DOP-C02 Practice Test 20 — 15 Questions

Question 1

Refer to the exhibit. A DevOps engineer created an IAM role 'MyLambdaRole' for a Lambda function. The Lambda function needs to write logs to CloudWatch Logs. However, the function is not able to create log streams. What is the most likely missing configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The role does not have an inline or managed policy that grants permissions for CloudWatch Logs.. The IAM role must have an inline or managed policy that grants permissions for CloudWatch Logs actions such as logs:CreateLogStream and logs:PutLogEvents. Option A is incorrect because the role name does not need a prefix; the trust policy is what matters. Option C is incorrect because the role ARN format does not affect log stream creation. Option D is incorrect because the trust policy allowing Lambda to assume the role is separate from the permissions to write logs; the question states the function is not able to create log streams, which indicates a permissions issue within the role's policies.

Answer

The role name is not prefixed with 'AWSLambda'.

Answer

The role ARN is incorrectly formatted.

Answer

The trust policy does not allow Lambda to assume the role.

Question 2

A company uses AWS CodePipeline to deploy a web application to an Auto Scaling group. The security team requires that all artifacts in the pipeline be encrypted at rest. The pipeline uses an S3 bucket as the artifact store. Which combination of actions should the DevOps engineer take to meet this requirement with minimal operational overhead?

Accepted Answer

Enable S3 default encryption with SSE-S3 on the artifact bucket.. Enabling S3 default encryption with SSE-S3 on the artifact bucket is the simplest way to encrypt all objects at rest with minimal operational overhead. SSES3 uses S3-managed keys, requiring no additional key management or permissions. Option A is wrong because AWS Certificate Manager provides TLS certificates, not encryption for S3 objects. Option C is wrong because using a Lambda function to encrypt artifacts after each stage adds unnecessary complexity and does not automatically encrypt all artifacts, especially existing ones. Option D is wrong because creating a customer-managed KMS key introduces additional overhead for key management and permissions, which is not minimal.

Answer

Use AWS Certificate Manager to encrypt the artifacts.

Answer

Use an AWS Lambda function to encrypt artifacts after each pipeline stage.

Answer

Create a customer-managed KMS key and configure the pipeline to use it for artifact encryption.

Question 3

A company wants to ensure that all S3 buckets are encrypted at rest by default. Which S3 feature should be enabled at the bucket level to automatically encrypt new objects?

Accepted Answer

Default encryption. S3 default encryption allows you to set a default encryption behavior for a bucket, so that all new objects are encrypted at rest automatically. Bucket policies can enforce encryption but do not automatically encrypt. Object lock is for retention. Versioning is for object versions.

Answer

S3 Object Lock

Answer

Bucket policy with a Deny for unencrypted uploads

Answer

S3 Versioning

Question 4

Which TWO actions can help protect an AWS account's root user? (Choose TWO.)

Accepted Answer

Do not create access keys for the root user; use IAM users instead. Not creating access keys for the root user is a best practice because root access keys have full permissions and cannot be restricted. Option C is correct: enabling MFA adds an extra layer of security. Option B is wrong: the root user cannot be deleted. Option D is wrong: rotating the password alone does not protect against unauthorized access; MFA is more important. Option E is wrong: changing the email to a group email does not inherently protect the account and may cause issues with account recovery.

Answer

Delete the root user after creating administrative IAM users

Answer

Rotate the root user password every 30 days

Answer

Change the root user's email address to a group email

Question 5

A company uses AWS CloudFormation to manage a production environment with multiple stacks. The DevOps team needs to implement a change management process that requires approval for any changes to the production stack. Which approaches meet this requirement? (Choose TWO.)

Accepted Answer

Require that all stack updates be performed through a change set that is reviewed and executed by a separate role.. Option B is correct because CloudFormation change sets let you preview exactly what modifications an update will make to the production stack, and gating the actual execution behind a separate role enforces a review-and-approve step before any changes are applied. Option C is correct because AWS CodePipeline supports a manual approval action that pauses the pipeline, allowing a designated approver to review the change set before the pipeline proceeds to execute it against the production stack. Option A is not correct because read-only versus write IAM policies only control who can modify stacks; they do not build a review/approval workflow into the change process. Option D is not correct because AWS Config rules detect and can remediate noncompliant resources after the fact, but they do not provide a pre-change approval gate for CloudFormation stack updates. Option E is not correct because an SCP restricting CloudFormation actions to a CI/CD role limits who can make changes but does not itself require human review or approval of those changes.

Answer

Create an IAM policy that allows only read-only access to the production stack and a separate role with write access.

Answer

Use AWS Config rules to detect unapproved changes and automatically revert them.

Answer

Use an SCP to deny all CloudFormation actions except from a specific CI/CD role.

Question 6

A DevOps engineer is designing an incident response plan for a multi-region application. The application runs on EC2 instances behind an Application Load Balancer (ALB) and uses Amazon RDS for MySQL with Multi-AZ. Which TWO actions should the engineer include to ensure high availability and fast failover during a regional incident?

Accepted Answer

Set up an Amazon RDS read replica in a second region and promote it during failover.. Options A and E are correct. Amazon RDS read replicas can be created in a different region and promoted to a standalone primary instance during a regional incident, providing a disaster recovery solution. Amazon Route 53 with health checks can automatically fail over DNS traffic to a secondary region by routing to a healthy endpoint. Option B is incorrect because Auto Scaling groups are regional and cannot launch instances across multiple regions directly; you would need separate Auto Scaling groups per region. Option C is incorrect because an Application Load Balancer is regional and cannot span regions; you would need separate ALBs in each region and Route 53 to route traffic. Option D is incorrect because Multi-AZ RDS replicates synchronously within a single region only; for cross-region disaster recovery, you need a read replica or a separate Multi-AZ deployment in the other region, not Multi-AZ in a second region (Multi-AZ in a second region is not a standard feature; you would need a separate RDS instance).

Answer

Create an Auto Scaling group that can launch instances in multiple regions.

Answer

Deploy an Application Load Balancer that spans both regions.

Answer

Configure Amazon RDS Multi-AZ in a second region.

Question 7

A DevOps engineer needs to monitor the health of a web application running on EC2 instances behind an Application Load Balancer (ALB). Which TWO metrics from ALB should be monitored to detect application errors? (Choose TWO.)

Accepted Answer

HTTPCode_Target_5XX_Count.. (HTTPCode_Target_5XX_Count) is correct because it counts HTTP 5XX errors returned by the target (EC2 instances), indicating application errors. Option E (TargetResponseTime) is correct because elevated response times can indicate application performance issues or errors, and is a key metric for detecting application problems. Option A (RequestCount) is incorrect because it simply counts total requests, not errors. Option B (HTTPCode_ELB_5XX_Count) is incorrect because it counts 5XX errors generated by the ALB itself (e.g., due to configuration issues), not application errors. Option D (HealthyHostCount) is incorrect because it indicates the number of healthy targets, not application-level errors.

Answer

RequestCount.

Answer

HTTPCode_ELB_5XX_Count.

Answer

HealthyHostCount.

Question 8

Which THREE are valid AWS Systems Manager capabilities for configuration management? (Select THREE.)

Accepted Answer

Run Command. Run Command enables you to manage configuration by remotely executing commands on instances. Patch Manager automates the process of patching managed instances. State Manager helps you define and maintain the desired state of your instances. OpsCenter (B) is an operational data hub for viewing and resolving operational issues, not primarily for configuration management. Parameter Store (C) provides secure storage for configuration data and secrets, but it is a supporting service rather than a configuration management capability itself.

Answer

OpsCenter

Answer

Parameter Store

Question 9

A company is designing a secure CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy. The pipeline must deploy to an EC2 Auto Scaling group across multiple AWS accounts. The security requirements include: (1) no hardcoded credentials, (2) least privilege for cross-account access, (3) encrypted artifacts. Which THREE steps should the DevOps engineer implement? (Choose THREE.)

Accepted Answer

Use a customer-managed KMS key with a cross-account key policy to encrypt artifacts.. Using a customer-managed KMS key with a cross-account key policy allows encrypting artifacts in CodePipeline's artifact store, ensuring that only authorized accounts can decrypt them, meeting the requirement for encrypted artifacts and least privilege. Option B is correct because storing database credentials in AWS Secrets Manager and retrieving them in CodeBuild using the secrets manager action avoids hardcoded credentials and provides secure, rotating credentials. Option E is correct because configuring CodePipeline to assume an IAM role in the target account using a trust policy enables cross-account deployment with least privilege, as the pipeline assumes a role with only necessary permissions. Option C is incorrect because while SSM Parameter Store can store credentials, Secrets Manager is specifically designed for secrets management with automatic rotation and is more appropriate for database credentials. Option D is incorrect because CodeCommit with pull request approval rules is a source control practice, not directly addressing the security requirements of no hardcoded credentials, least privilege cross-account access, or encrypted artifacts.

Answer

Store database credentials in AWS Systems Manager Parameter Store and retrieve them in CodeBuild.

Answer

Use AWS CodeCommit as the source repository with pull request approval rules.

Question 10

Drag and drop the steps to configure an AWS Elastic Load Balancer (ALB) with HTTPS listeners and target groups.

Accepted Answer

Create target group, Create ALB, Configure HTTPS listener, Register targets, Add redirect rule. First create the target group, then create the ALB, then configure HTTPS listener, then register targets, then add redirect rule.

Answer

Create ALB, Create target group, Configure HTTPS listener, Register targets, Add redirect rule

Answer

Create target group, Create ALB, Register targets, Configure HTTPS listener, Add redirect rule

Answer

Configure HTTPS listener, Create target group, Create ALB, Register targets, Add redirect rule

Question 11

A company uses AWS Elastic Beanstalk with a custom platform. They need to update the platform version to include a new security patch. Which approach should be used to create a new custom platform version?

Accepted Answer

Create a new platform version using the aws elasticbeanstalk create-platform-version command with an updated platform definition file.. AWS Elastic Beanstalk custom platforms are defined using a platform definition file (a YAML or JSON file that specifies the AMI, Chef recipes, and other configuration). To create a new platform version with an updated security patch, you must update this platform definition file (e.g., to reference a new base AMI with the patch) and then run the `aws elasticbeanstalk create-platform-version` CLI command. This command packages the definition file and uploads it to Elastic Beanstalk, which then builds and registers the new platform version. The other options either bypass the custom platform framework or are not supported operations.

Answer

Use the Elastic Beanstalk CLI to rebuild the platform with the new AMI.

Answer

Launch a new EC2 instance, apply the patch, and create an AMI, then update the platform version.

Answer

Modify the existing platform version's AMI ID using the Elastic Beanstalk console.

Question 12

An AWS account owner (Account A) owns an S3 bucket named my-bucket. The bucket policy shown in the exhibit is attached to the bucket. A user from Account B attempts to upload an object to the bucket without specifying the x-amz-acl header. What will happen?

Accepted Answer

The upload fails because the bucket policy requires the x-amz-acl header to be set to bucket-owner-full-control.. The condition requires the x-amz-acl header to be set to bucket-owner-full-control. If the header is not specified, the condition fails, and the request is denied. Option A is wrong because the condition is not met. Option B is wrong because the policy does not grant permission without the header. Option C is wrong because the bucket policy evaluates before the object ACL.

Answer

The upload fails because the bucket policy requires the object ACL to be set, but the default ACL allows the upload anyway.

Answer

The upload succeeds because the bucket policy does not explicitly deny the request.

Answer

The upload succeeds because the bucket policy allows s3:PutObject for any principal.

Question 13

A company is designing a disaster recovery (DR) strategy for a critical application that runs on EC2 instances with an RDS database. The DR site must be in a different AWS Region. The Recovery Point Objective (RPO) is 15 minutes, and Recovery Time Objective (RTO) is 1 hour. Which TWO actions should the company take to meet these objectives? (Choose TWO.)

Accepted Answer

Configure Amazon Route 53 with health checks and failover routing to the DR region.. Options C and D are correct. D: Creating an RDS cross-Region read replica in the DR region allows the replica to be promoted to the primary database with minimal data loss, meeting the 15-minute RPO. C: Configuring Amazon Route 53 with health checks and failover routing enables automatic traffic redirection to the DR region within the 1-hour RTO. Option A is wrong because copying AMIs and RDS snapshots every 15 minutes would require launching EC2 instances and restoring the database from snapshots, which can exceed the 1-hour RTO. Option B is wrong because manually pre-provisioning resources with CloudFormation does not provide the automated failover needed to meet the RTO. Option E is wrong because S3 cross-Region replication does not address the EC2 and RDS components of the application.

Answer

Use AWS Backup to copy EC2 AMIs and RDS snapshots to the DR region every 15 minutes.

Answer

Use AWS CloudFormation to pre-provision resources in the DR region manually.

Answer

Configure S3 cross-Region replication for application data stored in S3.

Question 14

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The team checks the logs and finds that the application installation script fails on some instances due to missing dependencies. What is the BEST long-term solution?

Accepted Answer

Create a custom AMI that includes all dependencies and use it in the Auto Scaling group.. Creating a custom AMI that includes all dependencies ensures that every instance launched in the Auto Scaling group has the required software pre-installed. This eliminates the root cause of the deployment failure—missing dependencies—by baking them into the machine image, making deployments consistent and reliable. It is the best long-term solution because it avoids runtime dependency installation failures and reduces deployment time.

Answer

Use an Elastic Load Balancer health check to automatically replace failed instances.

Answer

Modify the CodeDeploy AppSpec file to run the installation script as root.

Answer

Implement a retry mechanism in the deployment script to install dependencies again.

Question 15

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment strategy is Blue/Green. After a successful deployment, the team notices that the new instances are receiving traffic but the application returns errors. The old instances are still serving traffic correctly. The team wants to roll back immediately. What should be done?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails, then manually trigger a rollback.. To roll back a CodeDeploy Blue/Green deployment, you should initiate a rollback deployment with the previous application revision. This can be done via the AWS CLI (`aws deploy create-deployment` with the old revision) or via the CodeDeploy console. Configuring automatic rollback on deployment failure is a separate setting and is not a prerequisite for manual rollback. The explanation should be corrected to state that the rollback process creates a new replacement environment with the previous revision (or reuses the original if still available) and shifts traffic to it, not that automatic rollback must be configured first.

Answer

Stop the current deployment using the AWS CLI.

Answer

Manually update the Auto Scaling group to associate new instances with the old launch configuration.

Answer

Redeploy the same application revision to the same Auto Scaling group.