DOP-C02 Practice Exam 2 — 20 Questions

Question 1

A company wants to monitor the number of messages that are published to an Amazon SNS topic. Which CloudWatch metric should be used?

Accepted Answer

NumberOfMessagesPublished. The CloudWatch metric 'NumberOfMessagesPublished' tracks the number of messages published to an SNS topic. Option A (SMSMonthToDateSpentUSD) tracks monthly SMS spend, not messages published. Option B (PublishSize) is not a standard SNS metric; the relevant metric is 'PublishSize' for message size, but it's not for counting messages. Option C (NumberOfNotificationsDelivered) counts messages delivered to subscribers, not published.

Answer

SMSMonthToDateSpentUSD

Answer

PublishSize

Answer

NumberOfNotificationsDelivered

Question 2

A company wants to ensure that all changes to its Amazon S3 bucket policies are logged for auditing purposes. Which TWO AWS services should be enabled to capture these changes?

Accepted Answer

AWS Config. Options B and E are correct because AWS Config records resource configuration changes, including S3 bucket policies, and AWS CloudTrail logs API calls such as PutBucketPolicy. Option A is incorrect because Amazon CloudWatch monitors operational metrics and logs, not auditing of policy changes. Option C is incorrect because Amazon GuardDuty provides threat detection, not audit logging. Option D is incorrect because VPC Flow Logs capture network traffic, not configuration changes.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

VPC Flow Logs

Question 3

A company wants to monitor network traffic to and from its VPC for security analysis. It needs to capture IP traffic information, including accepted and rejected connection attempts, and store the data in S3 for long-term analysis. Which AWS service should be used?

Accepted Answer

Amazon VPC Flow Logs. VPC Flow Logs capture network traffic metadata and can be published to S3. Option A is wrong because CloudWatch Logs is for application logs, not network flows. Option C is wrong because GuardDuty is a threat detection service, not a log source. Option D is wrong because CloudTrail tracks API calls.

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 4

A DevOps engineer runs the command above to retrieve CPU utilization for an EC2 instance, but gets no data points. The instance is running and has basic monitoring enabled. What is the most likely reason?

Accepted Answer

The IAM user executing the command lacks 'cloudwatch:GetMetricStatistics' permission.. The command likely fails because the IAM user executing it does not have the 'cloudwatch:GetMetricStatistics' permission. Basic monitoring publishes CPUUtilization metrics every 5 minutes (300 seconds), so a period of 300 seconds is valid. The dimension name 'InstanceId' is correct as shown. Option A is wrong because the dimension name is case-sensitive and 'InstanceId' is correct. Option B is wrong because basic monitoring is enabled by default and publishes CPUUtilization. Option C is wrong because 300 seconds equals the default 5-minute interval, which is the minimum supported period for basic monitoring.

Answer

The dimension name should be 'InstanceId' with a different case.

Answer

The instance has basic monitoring disabled.

Answer

The period of 300 seconds is less than the minimum supported period.

Question 5

A company runs a microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. The DevOps team wants to monitor the number of HTTP 5xx errors returned by each service. They configure the ALB to send access logs to an S3 bucket and enable CloudWatch Container Insights. However, the team cannot view 5xx errors per service. What should the team do to achieve this?

Accepted Answer

Enable ALB access logging and parse the logs to filter by target group, then correlate with the ECS service name.. ALB access logs include the target group ARN. By parsing the logs and filtering for HTTP 5xx errors, you can group by target group. Then, you can correlate the target group with the ECS service name (e.g., via target group tags or by looking at the ALB listener rules). This allows you to view 5xx errors per service. Option A is incorrect because CloudWatch Logs Insights cannot query logs directly from S3; the logs would need to be in CloudWatch Logs. Option B is incorrect because Container Insights provides metrics at the task level, not per service, and does not directly expose HTTP 5xx errors from the ALB. Option D is incorrect because adding a custom header does not automatically create a metric; you would need additional logging or parsing to extract that header.

Answer

Use CloudWatch Logs Insights to query the ALB access logs directly from S3.

Answer

Enable Container Insights and create a CloudWatch dashboard to view HTTP 5xx errors per ECS service.

Answer

Configure the ALB to add a custom header with the service name and use CloudWatch metrics.

Question 6

A company uses AWS Organizations to manage multiple accounts. The DevOps team needs to monitor for any IAM user creation across all accounts in the organization. Which THREE steps should be taken to implement this centralized monitoring?

Accepted Answer

Create a CloudWatch Logs metric filter on the organization's CloudTrail log group for 'CreateUser' events.. Options A, B, and E are correct. Option B: Enabling CloudTrail in the management account with an organization trail captures all API activity across accounts. Option A: Creating a CloudWatch Logs metric filter on the organization's CloudTrail log group for 'CreateUser' events captures the specific event. Option E: Setting a CloudWatch alarm on the metric sends notifications via SNS. Option C is wrong because configuring an S3 bucket with event notifications does not directly enable centralized monitoring and alerting for IAM user creation. Option D is wrong because AWS Config rules are used for resource configuration compliance, not for real-time API call monitoring like IAM user creation.

Answer

Configure an S3 bucket to receive CloudTrail logs from all accounts and enable S3 event notifications for object creation.

Answer

Use AWS Config rules to detect IAM user creation across accounts.

Question 7

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Fargate tasks require network connectivity to pull container images from ECR (or Docker Hub) and to send logs to CloudWatch. Without a route to a NAT Gateway (for private subnets) or an Internet Gateway (for public subnets), the task cannot pull the image and fails to start. Option B is incorrect: while the image must exist, the immediate symptom of tasks failing to start when the image is missing would be an 'image not found' error, not a generic failure; the security group already allows inbound traffic on port 8080, but outbound connectivity is the issue. Option C is incorrect: insufficient CPU/memory would cause tasks to enter a 'CPU exhausted' or 'memory exhausted' state, not prevent them from starting entirely. Option D is incorrect: the security group allows inbound traffic, but the issue is about egress connectivity for the task to reach the image registry.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.

Question 8

A DevOps engineer receives a CloudWatch alarm that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance hosts a critical web application. What is the MOST appropriate immediate response to mitigate performance impact?

Accepted Answer

Place the instance into an Auto Scaling group with a scale-out policy based on CPU utilization.. Placing the instance into an Auto Scaling group with a scale-out policy based on CPU utilization allows the group to launch additional instances to handle the increased load, providing immediate mitigation without downtime. Rebooting (A) causes downtime and does not resolve the root cause. Creating a new AMI and launching a larger instance (C) or stopping and resizing (D) both involve significant downtime and are not immediate. Therefore, B is the best immediate response.

Answer

Reboot the EC2 instance to clear any temporary processes.

Answer

Create a new AMI from the instance and launch a new larger instance.

Answer

Stop the instance and change its type to a larger instance size.

Question 9

A company's production environment uses an Amazon ElastiCache Redis cluster for session caching. The operations team reports that the cache hit ratio has dropped significantly, causing increased load on the backend database. What is the MOST likely cause?

Accepted Answer

The cache is under memory pressure and evicting keys to make room.. A sudden drop in cache hit ratio is most commonly caused by memory pressure in the ElastiCache cluster, forcing key evictions. As keys are evicted to free memory, subsequent requests miss the cache and hit the database, reducing the hit ratio. Option B (cluster mode resizing) would cause a temporary disruption but not a sustained drop. Option C (encryption in transit) adds latency but does not affect cache hits. Option D (network partition) would cause cache unavailability, not just a reduced hit ratio.

Answer

The cluster was resized from a single node to a cluster mode.

Answer

The encryption in transit was enabled, adding latency.

Answer

There is a network partition between the application and the cache.

Question 10

An application running on Amazon EC2 instances in an Auto Scaling group is experiencing intermittent connectivity issues. The DevOps team suspects a security group configuration problem. Which approach should the team use to analyze security group traffic and identify denied requests?

Accepted Answer

Enable VPC Flow Logs and query Amazon Athena. VPC Flow Logs capture all network traffic (accepted and rejected) and can be queried using Amazon Athena to identify denied requests. Option A is incorrect because AWS Config records resource configuration changes, not network traffic. Option B is incorrect because AWS CloudTrail logs API calls, not network traffic. Option C is incorrect because AWS Security Hub aggregates security findings from various services but does not log individual traffic flows. Therefore, enabling VPC Flow Logs and querying Athena is the appropriate approach to analyze security group traffic and identify denied requests.

Answer

Use AWS Config to review security group rules

Answer

Check AWS CloudTrail for security group modification events

Answer

Enable AWS Security Hub and review the security findings

Question 11

A company has a production Amazon EKS cluster with multiple node groups. The DevOps team notices that some pods are frequently restarting due to OOMKilled errors, but the cluster-level metrics (CPU, memory) appear normal. Which CloudWatch Container Insights metric should be analyzed to identify the specific node or pod causing the issue?

Accepted Answer

pod_memory_utilization.. Container Insights provides pod-level memory utilization metrics (pod_memory_utilization) that can pinpoint which pod is exceeding its memory limit, causing OOMKilled errors. Option A (node_memory_utilization) is aggregate at node level and may not show individual pod issues. Option B (number_of_running_pods) does not indicate memory usage. Option D (pod_cpu_utilization) is for CPU, not memory.

Answer

node_memory_utilization.

Answer

number_of_running_pods.

Answer

pod_cpu_utilization.

Question 12

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function sometimes fails due to a transient error in a downstream API. The DevOps engineer wants to ensure that failed messages are retried automatically and eventually sent to a dead-letter queue after 3 failed attempts. The SQS queue is configured with a redrive policy that moves messages to a DLQ after 3 receive attempts. However, Lambda functions that fail are not being retried. What is the MOST likely reason?

Accepted Answer

The event source mapping has 'MaximumRetryAttempts' set to 0.. The event source mapping for Lambda has a separate retry policy controlled by 'MaximumRetryAttempts'. When set to 0, Lambda will not retry failed invocations, even though the SQS queue's redrive policy is configured to move messages to the DLQ after 3 receive attempts. Without Lambda retries, the message becomes visible again after the visibility timeout, and the receive count increments, eventually triggering the redrive. Option A is incorrect because batch size does not affect retries. Option B is incorrect because visibility timeout only affects when the message reappears, not the number of retry attempts. Option D is incorrect because the dead-letter queue is configured on the SQS queue, not on the Lambda function.

Answer

The batch size is set to 1, preventing retries.

Answer

The visibility timeout is set too low, causing messages to be retried immediately.

Answer

The dead-letter queue is not configured on the Lambda function.

Question 13

A DevOps engineer is troubleshooting a Lambda function that is timing out. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Increase the function timeout in the Lambda configuration.. Increasing the function timeout allows more time for the function to complete before timing out. Option E is correct because reviewing CloudWatch Logs helps identify timeout errors and execution details. Option A is wrong because setting reserved concurrency to 1 isolates the function but does not diagnose timeout issues. Option C is wrong because VPC configuration can cause network delays but is not a direct diagnostic step for timeout. Option D is wrong because increasing memory allocation may improve performance but does not directly resolve timeouts.

Answer

Set reserved concurrency to 1 to isolate the function.

Answer

Check the VPC configuration for the Lambda function.

Answer

Increase the function memory allocation.

Question 14

A DevOps engineer receives an alert that an EC2 instance's CPU utilization has been above 90% for the last 30 minutes. The engineer needs to investigate the root cause. Which AWS service should the engineer use to get OS-level process details and identify which process is consuming the CPU?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run commands (e.g., 'top', 'ps') remotely on EC2 instances to obtain OS-level process details and identify which process is consuming CPU. Option A is wrong because AWS Config records configuration changes, not OS-level processes. Option B is wrong because AWS CloudTrail logs API calls, not system-level metrics. Option D is wrong because Amazon CloudWatch provides aggregated CPU utilization metrics but cannot provide process-level details.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 15

A company runs a containerized application on Amazon ECS with Fargate launch type. The application consists of three microservices: frontend, backend, and database. The ECS cluster is in a VPC with public and private subnets. The frontend service is publicly accessible via an Application Load Balancer (ALB) in public subnets. The backend service communicates with the database service, which runs as a stateful service with persistent storage using Amazon EFS. The DevOps team is using CloudWatch Container Insights and has enabled Prometheus metrics for the ECS cluster. Recently, the team observed that the frontend service's response time has increased significantly, and some requests are timing out. The team checked the ALB metrics and saw an increase in 5xx errors. They also noticed that the backend service's CPU utilization is high, and the database service's disk I/O is high. The team suspects a bottleneck in the backend service. Which course of action should the team take FIRST to identify the root cause?

Accepted Answer

Check the backend service's application logs in CloudWatch Logs to identify errors or slow database queries.. The first step is to analyze the backend service's application logs to identify any errors or slow operations. High CPU and disk I/O may be caused by inefficient queries or code issues. Option A is incorrect because disabling health checks would hide the problem and could route traffic to unhealthy tasks. Option B is incorrect because migrating to RDS does not address the immediate issue and is a significant change without root cause analysis. Option D is incorrect because increasing the desired count without understanding the root cause may temporarily alleviate load but does not fix underlying performance issues and can increase costs.

Answer

Disable the health check for the backend service in the ALB target group.

Answer

Migrate the database service to Amazon RDS for better performance.

Answer

Increase the desired count of the backend service to reduce load per task.

Question 16

A DevOps team is using AWS CodeBuild to run unit tests and package a Java application. They want to cache the Maven local repository (~/.m2) between builds to improve build times. Which TWO steps are necessary to enable caching in CodeBuild? (Select TWO.)

Accepted Answer

Add a 'cache' section in the buildspec file specifying the paths to cache.. To enable caching for the Maven local repository in AWS CodeBuild, two steps are required: (1) Add a `cache` section in the buildspec file specifying the paths to cache (e.g., ~/.m2) — this is option D. (2) Create an S3 bucket to store the cache and configure the CodeBuild project to use that bucket for caching — this is option E. Option A (setting MAVEN_OPTS) is not necessary because the default Maven repository path is already ~/.m2. Option B (uploading as a build artifact) is for saving output artifacts, not for caching. Option C ('Local cache' mode) is a different feature used for Docker layer caching, not for Maven dependencies. Therefore, options D and E are correct.

Answer

Set the MAVEN_OPTS environment variable to use a custom repository path.

Answer

Configure the buildspec to upload the Maven repository as a build artifact.

Answer

Enable 'Local cache' mode in the CodeBuild project.

Question 17

A company is designing a disaster recovery plan for an RDS PostgreSQL database. They have a cross-region read replica. Which THREE steps should they take to ensure a successful failover?

Accepted Answer

Configure applications to use the new database endpoint. To failover a cross-region read replica, promote it to a standalone database instance (Option D). After promotion, update the Route 53 DNS record to point to the new master (Option C) and configure applications to use the new database endpoint (Option B). Option A is incorrect because automated backups are enabled by default on the replica once promoted or can be enabled separately, but they are not required prior to promotion. Option E is incorrect because Multi-AZ is not supported on read replicas in the same region; cross-region replicas also cannot have Multi-AZ before promotion. Multi-AZ can be configured after promotion if desired.

Answer

Enable automated backups on the replica before promotion

Answer

Enable Multi-AZ on the read replica before promotion

Question 18

Refer to the exhibit. A DevOps engineer created an IAM role 'MyLambdaRole' for a Lambda function. The Lambda function needs to write logs to CloudWatch Logs. However, the function is not able to create log streams. What is the most likely missing configuration?

Accepted Answer

The role does not have an inline or managed policy that grants permissions for CloudWatch Logs.. The IAM role must have an inline or managed policy that grants permissions for CloudWatch Logs actions such as logs:CreateLogStream and logs:PutLogEvents. Option A is incorrect because the role name does not need a prefix; the trust policy is what matters. Option C is incorrect because the role ARN format does not affect log stream creation. Option D is incorrect because the trust policy allowing Lambda to assume the role is separate from the permissions to write logs; the question states the function is not able to create log streams, which indicates a permissions issue within the role's policies.

Answer

The role name is not prefixed with 'AWSLambda'.

Answer

The role ARN is incorrectly formatted.

Answer

The trust policy does not allow Lambda to assume the role.

Question 19

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an RDS MySQL database. The security team requires that all traffic between the application and the database be encrypted in transit. Currently, the database security group allows inbound traffic from the ECS tasks' security group on port 3306 (MySQL). The application uses the standard MySQL client connection without SSL. After enabling SSL on the RDS instance, the application starts failing to connect. The error logs show 'SSL connection error: protocol version mismatch'. The application runs on a custom Docker image based on Amazon Linux 2. The DevOps engineer needs to fix the connection issue. Which course of action should the engineer take?

Accepted Answer

Update the Docker image to include the latest MySQL client libraries that support TLS 1.2.. The error indicates that the MySQL client in the container does not support the TLS version required by RDS. The simplest solution is to modify the application connection string to use the '--ssl-mode=REQUIRED' flag or equivalent, but the error persists even after that. The actual fix is to update the MySQL client libraries in the container image to a version that supports TLS 1.2, as RDS requires TLS 1.2 or higher. Alternatively, the engineer can configure RDS to accept TLS 1.0, but that is not secure. Changing the security group or using SSH tunneling does not address the TLS version mismatch.

Answer

Update the application code to connect using SSL with the --ssl-mode=REQUIRED flag.

Answer

Modify the RDS parameter group to allow TLS 1.0 and 1.1.

Answer

Create a VPC peering connection and route traffic through a VPN.

Question 20

A DevOps engineer receives an alarm that an EC2 instance's StatusCheckFailed metric has been in ALARM state for 10 minutes. Which action should the engineer take first to investigate?

Accepted Answer

Review the instance's system log and application logs in CloudWatch Logs. When an EC2 instance's StatusCheckFailed metric is in ALARM state, it indicates a problem with the instance itself (OS-level or application-level). Reviewing the instance's system log and application logs in CloudWatch Logs is the first step to diagnose the root cause. Option B (AWS Config) checks configuration compliance, which is not directly related to the health check failure. Option C (CloudTrail) logs API calls but not OS-level issues. Option D (restart) may temporarily resolve the issue but does not provide investigation.

Answer

Use AWS Config to check the instance's configuration compliance

Answer

Check AWS CloudTrail for any API calls that modified the instance

Answer

Restart the EC2 instance to clear the alarm