DOP-C02 Practice Test 18 — 15 Questions

Question 1

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. Users report intermittent 503 errors. CloudWatch metrics show that the ALB's 'RequestCount' is normal, but 'HTTPCode_ELB_5XX_Count' spikes. The 'TargetResponseTime' metric shows occasional high latency. Which troubleshooting step should the DevOps engineer take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable and analyze the ALB access logs stored in S3, filtering for 503 errors and correlating with target response times.. The correct first step is to enable and analyze ALB access logs (Option A). ALB access logs contain detailed information about each HTTP request, including the response status code (e.g., 503), target response time, and the specific target that handled the request. By filtering for 503 errors and correlating with high target response times, the engineer can identify whether the errors are caused by slow or failing targets. Option B (increasing desired capacity) does not address the root cause and may not help if the issue stems from target health or configuration. Option C (disabling connection draining) can worsen the problem by abruptly terminating in-flight requests, increasing errors. Option D (reviewing CloudTrail logs) is not useful because CloudTrail captures API changes, not HTTP-level errors.

Answer

Increase the desired capacity of the Auto Scaling group to handle more requests.

Answer

Disable connection draining on the target group to prevent slow-draining instances from causing errors.

Answer

Review AWS CloudTrail logs for any recent configuration changes to the ALB.

Question 2

A company's DevOps team notices that their Amazon RDS for PostgreSQL instance's CPU utilization spikes to 90% every day at 10:00 AM, causing application latency. They want to be notified when the CPU utilization exceeds 80% for more than 5 minutes to investigate the cause. Which solution should they implement?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and a threshold of 80, and set the alarm action to send a notification to an Amazon SNS topic.. An Amazon CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and a threshold of 80% will evaluate the average CPU utilization over 5-minute intervals. When the average exceeds 80% for a single 5-minute period, the alarm triggers and sends a notification to an SNS topic, meeting the requirement of being alerted when CPU exceeds 80% for more than 5 minutes. Option A is incorrect because CloudWatch Logs Insights is used for querying and analyzing log data, not for triggering alarms on metrics like CPU utilization. Option B is incorrect because AWS Trusted Advisor provides best practice recommendations and does not create custom CloudWatch alarms. Option D is incorrect because AWS CloudTrail records API activity and does not monitor CPU utilization metrics; it cannot trigger notifications based on performance thresholds.

Answer

Use Amazon CloudWatch Logs Insights to query the RDS logs and trigger an SNS notification when CPU utilization is high.

Answer

Enable AWS Trusted Advisor to automatically create a CloudWatch alarm on the CPU utilization metric.

Answer

Create an AWS CloudTrail trail to monitor CPU utilization and trigger an AWS Lambda function to send an email notification.

Question 3

A company uses AWS CloudFormation to deploy a multi-tier application. The network team manages the VPC and subnets using a separate CloudFormation stack. The application team needs to reference the VPC ID and subnet IDs from the network stack. Which approach should the application team use to obtain these values?

Accepted Answer

Export the VPC ID and subnet IDs from the network stack using the 'Export' field and import them in the application stack using Fn::ImportValue.. CloudFormation's Export and Fn::ImportValue mechanism allows cross-stack references without hardcoding or duplicating values. The network stack exports the VPC ID and subnet IDs using the Export field, and the application stack imports them via Fn::ImportValue, ensuring that changes in the network stack propagate automatically to dependent stacks.

Answer

Hardcode the VPC and subnet IDs in the application template.

Answer

Create the network stack as a nested stack inside the application stack.

Answer

Store the VPC and subnet IDs in AWS Systems Manager Parameter Store and retrieve them using dynamic references.

Question 4

A company uses AWS CloudFormation to manage infrastructure. The development team wants to promote changes from a development environment to a production environment using change sets. They need to ensure that the production stack is not updated if there are any changes to the stack's IAM policies. Which approach should the team use?

Accepted Answer

Create a ChangeSet from the updated template, review the changes for IAM modifications, and execute only if no IAM changes are present.. AWS CloudFormation change sets allow you to review the proposed changes to a stack before executing them. By creating a change set from the updated template, the team can inspect the list of changes and specifically look for any modifications to IAM resources (e.g., AWS::IAM::Role, AWS::IAM::Policy). If the change set contains IAM-related changes, they can choose not to execute it, thereby preventing unintended updates to the production stack's IAM policies.

Answer

Enable drift detection on the production stack and compare with the development stack.

Answer

Use AWS CloudFormation StackSets to deploy to multiple accounts and use stack instance filters.

Answer

Use a custom resource in the template that checks for IAM changes and fails the update.

Question 5

A DevOps team needs to implement a solution to automatically remediate an S3 bucket that becomes publicly accessible. Which TWO services should they use together?

Accepted Answer

AWS Config. AWS Config can monitor S3 bucket configurations using a managed rule such as s3-bucket-public-read-prohibited. When a violation is detected, Config can automatically invoke an AWS Systems Manager Automation document as a remediation action. Systems Manager Automation runs a pre-defined workflow (e.g., applying a bucket policy that blocks public access) to correct the issue. This combination provides automated, event-driven remediation without manual intervention, making AWS Config and AWS Systems Manager Automation the correct pair.

Answer

AWS CloudTrail

Answer

AWS Lambda

Answer

Amazon GuardDuty

Question 6

A team uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS instance. During an update, the stack fails with 'CREATE_FAILED' for the DB instance resource, and the error message indicates 'The DB instance already exists.' What is the most likely cause?

Accepted Answer

An RDS instance with the same identifier already exists in the account and region.. The error 'The DB instance already exists' indicates that CloudFormation is attempting to create a new RDS instance with a DB instance identifier that is already in use within the same AWS account and region. Since DB instance identifiers must be unique per account and region, the creation fails. This typically occurs when a stack update triggers a resource replacement (e.g., due to a property change that requires recreation) and the old instance was not deleted or its identifier is still reserved.

Answer

The stack update is trying to replace the DB instance without a proper UpdateReplace policy.

Answer

The stack has a DeletionPolicy of Retain on the RDS instance.

Answer

The RDS instance has deletion protection enabled.

Question 7

A DevOps engineer is configuring a centralized logging solution using Amazon CloudWatch Logs. They need to ensure that logs from multiple AWS accounts are aggregated into a single CloudWatch Logs account. Which approach meets this requirement?

Accepted Answer

Create a subscription filter in each account that delivers log events to a CloudWatch Logs destination in the central account.. CloudWatch Logs supports cross-account subscription filters that can deliver log events to a CloudWatch Logs destination in a central account. The destination is a logical resource that points to a Kinesis Data Stream or Lambda function in the central account, and the source account creates a subscription filter that sends matching log events to that destination. This allows centralized aggregation without requiring each account to manage separate streaming infrastructure.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket, then use Amazon Athena to query.

Answer

Set up a cross-account destination using an Amazon Kinesis Data Streams stream in the central account and configure each account to send logs to that stream.

Answer

Configure each application to use the PutLogEvents API to send logs directly to the central account's log group.

Question 8

A company uses AWS Config to evaluate resource compliance. They have a custom AWS Config rule that checks whether EC2 instances have a specific tag. The rule is triggered by configuration changes. The DevOps engineer notices that the rule evaluation results show 'NON_COMPLIANT' for some instances that actually have the tag. Which TWO could be causes? (Choose TWO.)

Accepted Answer

The Lambda function that evaluates the rule has a logic error. A logic error in the Lambda function evaluating the custom rule can cause it to incorrectly mark compliant resources as NON_COMPLIANT, such as misinterpreting the tag key/value or case sensitivity. Option E is correct because if the AWS Config service role lacks permission to invoke the Lambda function, the evaluation fails. If the custom rule has a default compliance value of NON_COMPLIANT for evaluation failures, the resource will be marked NON_COMPLIANT even though the tag is present.

Answer

The rule's maximum execution frequency is set to 24 hours

Answer

The rule is not being triggered by CloudTrail events

Answer

The rule is configured to evaluate only for a specific resource type that does not include EC2

Question 9

A DevOps team is deploying a web application on EC2 instances behind an ALB. The application must authenticate users using an external identity provider (IdP) that supports SAML 2.0. Which solution provides the simplest integration with the ALB?

Accepted Answer

Configure the ALB to use an SAML identity provider for authentication. The Application Load Balancer (ALB) natively supports SAML 2.0 identity provider (IdP) authentication. This allows the ALB to offload user authentication at the edge, validating SAML assertions directly and forwarding authenticated requests to the target EC2 instances without any application-level changes. This is the simplest integration as it requires no additional infrastructure or code on the EC2 instances.

Answer

Use Amazon Cognito user pools with SAML federation and integrate with ALB

Answer

Use AWS CloudFront with Lambda@Edge to validate SAML tokens

Answer

Install a SAML service provider library on each EC2 instance

Question 10

A DevOps team is designing an incident response plan for a critical microservices architecture. They need to automatically collect and analyze logs from all services during an incident. Which solution should they use?

Accepted Answer

Centralize logs in Amazon CloudWatch Logs and use CloudWatch Logs Insights for real-time querying.. Amazon CloudWatch Logs provides a centralized log management service that integrates natively with AWS services. During an incident, CloudWatch Logs Insights enables real-time, ad-hoc querying and analysis of logs from all microservices without needing to set up additional infrastructure, making it the most efficient solution for incident response.

Answer

Stream logs to Amazon Kinesis Data Firehose and analyze with Amazon OpenSearch Service.

Answer

Store logs in Amazon S3 and use Amazon Athena to query them.

Answer

Use AWS Systems Manager Run Command to execute log collection scripts on each instance.

Question 11

A company's application runs on Amazon ECS with Fargate launch type. The application must be resilient to an Availability Zone failure. Which configuration should be used?

Accepted Answer

Create an ECS service with tasks distributed across multiple Availability Zones using a spread placement strategy. ECS services using the Fargate launch type can distribute tasks across multiple Availability Zones (AZs) by defining a spread placement strategy with the 'availabilityZone' dimension. This ensures that if one AZ fails, the tasks in the other AZs continue to serve traffic, providing resilience to an AZ failure. The spread strategy explicitly instructs ECS to place tasks evenly across AZs, which is essential for high availability.

Answer

Use an ECS cluster with a cluster placement strategy that prefers the same Availability Zone

Answer

Define multiple task definitions, one for each Availability Zone

Answer

Use an ECS service with a single task in one Availability Zone and rely on auto-scaling

Question 12

A DevOps engineer is writing an AWS CloudFormation template that creates an Amazon S3 bucket with versioning enabled. The engineer wants to ensure that the bucket cannot be deleted accidentally. What should the engineer add to the template?

Accepted Answer

Set the DeletionPolicy attribute to Retain on the S3 bucket resource. Setting the DeletionPolicy attribute to Retain on the S3 bucket resource ensures that when the CloudFormation stack is deleted, the bucket is preserved and not removed. This is the correct AWS CloudFormation mechanism to prevent accidental deletion of a resource, as it overrides the default behavior of deleting all resources when a stack is deleted.

Answer

Enable termination protection on the S3 bucket

Answer

Add a DependsOn clause to the bucket referencing the stack itself

Answer

A bucket policy that denies s3:DeleteBucket

Question 13

A DevOps engineer is troubleshooting an AWS OpsWorks for Chef Automate deployment. The Chef server is configured with a custom run list that includes a recipe to install and configure an application. The test environment works correctly, but in the production environment, the application fails to start. The Chef client logs show that the recipe executed successfully, but the application process is not running. What is the most likely cause of this issue?

Accepted Answer

The IAM instance profile attached to the production EC2 instance does not have the necessary permissions to start the application service.. The IAM instance profile determines the AWS API permissions available to the EC2 instance. If the profile lacks permissions to call the service startup API (e.g., `ec2:StartInstances` or `autoscaling:CompleteLifecycleAction`), or to access required resources like an EFS mount target or Secrets Manager secret, the Chef recipe's service resource may execute without error but the underlying systemd or init daemon cannot actually start the application process. The Chef client logs only show recipe execution success, not the outcome of the service start, so the application fails silently.

Answer

The OpsWorks stack is configured to use 'auto-healing' which automatically terminates and replaces instances that fail to start the application.

Answer

The Chef server in production is running a different version of Chef than the test environment, causing the recipe to behave differently.

Answer

The Chef recipe does not include a 'service' resource to start the application; it only installs the package.

Question 14

A DevOps team is using AWS CloudFormation to manage a multi-tier application. They want to ensure that when an update to the stack causes a resource replacement, the replacement occurs only after the new resource is fully created and tested. Which CloudFormation feature should they use?

Accepted Answer

CreationPolicy attribute. The CreationPolicy attribute can be added to a resource to ensure that CloudFormation waits for a specified number of success signals before considering the resource created. When a stack update causes a resource replacement, CloudFormation creates the new resource, waits for the creation signals (if a CreationPolicy is defined), and only then deletes the old resource. This ensures the new resource is fully operational and tested before replacement. The other options are incorrect: UpdatePolicy with AutoScalingRollingUpdate is for updating instances in an Auto Scaling group without full replacement; DeletionPolicy Retain keeps the old resource but does not manage creation; DependsOn controls creation order but does not wait for testing signals.

Answer

UpdatePolicy attribute with AutoScalingRollingUpdate

Answer

DeletionPolicy attribute set to Retain

Answer

DependsOn attribute to specify creation order

Question 15

A company runs a stateful web application on EC2 instances behind a Network Load Balancer (NLB) in a single Availability Zone. The application stores session state locally on the instance. The company wants to achieve high availability across multiple AZs with minimal application changes. What should the DevOps engineer do?

Accepted Answer

Replace the NLB with an ALB and enable sticky sessions (session affinity) using the ALB's cookie.. Replacing the NLB with an ALB and enabling sticky sessions (session affinity) using the ALB's cookie allows the stateful web application to maintain session state across multiple AZs without modifying the application code. The ALB generates a cookie (AWSALB) that binds a client's session to a specific target instance, ensuring subsequent requests from the same client are routed to the same EC2 instance. This achieves high availability across AZs with minimal changes, as the application continues to store session state locally on the instance.

Answer

Add more AZs and configure the NLB with cross-zone load balancing.

Answer

Replace the NLB with an ALB and use ElastiCache for session storage.

Answer

Use a Multi-AZ RDS instance to store session state.