capacity before a spike occurs. This prevents the CPU from reaching critical levels that cause health check failures, ensuring the ALB always has healthy hosts. Scheduled scaling alone would not adapt to unexpected spikes, but predictive scaling combined with dynamic scaling provides both proactive and reactive resilience.

Answer

Increase the instance size to handle higher load.

Answer

Configure step scaling policies based on CPU utilization.

Answer

Set a higher CPU threshold for health checks.

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic to the ALB must be encrypted (HTTPS) and that the ALB must only accept traffic from CloudFront. The DevOps engineer has configured CloudFront with an origin pointing to the ALB, and the ALB has a listener on port 443 with a valid SSL certificate. The engineer also added a security group rule to the ALB that allows HTTPS traffic only from CloudFront's IP ranges. However, users are reporting intermittent 503 errors. The engineer checks CloudFront logs and sees that some requests are failing with 'Origin Connect Error'. What is the most likely cause?

Accepted Answer

The security group rule is using an outdated list of CloudFront IP ranges, and CloudFront has added new IP ranges that are being blocked.. The most likely cause is that the security group rule is using an outdated list of CloudFront IP ranges. CloudFront's IP ranges are dynamic and change over time; AWS publishes these ranges but they are not static. When a new range is added that is not in the security group rule, requests from those IPs are blocked, leading to 'Origin Connect Error' and intermittent 503 errors. The correct approach is to use a custom header (e.g., X-Origin-Verify) from CloudFront and validate it at the ALB, rather than relying on IP-based security groups. Option A (WAF blocking) would typically result in 403 Forbidden, not 503. Option C (SSL certificate) would cause handshake failures with a different error. Option D (idle timeout) would cause consistent timeout errors, not intermittent ones.

Answer

The ALB has a Web Application Firewall (WAF) that is blocking requests from CloudFront.

Answer

The SSL certificate on the ALB is not trusted by CloudFront, causing handshake failures.

Answer

The ALB idle timeout is set too low, causing CloudFront to close connections prematurely.

Question 4

A company wants to centrally manage user access to multiple AWS accounts using federated identity. Which AWS service should be used to create a single sign-on (SSO) solution?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is purpose-built to centrally manage user access and permissions across multiple AWS accounts and applications from a single place. It allows you to create or connect your existing identity source (e.g., Active Directory, Okta, Azure AD) and then define fine-grained permission sets that map users or groups to specific roles in each account, enabling a true single sign-on (SSO) experience without needing to create IAM users in every account.

Answer

AWS Organizations

Answer

AWS Directory Service for Microsoft Active Directory

Answer

Amazon Cognito

Question 5

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create. The error message indicates a 'circular dependency' between two resources: a security group and an EC2 instance. The security group contains an ingress rule that references the instance's private IP address, which is not known until the instance is created. The instance's network interface uses the security group. What change should the engineer make to resolve the circular dependency?

Accepted Answer

Add an AWS::EC2::SecurityGroupIngress rule that references the instance's network interface using Fn::GetAtt on the network interface resource.. It resolves the circular dependency by creating an explicit dependency on the network interface resource rather than the EC2 instance. The `AWS::EC2::SecurityGroupIngress` rule can use `Fn::GetAtt` on the `AWS::EC2::NetworkInterface` resource to retrieve the private IP address of the instance's primary network interface, which is known after the network interface is created but before the instance is fully launched. This breaks the cycle because the security group ingress rule depends on the network interface, and the network interface depends on the security group (via association), but the instance itself is not directly referenced in the ingress rule, allowing CloudFormation to resolve the dependencies in the correct order.

Answer

Create the EC2 instance first without a security group, then attach the security group after creation.

Answer

Hardcode the instance's private IP address in the security group rule.

Answer

Use the Ref function on the EC2 instance to get its private IP address.

Question 6

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group (ASG) for web servers, and an Amazon RDS Multi-AZ DB instance. The ASG uses a launch template with Amazon Linux 2 and a user data script that installs the web application and connects to the RDS database using a static password stored in the user data. Recently, the security team discovered that the user data script is exposed in the EC2 console and could be viewed by anyone with EC2 describe-instances permissions. The team wants to remediate this immediately without causing downtime. The ASG is configured with a min size of 2, max size of 6, and desired capacity of 4. The application is currently under load. Which option describes the best course of action?

Accepted Answer

Create a new launch template version that retrieves the password from AWS Secrets Manager. Update the ASG to use the new template version and perform an instance refresh with a minimum healthy percentage of 100%.. It uses an instance refresh with a minimum healthy percentage of 100% to replace instances without downtime, while the new launch template version retrieves the password from AWS Secrets Manager, eliminating the static password exposure. This approach ensures that the security vulnerability is remediated immediately without disrupting the running application under load.

Answer

Immediately modify the user data on each running EC2 instance to remove the password, then update the launch template to reference AWS Secrets Manager.

Answer

Update the existing launch template to use AWS Secrets Manager for the database password. The ASG will automatically apply the change to existing instances.

Answer

Delete the existing launch template and create a new one with secrets from AWS Secrets Manager. Then terminate all running instances and let the ASG launch new ones.

Question 7

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The application stores session state in an in-memory cache on each instance. During deployment of a new version, users experience session timeouts and errors. Which design change will MOST effectively improve resilience and avoid session loss during deployments?

Accepted Answer

Migrate session state to ElastiCache for Redis.. Migrating session state from in-memory EC2 instance storage to ElastiCache for Redis decouples session data from individual instances. This ensures that when a new deployment replaces instances, sessions persist independently, preventing timeouts and errors. ElastiCache provides a centralized, highly available session store that survives instance termination and scaling events.

Answer

Enable sticky sessions (session affinity) on the ALB.

Answer

Increase the ALB idle timeout to 600 seconds.

Answer

Increase the EC2 instance size to handle higher memory.

Question 8

A company wants to design a highly available web application using AWS services. The application must be resilient to the failure of an entire AWS Region. Which THREE components should the architecture include? (Choose THREE.)

Accepted Answer

Amazon Route 53 with a failover routing policy.. Amazon Route 53 with a failover routing policy is correct because it enables DNS-based health checking and automatic traffic routing to a secondary region when the primary region becomes unavailable. This is essential for cross-region disaster recovery, as Route 53 can monitor endpoint health and update DNS records to direct users to the healthy region, ensuring application availability despite a full region failure.

Answer

An Application Load Balancer (ALB) deployed in one Region.

Answer

Amazon EC2 instances in a single Region.

Question 9

A DevOps engineer is responsible for managing infrastructure as code for multiple microservices. The team uses AWS CloudFormation and wants to reuse common resource definitions across multiple stacks. Which approach should the engineer use to promote reusability and reduce code duplication?

Accepted Answer

Develop CloudFormation modules that encapsulate common resource configurations and publish them in a registry.. AWS CloudFormation modules allow you to encapsulate common resource configurations into reusable, versioned components that can be published in the CloudFormation registry. This promotes reusability and reduces code duplication across multiple stacks without the overhead of managing nested stack templates or manual copying.

Answer

Create nested stacks that include the common resources and pass parameters as needed.

Answer

Store the common resource definitions in an AWS CodeCommit repository and copy them into each template.

Answer

Use cross-stack references by exporting outputs from a central stack and importing them in other stacks.

Question 10

A company is designing a multi-Region disaster recovery strategy for a stateless web application. The application runs on EC2 instances in an Auto Scaling group behind an ALB in us-east-1. The recovery point objective (RPO) is 15 minutes and recovery time objective (RTO) is 30 minutes. The application data is stored in Amazon RDS for PostgreSQL. Which combination of actions should the company take to meet the RPO and RTO?

Accepted Answer

Use RDS cross-Region replication to a standby DB instance in another Region. Maintain a warm standby environment (Auto Scaling group, ALB) in the disaster Region. Configure Route 53 health checks to fail over automatically.. It meets both the 15-minute RPO and 30-minute RTO. RDS cross-Region replication provides continuous asynchronous replication with minimal lag, typically well under 15 minutes, ensuring data is nearly up-to-date. The warm standby environment (pre-provisioned Auto Scaling group and ALB) in the disaster Region allows automatic failover via Route 53 health checks, enabling recovery within the 30-minute RTO without manual intervention.

Answer

Use RDS cross-Region snapshot copy every 15 minutes. In the disaster Region, manually launch a new environment and restore the latest snapshot.

Answer

Use RDS Multi-AZ in us-east-1. In the disaster Region, keep a standby Auto Scaling group and ALB. On failure, promote the Multi-AZ standby to primary and update DNS.

Answer

Use RDS read replicas in another Region. On failure, promote the read replica to a standalone instance and update the application.

Question 11

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the destination account is 222222222222. Which policy should be attached to the S3 bucket?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. It uses a bucket policy to grant cross-account access to the S3 bucket. The policy specifies the destination account (222222222222) as the principal, allowing s3:GetObject on the bucket's objects. This is the standard AWS approach for cross-account S3 access, as bucket policies can grant permissions to principals in other AWS accounts.

Answer

Attach an IAM policy to the user in account 111111111111 allowing s3:GetObject.

Answer

Set the bucket ACL to grant full control to account 222222222222.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 12

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is failing because the new instances are not passing the health checks. The team wants to automatically roll back the deployment if health checks fail. Which THREE steps should the team take?

Accepted Answer

Create a CloudWatch alarm based on the ELB health check metric.. Creating a CloudWatch alarm based on the ELB health check metric allows you to monitor the health of instances in the Auto Scaling group. When the alarm triggers due to failed health checks, it can be used in conjunction with an automatic rollback configuration to revert the deployment to the previous revision. This ensures that unhealthy instances are detected early and the deployment is rolled back automatically, minimizing downtime.

Answer

Use a deployment configuration with a high minimum healthy host percentage.

Answer

Store the deployment artifacts in an S3 bucket with versioning enabled.

Question 13

A DevOps engineer is troubleshooting an application running on an EC2 instance. The application needs to access an Amazon RDS database using IAM database authentication. The EC2 instance is associated with an IAM role 'EC2-AppRole', and the RDS instance has a resource-based policy that allows 'DatabaseAccessRole' to connect. The engineer sees the error in the exhibit. What is the most likely cause?

Accepted Answer

The trust policy of the IAM role 'DatabaseAccessRole' does not allow the EC2 instance role 'EC2-AppRole' to assume it.. The error indicates that the EC2 instance's IAM role 'EC2-AppRole' cannot authenticate to the RDS instance. IAM database authentication requires the EC2 instance to assume a database authentication token, which is generated by calling the RDS API with the 'EC2-AppRole' credentials. However, the RDS instance's resource-based policy only allows 'DatabaseAccessRole' to connect. For 'EC2-AppRole' to successfully authenticate, it must first assume 'DatabaseAccessRole' via a trust policy that permits the EC2 instance role to assume it. Without this trust relationship, the authentication token request fails, causing the error.

Answer

The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.

Answer

The security group for the EC2 instance does not allow outbound traffic to the RDS instance.

Answer

The EC2 instance does not have the correct IAM instance profile attached.

Question 14

A DevOps engineer needs to set up a monitoring solution for an AWS Lambda function that processes messages from an Amazon SQS queue. The engineer wants to be alerted if the function fails to process a message (i.e., the message ends up in the dead-letter queue). Which approach should they use?

Accepted Answer

Create a CloudWatch alarm on the ApproximateNumberOfMessagesVisible metric of the dead-letter queue.. The `ApproximateNumberOfMessagesVisible` metric on the dead-letter queue (DLQ) directly reflects the number of messages that have failed processing and been moved there. By creating a CloudWatch alarm on this metric (e.g., when it exceeds 0 for a period), the engineer receives an alert precisely when messages are failing, without needing to parse logs or rely on indirect indicators.

Answer

Enable CloudTrail to log SQS API calls and create a metric filter for SendMessage to the DLQ.

Answer

Create a CloudWatch Events rule to monitor the Lambda function errors.

Answer

Configure the Lambda function's dead-letter queue to send notifications via Amazon SNS.

Question 15

A company runs a critical web application on AWS. The application is deployed across multiple Availability Zones using an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The Auto Scaling group uses a launch template that specifies an Amazon Linux 2 AMI. The application stores session state in an ElastiCache Redis cluster. Recently, the operations team received alerts that the application is returning 503 errors intermittently. Investigation shows that the ALB target group health checks are failing for some instances, but those instances are still in service. The CloudWatch logs from the instances show that the application is running, but the health check endpoint is timing out after 5 seconds. The health check is configured with a 5-second timeout, 10-second interval, and 2 consecutive successes required to mark healthy. The DevOps engineer suspects that the issue is due to high CPU utilization on the instances causing the health check to respond slowly. The engineer wants to implement a solution that prevents the ALB from routing traffic to instances that are experiencing high CPU, and also automatically scales out to handle the increased load. What should the engineer do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization and use it to perform an EC2 action to stop the instance, and configure the Auto Scaling group to use a target tracking scaling policy based on CPU utilization.. It addresses both the immediate issue (high CPU causing health check timeouts) and the scaling requirement. Stopping the instance via a CloudWatch alarm removes it from the ALB target group, preventing traffic routing to unhealthy instances. The target tracking scaling policy based on CPU utilization automatically adds instances when CPU is high, ensuring capacity matches demand.

Answer

Configure the Auto Scaling group to use ELB health checks and set the health check grace period to 600 seconds.

Answer

Create a scheduled scaling action to add more instances during peak hours.

Answer

Increase the health check timeout to 10 seconds and the interval to 20 seconds to give instances more time to respond.