DOP-C02 Practice Test 18 — 15 Questions

Question 1

During a deployment, a new application version on an ECS service starts failing health checks. The previous version is still running. The deployment is a rolling update with a 200% percent start. Which ECS feature should the engineer use to automatically revert to the previous version?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ECS deployment circuit breaker. (ECS deployment circuit breaker) is correct because it automatically detects failed deployments (e.g., health check failures) and triggers a rollback to the previous version. With a 200% percent start rolling update, the new version starts before the old is stopped; if health checks fail, the circuit breaker initiates a rollback. Option B (ECS service auto recovery) recovers from underlying infrastructure failures, not deployment failures. Option C (ECS managed scaling) adjusts desired count based on load, not deployment health. Option D (CloudWatch alarm actions) can trigger rollback events but is not an ECS built-in feature; it requires custom automation. Therefore, the correct ECS feature for automatic rollback is the deployment circuit breaker.

Answer

ECS service auto recovery

Answer

ECS managed scaling

Answer

CloudWatch alarm actions

Question 2

An organization needs to audit all AWS API calls made in their account for compliance purposes. Which AWS service should they enable?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity for auditing and compliance. Option A (Amazon CloudWatch Logs) is incorrect as it is a log management service but does not record API calls. Option B (AWS Config) is incorrect because it tracks resource configuration changes, not API calls. Option D (Amazon GuardDuty) is incorrect because it is a threat detection service, not a comprehensive API audit trail.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 3

An application running on Amazon ECS Fargate is experiencing intermittent 'CannotPullContainerError' errors. The task definition references a Docker image in a private Amazon ECR repository. The task execution role has the 'AmazonECSTaskExecutionRolePolicy' policy attached. What is the most likely cause?

Accepted Answer

The Fargate task is in a private subnet without a NAT gateway or VPC endpoint. The 'CannotPullContainerError' occurs when the ECS task cannot retrieve the container image from ECR. Since the task execution role has the 'AmazonECSTaskExecutionRolePolicy' attached, which includes the necessary permissions (ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer), the issue is not permissions. The most likely cause is that the Fargate task is running in a private subnet that lacks a route to the internet (via NAT gateway) or a VPC endpoint for ECR. Without either, the task cannot reach the ECR API to pull the image. Option A is correct. Option B is wrong because the policy provides sufficient permissions. Option C is irrelevant; Auto Scaling does not affect image pulling. Option D is less likely because ECR repositories are typically in the same region, and cross-region pulls would still be possible with proper permissions and networking.

Answer

The task execution role does not have sufficient permissions

Answer

The ECS service is not configured with Auto Scaling

Answer

The ECR repository is not in the same region as the ECS cluster

Question 4

Refer to the exhibit. A CodeBuild project uses this buildspec.yml to build and push a Docker image to Amazon ECR. The build fails at the pre_build phase with the error 'Error: Cannot perform an interactive login from a non TTY device'. What is the MOST likely issue?

Accepted Answer

The CodeBuild project's IAM role does not have permission to call ecr:GetAuthorizationToken.. The error 'Cannot perform an interactive login from a non TTY device' occurs when the `docker login` command is invoked without receiving the password via stdin. In the buildspec, `aws ecr get-login-password` is used to retrieve the password and pipe it to `docker login`. If the CodeBuild project's IAM role lacks the `ecr:GetAuthorizationToken` permission, this command fails silently or returns an error, causing `docker login` to fall back to interactive mode. Since CodeBuild runs in a non‑interactive environment, it throws the TTY error. Option B is correct because the missing permission prevents the password retrieval, leading to the login failure. Options A, C, and D do not directly cause this specific error.

Answer

The AWS_DEFAULT_REGION environment variable is not set in CodeBuild.

Answer

The buildspec.yml is missing the 'docker login' command.

Answer

The Docker daemon is not running on the CodeBuild instance.

Question 5

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent connection timeouts when calling an external API. The engineer needs to capture network traffic to diagnose the issue. Which solution is most appropriate?

Accepted Answer

Enable VPC Flow Logs on the ECS task's elastic network interface.. VPC Flow Logs capture network traffic metadata at the elastic network interface (ENI) level, which can be analyzed to identify dropped packets, timeouts, and other connectivity issues. For ECS tasks with Fargate, each task gets its own ENI, so enabling VPC Flow Logs on that ENI provides network-level diagnostics without needing to run commands inside the container. Option A is wrong because CloudWatch Logs captures application logs, not network packets. Option C is wrong because AWS X-Ray traces requests and provides latency information but does not capture raw network traffic. Option D is wrong because Fargate does not use underlying EC2 instances that the user can access; thus, running tcpdump is not possible.

Answer

Enable detailed CloudWatch Logs for the ECS task.

Answer

Enable AWS X-Ray tracing on the ECS task.

Answer

Run tcpdump on the EC2 instance hosting the ECS task.

Question 6

A company runs a containerized application on Amazon ECS with Fargate launch type. The application consists of three microservices: frontend, backend, and database. The ECS cluster is in a VPC with public and private subnets. The frontend service is publicly accessible via an Application Load Balancer (ALB) in public subnets. The backend service communicates with the database service, which runs as a stateful service with persistent storage using Amazon EFS. The DevOps team is using CloudWatch Container Insights and has enabled Prometheus metrics for the ECS cluster. Recently, the team observed that the frontend service's response time has increased significantly, and some requests are timing out. The team checked the ALB metrics and saw an increase in 5xx errors. They also noticed that the backend service's CPU utilization is high, and the database service's disk I/O is high. The team suspects a bottleneck in the backend service. Which course of action should the team take FIRST to identify the root cause?

Accepted Answer

Check the backend service's application logs in CloudWatch Logs to identify errors or slow database queries.. The first step is to analyze the backend service's application logs to identify any errors or slow operations. High CPU and disk I/O may be caused by inefficient queries or code issues. Option A is incorrect because disabling health checks would hide the problem and could route traffic to unhealthy tasks. Option B is incorrect because migrating to RDS does not address the immediate issue and is a significant change without root cause analysis. Option D is incorrect because increasing the desired count without understanding the root cause may temporarily alleviate load but does not fix underlying performance issues and can increase costs.

Answer

Disable the health check for the backend service in the ALB target group.

Answer

Migrate the database service to Amazon RDS for better performance.

Answer

Increase the desired count of the backend service to reduce load per task.

Question 7

A DevOps engineer creates the IAM policy above for an instance role. The role is attached to an EC2 instance that runs an application. The application starts and stops EC2 instances and reads a database password from Systems Manager Parameter Store. However, the application fails to retrieve the parameter. What is the most likely cause?

Accepted Answer

The parameter is a SecureString and the policy does not grant 'kms:Decrypt' permission for the KMS key.. The policy allows 'ssm:GetParameter' and 'ssm:GetParameters' on the specific parameter ARN. However, to retrieve a parameter, the action 'ssm:GetParameter' is sufficient, but the resource ARN must be correct. The given ARN includes the parameter name '/MyApp/DBPassword'. If the application is using a different path or the parameter is encrypted, the policy might be insufficient. But the most common issue is that the parameter is a SecureString and the policy also needs 'kms:Decrypt' access to the KMS key. Option C is correct because the policy does not include KMS permissions. Option A and B are less likely. Option D is incorrect because the actions are allowed.

Answer

The policy does not allow 'ssm:GetParameterHistory'.

Answer

The policy does not allow 'ec2:DescribeParameters'.

Answer

The policy does not allow 'ssm:GetParameter' on the specific resource.

Question 8

A DevOps engineer is creating a CloudFormation template to deploy a VPC with public and private subnets. The template uses the 'AWS::EC2::VPC' resource and two 'AWS::EC2::Subnet' resources. The engineer wants to ensure that the subnets are created in different Availability Zones. What is the best approach?

Accepted Answer

Use Fn::GetAZs function with Fn::Select to pick different AZs from the region's AZ list.. Fn::GetAZs returns a list of all Availability Zones in the region, and Fn::Select allows you to pick specific indices from that list, ensuring each subnet is assigned a different AZ. This approach is dynamic and region-agnostic, so the template works across regions without hardcoding AZ names. It also avoids the risk of using the same AZ for both subnets, which would violate the requirement for high availability.

Answer

Use the CidrBlock property to define different AZs.

Answer

Use Fn::GetAZs function with a count of 2 to automatically assign different AZs.

Answer

Hardcode the Availability Zone names in the template.

Question 9

A company is using AWS CloudFormation to deploy a microservices architecture. The operations team wants to receive real-time notifications when any stack operation fails. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Amazon CloudWatch Events (now Amazon EventBridge) can capture CloudFormation stack state changes, including failures, and trigger an Amazon SNS topic to send real-time notifications. Therefore, options D (CloudWatch Events/EventBridge) and E (SNS) are correct. Option A is incorrect because AWS Lambda alone does not provide notification capabilities; it would need to be triggered by another service. Option B is incorrect because CloudWatch Logs stores logs but does not natively trigger notifications for stack failures. Option C is incorrect because AWS CloudTrail records API activity for auditing, not real-time stack event notifications.

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 10

A company wants to monitor the number of messages that are published to an Amazon SNS topic. Which CloudWatch metric should be used?

Accepted Answer

NumberOfMessagesPublished. The CloudWatch metric 'NumberOfMessagesPublished' tracks the number of messages published to an SNS topic. Option A (SMSMonthToDateSpentUSD) tracks monthly SMS spend, not messages published. Option B (PublishSize) is not a standard SNS metric; the relevant metric is 'PublishSize' for message size, but it's not for counting messages. Option C (NumberOfNotificationsDelivered) counts messages delivered to subscribers, not published.

Answer

SMSMonthToDateSpentUSD

Answer

PublishSize

Answer

NumberOfNotificationsDelivered

Question 11

A company runs a containerized application on Amazon EKS. They want to ensure that if a node fails, the pods are rescheduled on healthy nodes. Which configuration is necessary?

Accepted Answer

Configure the EKS managed node group with a health check and ensure that the Kubernetes control plane automatically reschedules pods from failed nodes.. EKS managed node groups automatically register nodes with the Kubernetes control plane, and the Kubernetes node controller (part of the kube-controller-manager) monitors node health via the NodeLifecycleController. When a node fails (e.g., due to an EC2 instance termination or health check failure), the control plane marks the node as `NotReady` and, after the default pod eviction timeout (5 minutes), evicts pods from the failed node, rescheduling them on healthy nodes. This behavior is inherent to Kubernetes and does not require additional configuration beyond using a managed node group.

Answer

Configure a pod disruption budget to prevent too many pods from being terminated simultaneously.

Answer

Use a horizontal pod autoscaler to increase the number of pods during high load.

Answer

Use a cluster autoscaler to automatically add new nodes when pods are pending.

Question 12

An organization uses AWS Systems Manager to manage its EC2 instances. After a security incident, the security team wants to ensure that all future API calls to Systems Manager are logged and monitored. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS CloudTrail for the Systems Manager service. Enabling CloudTrail for Systems Manager logs all API calls made to the Systems Manager service. Option A is incorrect because S3 server access logging only logs access to S3 buckets, not Systems Manager API calls. Option C is incorrect because the CloudWatch Logs agent captures instance logs, not API calls to Systems Manager. Option D is incorrect because AWS Config rules track configuration changes, not API calls. Therefore, CloudTrail is the most efficient way to log and monitor all future API calls to Systems Manager.

Answer

Enable S3 server access logging on the Systems Manager log bucket

Answer

Install the CloudWatch Logs agent on each instance to capture Systems Manager logs

Answer

Create an AWS Config rule to monitor Systems Manager usage

Question 13

A DevOps engineer manages a production environment with EC2 instances behind an Application Load Balancer (ALB). The application logs show intermittent 5xx errors from the ALB. The engineer needs to identify whether the errors originate from the targets or the ALB itself. Which CloudWatch metric should be examined to differentiate between these two sources?

Accepted Answer

HTTPCode_Target_5XX_Count. HTTPCode_Target_5XX_Count, is the correct metric to identify 5xx errors originating from the targets (EC2 instances). The ALB has separate metrics for target errors (HTTPCode_Target_5XX_Count) and ALB errors (HTTPCode_ELB_5XX_Count). Option A (TargetResponseTime) measures latency, not error codes. Option B (UnhealthyHostCount) counts unhealthy targets based on health checks, not specific HTTP errors. Option D (RequestCount) is total requests, not error codes.

Answer

TargetResponseTime

Answer

UnhealthyHostCount

Answer

RequestCount

Question 14

A company wants to receive notifications when an EC2 instance's CPU utilization exceeds 90% for 10 consecutive minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch alarm. Amazon CloudWatch alarms monitor specified metrics (like CPU utilization) and trigger actions (e.g., SNS notification) when a threshold is breached for a given period. Option A is correct. Option B is incorrect because AWS Config rules evaluate configuration compliance, not metric thresholds. Option C is incorrect because AWS CloudTrail records API activity, not metric monitoring. Option D is incorrect because Amazon Inspector assesses security vulnerabilities, not performance metrics.

Answer

AWS Config rule

Answer

AWS CloudTrail event

Answer

Amazon Inspector

Question 15

A DevOps engineer is troubleshooting a performance issue with an Amazon RDS for MySQL database. The engineer suspects that slow queries are causing high CPU utilization. Which TWO actions can the engineer take to identify the slow queries?

Accepted Answer

Enable the slow query log and publish it to CloudWatch Logs.. Enable the slow query log and publish it to CloudWatch Logs (Option C) allows you to capture and analyze slow SQL queries. Performance Insights (Option D) provides a dashboard to visualize database load and identify the top SQL statements causing performance issues. Option A is incorrect because event subscriptions for low storage notify about storage events, not slow queries. Option B is incorrect because monitoring CPUUtilization only indicates high CPU usage but does not identify specific slow queries. Option E is incorrect because Enhanced Monitoring provides OS-level metrics like CPU and memory, not the actual SQL queries.

Answer

Create an RDS event subscription for 'low storage' events.

Answer

Monitor the 'CPUUtilization' metric in CloudWatch.

Answer

Enable Enhanced Monitoring to view process list and SQL queries.