DOP-C02 Practice Test 20 — 15 Questions

Question 1

An IAM policy is attached to a role used by an operations team. The team reports that they are unable to start or stop EC2 instances tagged with Environment=Production. Other instances can be described. What is the MOST likely reason for this failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The condition key ec2:ResourceTag/Environment is not valid for ec2:StartInstances and ec2:StopInstances.. The `ec2:ResourceTag` condition key is not supported for the `ec2:StartInstances` and `ec2:StopInstances` actions in IAM policy evaluation. AWS documentation explicitly states that these actions do not support resource-level permissions based on tags; they only support the `ec2:ResourceTag` condition key for certain read-only or tagging actions. Therefore, the condition in the policy cannot be evaluated, causing the operations team to fail when attempting to start or stop Production-tagged instances.

Answer

The role does not have permission to describe instances, so the condition cannot be evaluated.

Answer

The policy's Resource element is set to '*' and must be restricted to specific instance ARNs.

Answer

The policy does not include the ec2:RebootInstances action.

Question 2

A company uses AWS CodePipeline with multiple stages. The pipeline includes a Beta stage that deploys to a test environment and a Prod stage. The team wants to require manual approval before the Prod stage. Which TWO actions should be taken to implement this? (Choose TWO.)

Accepted Answer

Ensure that the IAM user or role performing the approval has codepipeline:PutApprovalResult permissions.. The IAM user or role that performs the manual approval action in CodePipeline must have the `codepipeline:PutApprovalResult` permission. This permission allows the user to submit the approval or rejection result to the pipeline, which is required to advance the pipeline to the Prod stage. Without this permission, the approval action cannot be completed, and the pipeline will remain stuck.

Answer

Use CloudWatch Events to trigger a Lambda function that requires manual sign-off.

Answer

Set the Prod stage to only run on manual invocation.

Answer

Configure a CodeCommit approval rule template to require approval before merging.

Question 3

A company is designing a disaster recovery plan for a critical application with an RPO of 15 minutes and RTO of 1 hour. The application runs on EC2 instances with an RDS MySQL database. The primary Region is us-east-1. Which THREE actions should they take to meet the RPO and RTO? (Choose three.)

Accepted Answer

Schedule automated AMI backups of EC2 instances every 15 minutes. Automated AMI backups of EC2 instances every 15 minutes align with the 15-minute RPO by capturing incremental snapshots of the instance volumes. These AMIs can be used to launch replacement EC2 instances in the secondary Region within the 1-hour RTO, provided the infrastructure is pre-staged. The frequency of 15 minutes ensures that data loss is limited to at most 15 minutes of changes.

Answer

Launch EC2 instances in a single Availability Zone in the secondary Region to reduce costs

Answer

Use AWS CloudFormation StackSets to deploy identical infrastructure in the secondary Region

Question 4

A company runs a critical application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. The DevOps team needs to ensure that if an entire Availability Zone fails, the application continues to serve traffic without manual intervention. What should the team do?

Accepted Answer

Configure the ECS service to run tasks in at least two Availability Zones and enable the ECS service auto-recovery feature.. The ECS service's AZ rebalancing feature automatically redistributes tasks across Availability Zones when an imbalance is detected, such as after an AZ failure. By configuring the service to run tasks in at least two AZs and enabling this feature, the ECS service will automatically launch replacement tasks in the remaining healthy AZs to maintain the desired count, ensuring continued traffic serving without manual intervention.

Answer

Use an Amazon ECS service auto-scaling policy to automatically replace tasks in the failed AZ.

Answer

Configure the ALB to enable cross-zone load balancing and enable the ECS service's AZ rebalancing feature.

Answer

Set the ECS service's minimum healthy percent to 100 and maximum percent to 200.

Question 5

A DevOps engineer is setting up an alarm to notify the team when the average CPU utilization of an EC2 instance exceeds 80% for 5 consecutive minutes. Which CloudWatch alarm configuration should be used?

Accepted Answer

Metric: CPUUtilization, Statistic: Average, Period: 300 seconds, Threshold: 80, Evaluation Periods: 1. It configures a CloudWatch alarm with a 300-second (5-minute) period and 1 evaluation period, meaning the alarm triggers when the average CPU utilization exceeds 80% for a single 5-minute data point. This directly matches the requirement of 'exceeds 80% for 5 consecutive minutes' since the metric is evaluated over a 5-minute window.

Answer

Metric: CPUUtilization, Statistic: Average, Period: 300 seconds, Threshold: 80, Evaluation Periods: 1, Comparison: LessThanThreshold

Answer

Metric: CPUUtilization, Statistic: Average, Period: 60 seconds, Threshold: 80, Evaluation Periods: 5

Answer

Metric: CPUUtilization, Statistic: Sum, Period: 60 seconds, Threshold: 80, Evaluation Periods: 5

Question 6

Refer to the exhibit. A DevOps engineer applies the IAM policy shown to an S3 bucket to enforce server-side encryption. However, users report that some uploads succeed without encryption. What is the most likely reason?

Accepted Answer

The policy only allows the action but does not deny actions that do not meet the condition.. The IAM policy shown only allows the s3:PutObject action when the encryption condition is met, but it does not include a Deny statement to explicitly block uploads that do not satisfy the condition. In AWS IAM, an Allow statement alone does not prevent actions that fail the condition; it simply grants permission when the condition is true. Without a corresponding Deny, users with other permissions (e.g., from a broader policy) can still upload objects without encryption, as the Allow does not override other effective allows.

Answer

The resource ARN is incorrect; it should be the bucket ARN.

Answer

The action should be s3:PutEncryptedObject instead of s3:PutObject.

Answer

The policy uses StringEquals instead of StringNotEquals.

Question 7

A company is designing a disaster recovery plan for an application running on AWS. The plan must meet an RTO of 1 hour and an RPO of 15 minutes. Which TWO strategies can achieve these objectives? (Select TWO.)

Accepted Answer

Warm standby in a different AWS Region with database replication. (Warm standby) is correct because it maintains a scaled-down but fully functional copy of the production environment in a different AWS Region, with database replication (e.g., Amazon RDS cross-Region read replicas or Aurora Global Database) ensuring an RPO of 15 minutes or less. The standby infrastructure can be scaled up within the 1-hour RTO, as it is already running and configured.

Answer

Backup and restore using daily snapshots to a different Region

Answer

Cold standby in a different Region with infrastructure deployed on demand

Answer

Multi-AZ deployment in the same Region

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer. They use Amazon CloudFront for content delivery. The DevOps team notices that some requests are returning HTTP 503 errors intermittently. After checking the CloudFront and ALB logs, they find that the errors originate from the ALB. What is the most likely cause?

Accepted Answer

The ALB is experiencing a surge in traffic and is scaling up, but during the scaling activity, some requests are rejected.. When an Application Load Balancer (ALB) experiences a sudden surge in traffic that exceeds its current capacity, it may temporarily reject requests with HTTP 503 errors while it scales up. During the scaling activity, the ALB's target group might not have enough healthy registered targets to handle the load, causing the ALB to return 503 responses until new instances are provisioned and pass health checks. This matches the intermittent nature of the errors described in the scenario.

Answer

The SSL certificate on the ALB is expired.

Answer

The security group for the ALB is blocking traffic from CloudFront.

Answer

CloudFront is configured to forward an HTTP method that the ALB does not support.

Question 9

A DevOps engineer wants to ensure that all EC2 instances launched in an AWS account automatically have a specific set of tags applied for cost allocation. Which AWS service should they use to enforce this?

Accepted Answer

AWS Config. AWS Config is correct because it can enforce tagging rules through managed rules like `required-tags` or custom AWS Config rules using AWS Lambda. When an EC2 instance is launched without the required tags, AWS Config can evaluate the resource against the rule and trigger remediation actions (e.g., via AWS Systems Manager Automation) to automatically apply the tags or flag non-compliance. This ensures consistent cost allocation tagging across all instances without manual intervention.

Answer

AWS Service Catalog

Answer

Amazon EC2 Auto Scaling

Answer

AWS CloudFormation

Question 10

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the new instances fail the health check and are terminated. The deployment fails. The team wants to automatically roll back to the previous working version. What should they do?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails.. AWS CodeDeploy provides a built-in rollback configuration that can be triggered automatically when a deployment fails. By enabling automatic rollback in the deployment group settings, CodeDeploy will redeploy the last successful revision when the current deployment fails health checks, without requiring manual intervention or additional infrastructure.

Answer

Set up an Auto Scaling lifecycle hook to terminate instances and trigger a rollback.

Answer

Manually redeploy the last successful deployment revision after investigating the failure.

Answer

Configure the deployment group to automatically redeploy the same revision on failure.

Question 11

A developer wants to grant an EC2 instance read-only access to a specific S3 bucket. Which AWS mechanism should they use to securely provide credentials to the instance?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.. IAM roles with instance profiles provide temporary, automatically rotated credentials to EC2 instances via the AWS STS service. This eliminates the need to hardcode or store long-term access keys on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the AMI.

Answer

Store AWS access keys in the EC2 user data script.

Answer

Retrieve the credentials from AWS Systems Manager Parameter Store using a custom script.

Question 12

A team wants to automate the deployment of a serverless application using AWS SAM. They have a template.yaml file defining Lambda functions, an API Gateway, and a DynamoDB table. Which command should they use to build and deploy the application?

Accepted Answer

sam build && sam deploy. The correct command sequence is `sam build && sam deploy` because AWS SAM requires the `sam build` command to transform the SAM template into an AWS CloudFormation template with the necessary artifact packaging, and then `sam deploy` to create or update the stack. Option C is the only choice that performs both the build (which resolves local dependencies and prepares deployment artifacts) and the deployment step, which is essential for a serverless application defined in a SAM template.

Answer

aws cloudformation deploy --template-file template.yaml

Answer

sam package --output-template-file packaged.yaml

Answer

sam deploy --guided

Question 13

A company is using AWS CloudFormation to deploy infrastructure. An engineer needs to ensure that any changes to the production stack are reviewed and approved before they are applied. The engineer also wants to prevent unauthorized changes. Which solution should the engineer implement?

Accepted Answer

Use CloudFormation Change Sets and require manual approval to execute the change set.. CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact running resources before you apply them. By requiring manual approval to execute the change set, the engineer ensures that all modifications are reviewed and approved, preventing unauthorized changes. This directly meets the requirement for a review-and-approval workflow without introducing unnecessary complexity.

Answer

Use CloudFormation StackSets to manage the production stack across multiple accounts.

Answer

Use AWS Service Catalog to create a product for the stack and require approval for any portfolio changes.

Answer

Use AWS CodePipeline to deploy the stack and require manual approval at the deploy stage.

Question 14

A DevOps team uses AWS CodePipeline to deploy a microservices application. The pipeline includes a CodeBuild project that runs unit tests. Recently, builds have been failing intermittently due to test timeouts. The team wants to improve the reliability of the pipeline without increasing the build timeout. Which action should the team take?

Accepted Answer

Configure the CodeBuild project to run tests in parallel by using separate build environments or test splits.. Running unit tests in parallel using separate build environments or test splits directly addresses intermittent timeouts by reducing the total execution time without increasing the build timeout. This approach leverages CodeBuild's ability to run multiple build jobs concurrently, distributing the test load and improving pipeline reliability.

Answer

Increase the build timeout to the maximum allowed value of 8 hours.

Answer

Use AWS CodeDeploy to run the unit tests on EC2 instances with more CPU and memory.

Answer

Modify the unit tests to be non-flaky by adding retries for network calls.

Question 15

A DevOps team is implementing a comprehensive logging strategy for a microservices architecture running on Amazon EKS. They need to collect logs from all containers and send them to a centralized log analytics platform. The solution must be agentless and support multi-line log events. Which approach should the team use?

Accepted Answer

Deploy a Fluent Bit DaemonSet on the EKS cluster and configure it to send logs to Amazon CloudWatch Logs.. Fluent Bit is a lightweight, CNCF-graduated log processor that can be deployed as a DaemonSet on EKS to collect logs from all nodes without requiring sidecar containers. It supports multi-line log events natively via its multiline filter plugin, and it can output directly to Amazon CloudWatch Logs using the cloudwatch_logs output plugin, meeting the agentless requirement since it runs as a Kubernetes DaemonSet rather than as a per-pod sidecar.

Answer

Use the Amazon CloudWatch agent as a sidecar container in each pod to forward logs to CloudWatch Logs.

Answer

Install the Amazon Kinesis Agent on each EC2 instance and configure it to stream logs to Amazon Kinesis Data Firehose.

Answer

Deploy a Fluentd DaemonSet on the EKS cluster and configure it to send logs to Amazon S3.