DOP-C02 Practice Exam 1 — 20 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. They want to receive notifications when a stack operation fails, including the specific resource that caused the failure. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack and subscribe to receive stack events.. CloudFormation allows you to specify an SNS topic ARN as a notification option when creating or updating a stack. When a stack operation fails, CloudFormation publishes a notification to that SNS topic, and the notification includes the logical resource ID and the status reason for the failure. This provides real-time, event-driven notifications without requiring polling or additional services.

Answer

Create a CloudWatch alarm on the 'StackFailure' metric.

Answer

Create an AWS Lambda function that polls the CloudFormation DescribeStackEvents API every minute and sends an email on failure.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and configure an SNS notification on the trail.

Question 2

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

Accepted Answer

The Deny statement's Resource specifies only the objects, not the bucket itself. The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.

Answer

The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'

Answer

The bucket is not versioned, so the policy does not apply to object versions

Answer

The policy uses Deny, but an Allow policy from another statement overrides it

Question 3

A DevOps engineer is troubleshooting a performance issue with an Amazon RDS for MySQL database. The engineer suspects that slow queries are causing high CPU utilization. Which TWO actions can the engineer take to identify the slow queries?

Accepted Answer

Enable the slow query log and publish it to CloudWatch Logs.. Enable the slow query log and publish it to CloudWatch Logs (Option C) allows you to capture and analyze slow SQL queries. Performance Insights (Option D) provides a dashboard to visualize database load and identify the top SQL statements causing performance issues. Option A is incorrect because event subscriptions for low storage notify about storage events, not slow queries. Option B is incorrect because monitoring CPUUtilization only indicates high CPU usage but does not identify specific slow queries. Option E is incorrect because Enhanced Monitoring provides OS-level metrics like CPU and memory, not the actual SQL queries.

Answer

Create an RDS event subscription for 'low storage' events.

Answer

Monitor the 'CPUUtilization' metric in CloudWatch.

Answer

Enable Enhanced Monitoring to view process list and SQL queries.

Question 4

A team uses AWS CodePipeline with a multi-branch strategy. They want to run different build projects based on the branch name: 'main' triggers a production build, 'develop' triggers a staging build, and feature branches trigger a test build. Which CodePipeline feature should they use?

Accepted Answer

Configure the source action with a branch filter using a regular expression.. CodePipeline's source action supports branch filtering via regular expressions, allowing you to define which branch triggers which pipeline execution. By configuring a single pipeline with a branch filter regex (e.g., '^main$', '^develop$', '^feature/.*$'), you can route commits from different branches to different build projects without creating multiple pipelines or using external logic.

Answer

Use AWS Lambda to dynamically change the pipeline definition.

Answer

Create separate pipelines for each branch and use tags.

Answer

Use a manual approval action to select the branch.

Question 5

A company wants to set up centralized logging for its multi-account AWS environment. The logs include CloudTrail, VPC Flow Logs, and Amazon Route 53 resolver query logs. Which TWO services should they use to achieve this with minimal operational overhead? (Select TWO.)

Accepted Answer

Amazon CloudWatch Logs. (CloudWatch Logs) and Option B (S3) are correct. CloudWatch Logs can aggregate logs from multiple AWS accounts using subscription filters or cross-account log grouping. S3 can serve as a central archive for all log types, including CloudTrail, VPC Flow Logs, and Route 53 resolver query logs, with minimal operational overhead. Option C (Kinesis Data Streams) is unnecessary because it adds complexity as an intermediate stream for this use case. Option D (OpenSearch Service) would require additional setup and management for indexing and visualization, increasing overhead. Option E (CloudTrail) only captures API activity and cannot centralize VPC Flow Logs or Route 53 resolver query logs.

Answer

Amazon Kinesis Data Streams

Answer

Amazon OpenSearch Service

Answer

AWS CloudTrail

Question 6

A company's production environment consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances run a web application that stores session data in an ElastiCache Redis cluster. The company has enabled detailed CloudWatch metrics and set up a dashboard. The operations team notices that the average CPU utilization across the Auto Scaling group spikes to 95% every 15 minutes, coinciding with a high number of Redis connections. What is the MOST likely cause?

Accepted Answer

The ALB has session stickiness enabled, causing traffic to be routed to the same instances.. ALB session stickiness (sticky sessions) causes the load balancer to route requests from the same client to the same EC2 instance. When a large number of clients connect simultaneously (e.g., due to a periodic batch job), they may all be routed to the same few instances, causing CPU spikes on those instances. The high number of Redis connections corresponds to the sessions being stored in Redis. This explains the 15-minute periodic spikes. Option A is incorrect because Memcached is not used; the question states ElastiCache Redis. Option B is incorrect because the scaling policy is based on CPU utilization, not memory. Option D is incorrect because the cluster size doesn't cause periodic spikes; it would cause consistent high utilization.

Answer

The application is using Memcached instead of Redis, causing increased load.

Answer

The Auto Scaling group's scaling policy is based on memory utilization instead of CPU.

Answer

The ElastiCache cluster is not large enough to handle the number of requests.

Question 7

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using customer-managed KMS keys. Additionally, any attempt to upload an unencrypted object must be denied. Which S3 bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: aws:kms. The condition 's3:x-amz-server-side-encryption':'aws:kms' in a Deny statement ensures that only requests with SSE-KMS encryption are allowed, blocking unencrypted uploads or uploads with other encryption types. Option A is wrong because 'true' is not a valid encryption type; the correct value is 'aws:kms'. Option B is wrong because it allows SSE-S3 (AES256), not KMS encryption. Option C is wrong because it checks a KMS encryption context rather than the encryption header, and it does not deny unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: true

Answer

Allow s3:PutObject with condition s3:x-amz-server-side-encryption: AES256

Answer

Allow s3:PutObject with condition kms:EncryptionContext: department:finance

Question 8

A company uses AWS CodePipeline with a GitHub source action. The pipeline triggers on changes to the master branch. However, the pipeline does not trigger when changes are pushed to the master branch. What is the MOST likely cause?

Accepted Answer

The webhook in GitHub is not properly configured or has been removed.. The most likely cause is that the webhook in GitHub is not properly configured or has been removed. CodePipeline relies on a webhook to automatically detect changes in the GitHub repository. If the webhook is missing or misconfigured, the pipeline will not trigger on pushes. Option A is incorrect because the pipeline uses the master branch as specified. Option B is incorrect because AWS regions are independent of GitHub; the webhook is not region-specific. Option D is incorrect because pipeline permissions are not required for the webhook to function; the webhook itself is the key mechanism for triggering.

Answer

The pipeline uses a different branch name.

Answer

The GitHub repository is not in the same AWS region as the pipeline.

Answer

The pipeline does not have permission to access the GitHub repository.

Question 9

A company wants to centrally manage and audit access to AWS KMS keys across multiple accounts. Which AWS feature should be used?

Accepted Answer

AWS CloudTrail with organization trail. AWS CloudTrail with an organization trail can log all API calls, including KMS key usage, across multiple accounts in an AWS Organization. This provides centralized audit logging for KMS key access. Option A (AWS Config aggregated rules) can evaluate resource compliance but does not audit key usage. Option B (Cross-account IAM roles) allows access but not centralized auditing. Option D (AWS Organizations tag policies) manage tags, not auditing. Therefore, option C is correct.

Answer

AWS Config aggregated rules

Answer

Cross-account IAM roles

Answer

AWS Organizations tag policies

Question 10

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 11

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

Accepted Answer

Define environment variables in the source code using .ebextensions configuration files.. Ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Answer

Update the environment variables manually in the Elastic Beanstalk console after each deployment.

Answer

Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.

Answer

Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Question 12

A DevOps engineer needs to collect and analyze logs from multiple AWS services, including EC2, Lambda, and API Gateway. The logs must be stored in a central location for long-term retention and analyzed using SQL queries. Which TWO services should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Correct options: B and E. Option B: CloudWatch Logs can collect logs from many AWS services. Option E: Exporting logs to S3 and using Athena allows SQL-based analysis. Option A is wrong because CloudTrail is for API logs, not all service logs. Option C is wrong because Kinesis Data Firehose is for real-time streaming, not for ad-hoc SQL queries. Option D is wrong because SQS is a message queue, not a log store.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Question 13

Which THREE steps are required to set up cross-account access for AWS CodePipeline using a customer-managed KMS key?

Accepted Answer

Grant the pipeline's IAM role permission to use the KMS key via IAM policy.. The pipeline's IAM role must have an IAM policy granting it permission to use the customer-managed KMS key for encrypt and decrypt operations. This is necessary because CodePipeline uses the KMS key to encrypt artifacts stored in the artifact bucket, and the pipeline role needs explicit kms:Encrypt and kms:Decrypt permissions to interact with the key.

Answer

Give the target account's IAM role permission to encrypt with the KMS key.

Answer

Create a KMS key in the target account.

Question 14

A company runs a stateful web application on EC2 instances behind an ALB. The application stores session data in memory. The company wants to make the application stateless to improve resilience. Which TWO changes should the company make?

Accepted Answer

Disable sticky sessions on the ALB. To make the application stateless, the company should disable sticky sessions on the ALB (option B) and store session data in Amazon ElastiCache for Redis (option D). Disabling sticky sessions ensures that requests can be routed to any instance, and storing session data externally removes the dependency on in-memory state on individual instances, improving resilience. Option A is incorrect because increasing instance memory does not solve the statefulness issue. Option C is incorrect because enabling sticky sessions would maintain state on instances. Option E is incorrect because using an NLB does not address session state management.

Answer

Increase the instance memory to store more sessions

Answer

Enable sticky sessions (session affinity) on the ALB

Answer

Use an NLB instead of an ALB

Question 15

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Which TWO steps must be taken to achieve this?

Accepted Answer

Add a statement to the KMS key policy that allows CloudWatch Logs to use the key.. To encrypt CloudWatch Logs at rest with a customer-managed KMS key, you must add a statement to the KMS key policy granting CloudWatch Logs permission to use the key (option B). Then, use the put-log-group-encryption API to associate the KMS key with the log group (option E). Option C is incorrect because CloudWatch Logs uses key policies, not grants. Option D is incorrect because you specify the key ARN at the log group level, not per log stream. Option A is incorrect because you do not need to recreate the log group; you can associate the key with an existing log group.

Answer

Recreate the log group after associating the key.

Answer

Create a KMS grant to allow CloudWatch Logs to use the key.

Answer

Specify the KMS key ARN when creating each log stream.

Question 16

A company runs a critical microservices architecture on Amazon ECS with Fargate. They want to ensure that if a task fails, it is automatically restarted, and the service remains available across multiple Availability Zones. How should they configure the ECS service?

Accepted Answer

Define an ECS service with a task definition, set desired count across multiple Availability Zones, and use Service Auto Scaling. An ECS service configured with a task definition, desired count across multiple Availability Zones, and Service Auto Scaling ensures resilience. The ECS service scheduler automatically restarts failed tasks, and distributing tasks across AZs provides high availability. Option A is wrong because placing all tasks in a single AZ creates a single point of failure. Option B is wrong because a standalone Fargate task does not have automatic restart; a CloudWatch alarm can restart it but lacks the built-in resilience of an ECS service. Option C is wrong because using a single EC2 instance is a single point of failure and does not provide multi-AZ resilience.

Answer

Place all tasks in the same Availability Zone to reduce latency

Answer

Run a standalone Fargate task and use a CloudWatch alarm to restart it

Answer

Use an EC2 launch type with a single instance to reduce complexity

Question 17

A company wants to monitor the number of messages that are published to an Amazon SNS topic. Which CloudWatch metric should be used?

Accepted Answer

NumberOfMessagesPublished. The CloudWatch metric 'NumberOfMessagesPublished' tracks the number of messages published to an SNS topic. Option A (SMSMonthToDateSpentUSD) tracks monthly SMS spend, not messages published. Option B (PublishSize) is not a standard SNS metric; the relevant metric is 'PublishSize' for message size, but it's not for counting messages. Option C (NumberOfNotificationsDelivered) counts messages delivered to subscribers, not published.

Answer

SMSMonthToDateSpentUSD

Answer

PublishSize

Answer

NumberOfNotificationsDelivered

Question 18

A company wants to ensure that all changes to its Amazon S3 bucket policies are logged for auditing purposes. Which TWO AWS services should be enabled to capture these changes?

Accepted Answer

AWS Config. Options B and E are correct because AWS Config records resource configuration changes, including S3 bucket policies, and AWS CloudTrail logs API calls such as PutBucketPolicy. Option A is incorrect because Amazon CloudWatch monitors operational metrics and logs, not auditing of policy changes. Option C is incorrect because Amazon GuardDuty provides threat detection, not audit logging. Option D is incorrect because VPC Flow Logs capture network traffic, not configuration changes.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Question 19

A DevOps engineer runs the command above to retrieve CPU utilization for an EC2 instance, but gets no data points. The instance is running and has basic monitoring enabled. What is the most likely reason?

Accepted Answer

The IAM user executing the command lacks 'cloudwatch:GetMetricStatistics' permission.. The command likely fails because the IAM user executing it does not have the 'cloudwatch:GetMetricStatistics' permission. Basic monitoring publishes CPUUtilization metrics every 5 minutes (300 seconds), so a period of 300 seconds is valid. The dimension name 'InstanceId' is correct as shown. Option A is wrong because the dimension name is case-sensitive and 'InstanceId' is correct. Option B is wrong because basic monitoring is enabled by default and publishes CPUUtilization. Option C is wrong because 300 seconds equals the default 5-minute interval, which is the minimum supported period for basic monitoring.

Answer

The dimension name should be 'InstanceId' with a different case.

Answer

The instance has basic monitoring disabled.

Answer

The period of 300 seconds is less than the minimum supported period.

Question 20

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Fargate tasks require network connectivity to pull container images from ECR (or Docker Hub) and to send logs to CloudWatch. Without a route to a NAT Gateway (for private subnets) or an Internet Gateway (for public subnets), the task cannot pull the image and fails to start. Option B is incorrect: while the image must exist, the immediate symptom of tasks failing to start when the image is missing would be an 'image not found' error, not a generic failure; the security group already allows inbound traffic on port 8080, but outbound connectivity is the issue. Option C is incorrect: insufficient CPU/memory would cause tasks to enter a 'CPU exhausted' or 'memory exhausted' state, not prevent them from starting entirely. Option D is incorrect: the security group allows inbound traffic, but the issue is about egress connectivity for the task to reach the image registry.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.