DOP-C02 Practice Exam 2 — 20 Questions

Question 1

The exhibit shows a CloudFormation stack event. The stack creation failed with 'Resource creation cancelled'. What is the most likely reason for this cancellation?

Accepted Answer

The stack was manually cancelled by a user or an automation script.. The 'Resource creation cancelled' event in a CloudFormation stack creation indicates that the operation was explicitly halted by a user or an automation script (e.g., via the AWS CLI, Console, or SDK). This is distinct from a timeout or permission error, which would produce different error messages such as 'Resource creation timed out' or 'API: cloudformation:CreateStack Access Denied'.

Answer

The stack template contains a syntax error.

Answer

The IAM role used for stack operations lacks permissions.

Answer

A stack creation timeout was reached.

Question 2

A company runs a critical batch processing workload on Amazon EMR that must complete within a 2-hour window each night. The workload is fault-tolerant but must be resilient to instance failures. Currently, the EMR cluster uses instance fleets with Spot Instances. Recently, Spot Instance interruptions caused the cluster to take over 3 hours to complete. Which change will MOST effectively ensure the workload completes within the 2-hour window despite Spot interruptions?

Accepted Answer

Use a mixed instances policy that includes multiple instance types across different Availability Zones.. A mixed instances policy across multiple Availability Zones increases the diversity of Spot capacity pools. When one instance type or zone experiences interruptions, the cluster can fall back to other pools, reducing the likelihood of prolonged delays. This approach directly addresses Spot interruption risk without sacrificing cost efficiency, as On-Demand instances would.

Answer

Increase the number of core nodes to 20 to improve parallelism.

Answer

Switch to using On-Demand instances for all nodes.

Answer

Configure the cluster to terminate idle nodes after 5 minutes to reduce costs.

Question 3

Match each AWS Config rule to its purpose.

Accepted Answer

s3-bucket-public-read-prohibited: Checks if S3 buckets allow public read access. The correct matches are: s3-bucket-public-read-prohibited with S3 public read check, restricted-ssh with SSH access check, iam-user-no-policies-check with no attached policies, and cloud-trail-cloud-watch-logs-enabled with CloudWatch integration. Common confusions include swapping definitions between different rule types.

Answer

s3-bucket-public-read-prohibited: Checks security groups for unrestricted SSH access

Answer

encrypted-volumes: Checks that no IAM users have inline policies

Question 4

A DevOps engineer is troubleshooting an Auto Scaling group (ASG) that is not launching instances as expected. The ASG is configured with a launch template that uses an Amazon Linux 2 AMI. The engineer checks the EC2 Auto Scaling console and sees that the group's desired capacity is set to 2, but only 1 instance is running. The last scaling activity shows 'Failed to launch instance. Error: Your quota allows for 0 more running instance(s).' What is the most likely cause?

Accepted Answer

The account has reached the EC2 instance limit for the selected instance type in the region.. The error message 'Your quota allows for 0 more running instance(s)' directly indicates that the AWS account has reached its EC2 instance limit for the specific instance type in the region. Auto Scaling groups cannot launch instances beyond the service quota, regardless of the desired capacity. This is a common issue when the default limit (e.g., 5 or 20 instances per instance family) has been exhausted.

Answer

The launch template has insufficient IAM permissions to create instances.

Answer

The VPC subnet does not have enough available IP addresses.

Answer

There is an instance that is not passing health checks, preventing new instances.

Question 5

A company has a Lambda function that processes sensitive data and needs to access an RDS database. The security team requires that the database credentials are automatically rotated every 30 days. Which service should be used to store and rotate the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like RDS. It supports native, built-in rotation for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) without requiring custom Lambda functions. The automatic rotation can be scheduled at a desired interval (e.g., every 30 days) using a rotation schedule defined in the secret's configuration, and it integrates directly with RDS to update the credentials on both the secret and the database.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS IAM roles

Question 6

Which THREE actions should a DevOps engineer take to ensure that AWS CloudFormation stacks are securely managed? (Choose three.)

Accepted Answer

Use a service role with least privilege when creating the stack.. Using a service role with least privilege ensures that CloudFormation operates with only the permissions necessary to create, update, and delete resources, rather than inheriting the user's broader permissions. This decouples the user's IAM permissions from the stack's runtime actions, reducing the risk of privilege escalation and unintended resource modifications.

Answer

Set a DeletionPolicy on the stack to retain resources when the stack is deleted.

Answer

Define a StackSetPolicy to control permissions across accounts.

Question 7

A company is implementing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application using the AWS Serverless Application Model (SAM). The pipeline must build and package the application, then deploy it to multiple environments (dev, test, prod) sequentially with manual approval gates before production. Which stage configuration should be used?

Accepted Answer

Use a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, then separate deploy stages for each environment with manual approval actions. It uses a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, which is the recommended approach for SAM-based deployments. The pipeline then separates deploy stages for each environment (dev, test, prod) with manual approval actions before production, satisfying the sequential deployment and manual gate requirements.

Answer

Use a single CloudFormation stack with a change set approval step

Answer

Configure CodePipeline with a deploy action provider set to AWS CloudFormation

Answer

Use CodeDeploy to deploy the SAM template directly to Lambda

Question 8

Which TWO metrics should be monitored in Amazon CloudWatch to detect a potential memory leak in an EC2 instance? (Choose two.)

Accepted Answer

MemoryUtilization (custom metric published via CloudWatch Agent).. MemoryUtilization is a custom metric that must be published via the CloudWatch Agent because EC2 does not expose memory metrics by default. Monitoring this metric over time can reveal a steady upward trend in memory usage that does not drop after processes complete, which is a classic symptom of a memory leak.

Answer

DiskReadOps

Answer

NetworkIn

Answer

CPUUtilization

Question 9

A company uses AWS CodeBuild to run unit tests and package a Java application. The build environment needs to have a specific version of Java installed that is not available in the standard build images. The team wants to minimize build time. How should the engineer configure the build environment?

Accepted Answer

Use a custom build image that already includes the required Java version, stored in Amazon ECR.. Using a custom build image stored in Amazon ECR allows the team to pre-install the exact Java version required, eliminating the need for runtime installation. This minimizes build time by avoiding the overhead of downloading and installing software during every build, while still providing a consistent, reproducible environment.

Answer

Use AWS Lambda to run the tests and package the application.

Answer

Use a standard build image and include a pre-build command to install the required Java version.

Answer

Use the pre-build phase to download and install Java from an S3 bucket.

Question 10

A developer wants to automate the creation of a new Amazon ECS service whenever a new Docker image is pushed to Amazon ECR. Which AWS service should be used to orchestrate this workflow?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture ECR image push events (via the 'ECR Image Action' event type) and route them to a target such as an ECS service or a Lambda function that triggers an ECS service update or creation. This serverless event bus natively integrates with ECR and ECS, making it the simplest and most direct service to orchestrate the workflow without custom polling or additional orchestration logic.

Answer

AWS Step Functions

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Question 11

A development team wants to ensure that their application can continue serving traffic even if an entire AWS Availability Zone (AZ) becomes unavailable. The application runs on Amazon EC2 instances in an Auto Scaling group and uses an Application Load Balancer (ALB). Which configuration should the team implement to meet this requirement?

Accepted Answer

Configure the Auto Scaling group to launch EC2 instances across multiple AZs, and ensure the ALB is enabled for cross-zone load balancing.. Deploying EC2 instances across multiple Availability Zones (AZs) ensures that if one AZ fails, the remaining AZs continue to serve traffic. Enabling cross-zone load balancing on the ALB distributes incoming requests evenly across all healthy instances in all AZs, preventing traffic from being sent only to instances in the same AZ as the client. This architecture meets the requirement for high availability and fault tolerance at the AZ level.

Answer

Use a launch template with multiple instance types to ensure diversity across the fleet.

Answer

Use a single AZ but configure EC2 Auto Scaling to replace unhealthy instances automatically.

Answer

Launch all EC2 instances in the same AZ to minimize latency, and configure the Auto Scaling group to maintain a minimum of two instances.

Question 12

A company is designing a multi-region active-active architecture for a stateless web application. The application uses a DynamoDB table as its data store. The company wants to minimize write latency and ensure that writes are accepted in any region with eventual consistency. Which DynamoDB feature should they use?

Accepted Answer

DynamoDB global tables.. DynamoDB global tables provide a fully managed, multi-region, multi-active solution that automatically replicates data across AWS Regions. This enables low-latency writes in any region with eventual consistency, meeting the requirement for an active-active architecture without custom code or additional infrastructure.

Answer

DynamoDB read replicas in each region.

Answer

Cross-region replication using AWS Lambda function.

Answer

DynamoDB Accelerator (DAX) with multi-region endpoints.

Question 13

A company runs a fleet of EC2 instances behind an Auto Scaling group. The DevOps team wants to detect and respond to memory leaks in their application. They have configured CloudWatch agent to collect memory metrics. However, the metric shows unpredictable spikes. The team needs to correlate these spikes with application logs to identify the root cause. Which solution provides the BEST correlation?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns around the time of memory spikes. CloudWatch Logs Insights allows you to query application logs directly in CloudWatch Logs using a purpose-built query language. By filtering logs around the timestamps of memory spikes, you can correlate specific error patterns or log entries with the metric data, enabling root cause analysis without moving data or adding complexity.

Answer

Export the memory metric and application logs to Amazon S3 and use Amazon Athena to join them

Answer

Enable AWS X-Ray on the application to trace requests and identify memory-heavy requests

Answer

Use Amazon EventBridge to capture EC2 instance state changes and correlate with memory spikes

Question 14

A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?

Accepted Answer

The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).. CodeBuild's security group outbound rules must explicitly allow traffic to the RDS security group on the database port (e.g., 3306 for MySQL). Even though CodeBuild runs in a VPC, if the outbound rules are too restrictive, the build agent cannot establish a TCP connection to the RDS instance, causing a timeout. The security group acts as a virtual firewall for the CodeBuild ENI, and without a matching outbound rule, packets are dropped.

Answer

CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.

Answer

The CodeBuild service role does not have rds:Connect permission.

Answer

The RDS instance is in a different subnet CIDR than CodeBuild's subnet.

Question 15

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an EC2 instance with a UserData script that installs software. The stack creation fails with the error: 'The following resource(s) failed: EC2Instance (AWS::EC2::Instance) – Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack creation timed out or was manually cancelled. The error message 'Resource creation cancelled' indicates that the CloudFormation stack creation was either timed out or manually cancelled, not that the EC2 instance itself failed. CloudFormation has a default timeout of 60 minutes for stack creation, and if the UserData script takes longer than this or the user manually cancels the operation, CloudFormation will mark the resource as cancelled. This is distinct from a resource-specific failure like an invalid instance type or IAM permissions issue, which would produce a different error message such as 'Resource failed to stabilize' or 'API error'.

Answer

The EC2 instance type is not supported in the region

Answer

The IAM role attached to the instance lacks permissions

Answer

The UserData script failed due to a syntax error

Question 16

A company requires that all access to their S3 buckets be encrypted in transit. Which configuration achieves this?

Accepted Answer

Use a bucket policy that denies requests when aws:SecureTransport is false.. Using a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` explicitly enforces encryption in transit for all access to the S3 bucket. This policy ensures that any HTTP (non-TLS) request is denied, while HTTPS requests are allowed, meeting the requirement that all access be encrypted in transit.

Answer

Use CloudFront with the bucket as origin and enforce HTTPS only between viewer and CloudFront.

Answer

Enable default encryption on the bucket.

Answer

Set the bucket policy to require SSE-KMS.

Question 17

A company is designing a highly available architecture for a web application that uses Amazon EC2 instances. The application must be resilient to the failure of a single instance and a single Availability Zone. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Use an Auto Scaling group with a minimum of two instances spread across two Availability Zones.. An Auto Scaling group with a minimum of two instances spread across two Availability Zones ensures that if one instance or one entire AZ fails, the remaining instance(s) in the other AZ can continue serving traffic, and Auto Scaling will automatically launch a replacement instance in the healthy AZ to restore the desired count. Option B is correct because distributing EC2 instances across at least two Availability Zones is the fundamental requirement for AZ-level resilience, as it eliminates a single point of failure at the AZ boundary.

Answer

Place all EC2 instances in a single Availability Zone and use a Network Load Balancer.

Answer

Use a single Application Load Balancer in one Availability Zone.

Answer

Use a single large EC2 instance in one Availability Zone.

Question 18

A company uses AWS CodeBuild to compile and test code. The build process requires a specific version of a library that is not available in the default build environment. Which approach should be used to include this library in the build process?

Accepted Answer

Create a custom Docker image that includes the library and use it as the build environment in CodeBuild.. Creating a custom Docker image that includes the required library ensures the build environment is consistent, reproducible, and avoids repeated download/compile overhead. AWS CodeBuild supports custom Docker images via the `image` field in the buildspec file or the console, allowing you to specify a repository in Amazon ECR or Docker Hub. This approach aligns with infrastructure-as-code best practices by baking dependencies into the environment rather than managing them at build time.

Answer

Modify the buildspec file to include the library as a build artifact.

Answer

Store the compiled library in an Amazon S3 bucket and download it during the build process using the buildspec file.

Answer

Add an install command in the buildspec file to download and compile the library during each build.

Question 19

A company's application running on EC2 instances behind an Application Load Balancer (ALB) is returning intermittent 504 errors. The instances are in an Auto Scaling group with a health check grace period of 300 seconds. What should the DevOps engineer check first to troubleshoot the issue?

Accepted Answer

Check ALB access logs for target response times.. A 504 error indicates the load balancer did not receive a response from the target within the idle timeout period. Checking ALB access logs for target response times is the first step to determine if the backend is slow or unresponsive. Option A is wrong because scaling policies affect the number of instances, not response times. Option B is wrong because health checks verify instance availability, but intermittent slow responses may not cause health check failures. Option C is wrong because security group rules would cause different errors (e.g., connection timeouts) rather than 504s.

Answer

Review the Auto Scaling group scaling policies.

Answer

Verify the target group health checks are passing.

Answer

Check security group rules for the ALB.

Question 20

A company uses AWS CodeBuild to compile and test code. The build takes 30 minutes, but the team wants to reduce build time by caching dependencies. Which approach should be used?

Accepted Answer

Enable local caching in the build project configuration.. AWS CodeBuild's local caching feature allows you to cache intermediate build artifacts (such as dependencies) in a local directory on the build instance, which persists across builds for the same build project. This eliminates the need to re-download dependencies from external sources for every build, significantly reducing build time. The cache is stored in a Docker volume or S3 bucket, but the key benefit is that it is automatically managed by CodeBuild without manual download steps.

Answer

Remove unnecessary dependencies from the build specification.

Answer

Store dependencies in an S3 bucket and download them before each build.

Answer

Use AWS CodeArtifact to store dependencies and pull them during build.