DOP-C02 Practice Test 19 — 15 Questions

Question 1

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance fails, and automatic failover does not occur within the expected 1-2 minutes. The DevOps team needs to quickly restore database availability. What should the team do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reboot the DB instance with failover selected.. When automatic failover does not occur within the expected 1-2 minutes, the fastest way to manually trigger a failover is to reboot the DB instance with the 'Reboot with Failover' option selected. This forces the RDS service to promote the standby replica to the new primary, restoring database availability without waiting for the automated health check to complete. Option D is correct because it directly initiates the failover process, leveraging the existing Multi-AZ setup.

Answer

Restore the latest automated snapshot to a new DB instance.

Answer

Modify the DB instance to change the Multi-AZ setting to enable automatic failover.

Answer

Connect to the standby instance directly and promote it to primary.

Question 2

A company runs a web application on EC2 instances behind an ALB. To improve resilience, they want to automatically re-register failed instances. Which solution meets this requirement?

Accepted Answer

Enable EC2 instance recovery and configure ALB health checks to deregister unhealthy instances.. Enabling EC2 instance recovery automatically restarts the instance on a new healthy host if the underlying hardware fails, while ALB health checks detect application-level failures and deregister unhealthy instances from the target group. This combination ensures failed instances are automatically replaced in the load balancer's rotation without manual intervention, meeting the resilience requirement.

Answer

Set up a CloudWatch alarm to terminate the instance and notify an operator to re-register it.

Answer

Configure Auto Scaling to launch a new instance on instance failure.

Answer

Use Route 53 health checks to detect failure and update DNS to remove the instance.

Question 3

A DevOps engineer notices that an Amazon RDS for MySQL instance's CPU is consistently high during business hours. The engineer wants to identify the specific queries causing the high CPU. Which combination of services should be used to capture and analyze the queries? (Choose the best answer.)

Accepted Answer

Enable RDS Performance Insights and analyze the top SQL queries. RDS Performance Insights provides a database performance tuning feature that visualizes database load and identifies the specific SQL queries causing high CPU. It captures query-level metrics such as wait events, SQL digest, and host/user information, allowing the DevOps engineer to pinpoint the exact queries responsible for the CPU spike during business hours.

Answer

Enable RDS Enhanced Monitoring and view metrics in CloudWatch

Answer

Enable AWS X-Ray tracing on the application and database

Answer

Enable RDS audit logs and stream them to Amazon CloudWatch Logs

Question 4

During a deployment using AWS CodeDeploy, the deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment group is configured with a minimum healthy instances of 75%. What could be the cause?

Accepted Answer

More than 25% of the instances failed the deployment.. The error message explicitly states that too many individual instances failed deployment and too few healthy instances are available. With a minimum healthy instances setting of 75%, the deployment fails when more than 25% of the instances in the deployment group fail their deployment. This is a built-in safety mechanism in AWS CodeDeploy to prevent cascading failures and ensure application availability.

Answer

The deployment configuration timeout is too short.

Answer

The CodeDeploy service role does not have sufficient permissions.

Answer

The instances are not running the CodeDeploy agent.

Question 5

A development team is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a Source stage connected to an Amazon S3 bucket, a Build stage using AWS CodeBuild, and a Deploy stage that deploys to an Amazon ECS cluster. The team notices that the pipeline fails intermittently during the Build stage with a 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE' error. What is the most likely cause?

Accepted Answer

The CodeBuild project is configured to run in a VPC without a NAT gateway, and the build image is pulled from a public registry.. The 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE' error in AWS CodeBuild indicates that the build environment cannot pull the specified Docker image from its registry. When a CodeBuild project is configured to run in a VPC without a NAT gateway, it lacks outbound internet access, which is required to pull images from public registries like Docker Hub or Amazon ECR public. This is the most likely cause because the error is intermittent (e.g., if the image is cached locally sometimes) and directly relates to network connectivity.

Answer

The CodeBuild project is in a different AWS Region than the CodePipeline pipeline.

Answer

The S3 bucket where the source code is stored has a bucket policy denying access to the CodeBuild service role.

Answer

The CodeBuild project does not have enough memory or vCPU allocated.

Question 6

A developer wants to use AWS CloudFormation to create an Amazon RDS DB instance. The template includes a DB instance resource. Which property is required for the DB instance to be created successfully?

Accepted Answer

DBInstanceClass and Engine. In AWS CloudFormation, when creating an Amazon RDS DB instance using the AWS::RDS::DBInstance resource, the only truly required properties are DBInstanceClass (the compute and memory capacity) and Engine (the database engine, e.g., MySQL, PostgreSQL). These two properties are mandatory in the CloudFormation resource specification; without them, the template will fail validation. All other properties, such as AllocatedStorage, DBInstanceIdentifier, MasterUsername, and MasterUserPassword, have default behaviors or can be omitted under certain conditions (e.g., AllocatedStorage defaults to 20 GB for some engines, and MasterUsername/MasterUserPassword are not required if you use a snapshot or a source DB instance).

Answer

AllocatedStorage

Answer

DBInstanceIdentifier

Answer

MasterUsername and MasterUserPassword

Question 7

A company uses AWS Organizations with multiple accounts. The security team needs to automatically isolate a compromised EC2 instance by removing it from its security group and attaching a quarantine security group that only allows traffic to a forensic instance. Which combination of actions should be implemented?

Accepted Answer

Use AWS Config rules with AWS Systems Manager Automation documents to automatically remove the instance from the security group and attach the quarantine group when non-compliant.. AWS Config rules can evaluate security group membership compliance, and when a non-compliant EC2 instance is detected, an AWS Systems Manager Automation document can be triggered via a remediation action. This automation document can execute the steps to remove the instance from its current security group and attach a quarantine security group, providing a fully automated, event-driven isolation workflow without requiring custom code for orchestration.

Answer

Use Amazon GuardDuty to automatically modify the security group membership of the instance.

Answer

Use AWS Shield Advanced to automatically apply the quarantine security group to the instance.

Answer

Use AWS Lambda functions triggered by Amazon EventBridge to remove the instance from the security group and attach the quarantine group.

Question 8

A DevOps engineer needs to securely store database credentials for an application running on EC2. The credentials must be rotated automatically every 30 days. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with the RDS rotation Lambda blueprint.. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It provides a built-in RDS rotation Lambda blueprint that can be configured to rotate credentials every 30 days without custom code. This fully managed rotation capability meets the requirement for automatic, scheduled rotation with minimal operational overhead.

Answer

Store credentials in AWS Systems Manager Parameter Store and use a Lambda function to rotate them.

Answer

Store credentials in an S3 bucket encrypted with KMS and use S3 Lifecycle policies to rotate the objects.

Answer

Use IAM roles to grant the EC2 instance access to the database, eliminating the need for credentials.

Question 9

A company is using AWS CloudFormation to deploy a critical application stack. The company wants to ensure that the stack can be recovered quickly in case of a failure. Which THREE strategies should the company implement? (Choose THREE.)

Accepted Answer

Use StackSets to deploy the stack across multiple Regions.. AWS CloudFormation StackSets allow you to deploy stacks across multiple AWS Regions and accounts from a single template, enabling multi-Region disaster recovery. By deploying the critical application stack in multiple Regions, you can quickly fail over to a secondary Region if the primary fails, meeting the requirement for rapid recovery.

Answer

Disable rollback on stack creation failure to preserve resources for debugging.

Answer

Define the entire application in a single CloudFormation template.

Question 10

A company requires that all access to their S3 buckets be encrypted in transit. Which configuration achieves this?

Accepted Answer

Use a bucket policy that denies requests when aws:SecureTransport is false.. Using a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` explicitly enforces encryption in transit for all access to the S3 bucket. This policy ensures that any HTTP (non-TLS) request is denied, while HTTPS requests are allowed, meeting the requirement that all access be encrypted in transit.

Answer

Use CloudFront with the bucket as origin and enforce HTTPS only between viewer and CloudFront.

Answer

Enable default encryption on the bucket.

Answer

Set the bucket policy to require SSE-KMS.

Question 11

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the 'ValidateService' lifecycle event. The CloudWatch Agent reports that the target process is running but the health check endpoint returns HTTP 503. The CodeDeploy agent logs show no errors. What is the most likely cause of the failure?

Accepted Answer

The application is not fully functional due to missing configuration files. The 'ValidateService' lifecycle event in CodeDeploy runs a health check against the application endpoint. A 503 HTTP status indicates the web server is running (the target process is up) but the application itself is not fully functional, often due to missing configuration files, environment variables, or dependencies. The CloudWatch Agent confirming the process is running and the CodeDeploy agent logs showing no errors further isolate the issue to the application layer, not the deployment infrastructure.

Answer

The Auto Scaling group is not healthy

Answer

The CodeDeploy agent is not installed on the instances

Answer

The target process is not listening on the expected port

Question 12

A DevOps engineer is creating an AWS CloudFormation template to deploy a stack that includes an Amazon EC2 instance. The instance needs to be launched in a specific subnet. How should the engineer reference the subnet ID in the template?

Accepted Answer

Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.. Defining a parameter of type `AWS::EC2::Subnet::Id` allows the CloudFormation template to accept a subnet ID as input at stack creation or update time, making the template reusable across different environments without modification. This approach follows infrastructure-as-code best practices by avoiding hardcoded values and enabling parameterized deployments.

Answer

Hardcode the subnet ID in the template.

Answer

Use a mapping (Mappings) to define the subnet ID based on the stack name.

Answer

Use the Fn::GetAtt function to retrieve the subnet ID from a VPC resource.

Question 13

A company uses AWS CodeDeploy for application deployments to EC2 instances. The team recently noticed that deployments are failing because some instances do not have the CodeDeploy agent installed. Which configuration management approach should the team implement to ensure the CodeDeploy agent is installed and running on all instances before deployment?

Accepted Answer

Create a custom AMI with the CodeDeploy agent pre-installed, or use a user data script to install the agent at launch.. It ensures the CodeDeploy agent is present on every EC2 instance from the moment it is launched, either by baking the agent into a custom AMI or by installing it via a user data script. This approach aligns with immutable infrastructure and configuration management best practices, preventing deployment failures caused by missing agents. AWS CodeDeploy requires the agent to be installed and running on target instances before any deployment can proceed.

Answer

Use an AWS Config rule to detect instances without the agent and trigger a Lambda function to install it.

Answer

Use the CodeDeploy deployment configuration to skip instances that do not have the agent.

Answer

Configure the CodeDeploy deployment group to automatically install the agent on new instances.

Question 14

A DevOps team is using Amazon CloudWatch Logs to collect application logs from multiple EC2 instances. They notice that some log entries are missing and that the CloudWatch agent is consuming high CPU. The log group has a retention policy of 30 days. Which action should the team take to reduce CPU usage without losing log data?

Accepted Answer

Increase the batch size in the CloudWatch agent configuration.. Increasing the batch size in the CloudWatch agent configuration reduces the number of HTTP API calls made to CloudWatch Logs, which lowers CPU overhead from frequent network I/O and serialization. The agent buffers log events and sends them in larger, less frequent batches, directly addressing high CPU consumption without discarding any log data.

Answer

Use JSON format for logs instead of plain text.

Answer

Set the agent's timezone to UTC.

Answer

Change the log group retention policy to 7 days.

Question 15

A company is designing a resilient architecture for a web application that uses Amazon RDS for MySQL. The application must be able to withstand the loss of an entire AWS Region. Which TWO actions should the company take?

Accepted Answer

Configure automated backups to be copied to another Region.. To withstand the loss of an entire AWS Region, the company must have a disaster recovery strategy that includes cross-region data replication. Option B is correct because copying automated backups to another Region ensures that a recoverable copy of the database exists in a different geographic area, allowing restoration in a separate Region if the primary Region fails. Option D is correct because a Cross-Region Read Replica provides a live, asynchronously replicated copy of the database in another Region, which can be promoted to a standalone primary instance during a regional outage, minimizing recovery time.

Answer

Use RDS Proxy to pool database connections.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Enable deletion protection on the RDS instance.