DOP-C02 Practice Exam 3 — 20 Questions

Question 1

A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use CloudWatch Logs Insights to run queries across multiple log groups.. CloudWatch Logs Insights is purpose-built for querying log data across multiple log groups. It uses a query language to search, filter, and aggregate log events, making it ideal for identifying error patterns across different sources. This option is correct because it directly supports cross-log-group queries without additional data movement or infrastructure.

Answer

Install the CloudWatch Logs agent on an EC2 instance and tail the logs.

Answer

Create a Lambda function that reads logs from each log group and searches for the pattern.

Answer

Use Amazon Kinesis Data Analytics to process the log streams.

Question 2

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. The application is deployed using AWS CodeDeploy with an in-place deployment configuration. During a recent deployment, the deployment failed because the new application version caused a health check failure, and CodeDeploy did not automatically roll back. What should the engineer do to ensure automatic rollback on health check failure?

Accepted Answer

Enable automatic rollback in the CodeDeploy deployment group and set up a CloudWatch alarm for the ALB health check. CodeDeploy can automatically roll back a deployment when a CloudWatch alarm, such as one monitoring ALB health check failures, enters the ALARM state. By enabling automatic rollback in the deployment group and associating the CloudWatch alarm, the deployment will revert to the previous version as soon as the health check fails, without manual intervention.

Answer

Set up an EC2 instance lifecycle hook to trigger a rollback script when the instance enters a pending state

Answer

Configure an Amazon SQS queue to monitor health checks and invoke a rollback Lambda function

Answer

Modify the Auto Scaling group to replace unhealthy instances automatically

Question 3

Refer to the exhibit. A DevOps engineer ran the above AWS CLI command after a CloudFormation stack update. What does the status 'ROLLBACK_COMPLETE' indicate?

Accepted Answer

The stack update failed and CloudFormation reverted to the previous stack.. The 'ROLLBACK_COMPLETE' status indicates that the CloudFormation stack update operation failed, and CloudFormation automatically reverted the stack to its previous stable state. This is a built-in safety mechanism: if any resource fails to update, CloudFormation triggers a rollback to undo all changes made during the update, ensuring the stack returns to its last known good configuration.

Answer

The stack update is in progress.

Answer

The stack was deleted successfully.

Answer

The stack was created successfully.

Question 4

A company uses AWS CodeBuild to compile and test code. The buildspec.yml file includes commands that require access to a private S3 bucket. The DevOps engineer wants to securely provide AWS credentials to the build project. What is the recommended approach?

Accepted Answer

Use a service role for CodeBuild with appropriate permissions. The recommended approach is to use a service role for CodeBuild with appropriate permissions. CodeBuild can assume an IAM role that grants the build project access to the private S3 bucket, eliminating the need to manage long-term credentials. This follows AWS best practices for secure credential management by using temporary, automatically rotated credentials via the AWS Security Token Service (STS).

Answer

Store the AWS access key ID and secret access key in the buildspec.yml file

Answer

Use an EC2 instance profile attached to the build environment

Answer

Pass the credentials as environment variables in the build project configuration

Question 5

A company uses AWS CloudFormation to deploy infrastructure. They have a template that creates an Amazon EC2 instance and an Elastic IP address. The template uses the AWS::EC2::EIP resource. The team notices that when they delete the stack, the Elastic IP address is not released, leading to charges. They want to ensure that the Elastic IP is automatically released when the stack is deleted. What should they do?

Accepted Answer

Set the DeletionPolicy attribute to 'Delete' on the EIP resource. The default DeletionPolicy for AWS::EC2::EIP is 'Retain', meaning the Elastic IP address is preserved after stack deletion, leading to charges. To ensure it is automatically released, you must explicitly set the DeletionPolicy attribute to 'Delete' on the EIP resource. This overrides the default and causes the Elastic IP to be deleted upon stack deletion. Option A (Retain) would keep the EIP, which is the default and would still incur charges. Option B (custom resource) is unnecessary. Option D (DependsOn) does not control deletion behavior. Therefore, Option C is the correct solution.

Answer

Set the DeletionPolicy attribute to 'Retain' to keep the EIP

Answer

Create a custom resource to release the EIP before stack deletion

Answer

Add a DependsOn clause to ensure proper order of deletion

Question 6

A team manages a large fleet of EC2 instances using AWS Systems Manager. They want to enforce a consistent configuration across all instances, including installed software packages, firewall rules, and user accounts. The team also needs to audit configuration changes and remediate drift automatically. Which AWS service should the team use?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct choice because it is designed to enforce a consistent configuration across EC2 instances by defining and applying desired state configurations (DSCs). It can manage software packages, firewall rules, and user accounts, and it automatically remediates drift by re-applying the desired state on a schedule. This directly meets the requirement for configuration enforcement, auditing, and automated drift remediation.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS Systems Manager Run Command

Answer

AWS Config

Question 7

A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)

Accepted Answer

Run Command. Run Command (A) is correct because it allows you to remotely and securely execute scripts or commands across EC2 instances without needing SSH or RDP, using an SSM document (SSM Document) that defines the desired configuration actions. This capability directly enforces a desired state by running idempotent scripts on demand or on a schedule.

Answer

OpsCenter

Answer

Parameter Store

Question 8

A company wants to ensure that its application can recover from an Amazon S3 service disruption. The application reads and writes data to S3. Which strategy should the application implement to achieve resilience?

Accepted Answer

Implement application logic to fall back to an S3 bucket in a different Region if the primary bucket is unavailable. Implementing application logic to fall back to an S3 bucket in a different Region provides resilience against a regional S3 service disruption. S3 buckets are regional resources, so if one Region experiences an outage, the application can redirect reads and writes to a bucket in another Region. This approach requires the application to handle errors from the primary bucket and switch to the secondary bucket, ensuring continued availability without relying on automatic failover mechanisms that may not be instantaneous.

Answer

Store all data in a single S3 bucket with versioning enabled

Answer

Enable S3 Cross-Region Replication with automatic failover

Answer

Use S3 Transfer Acceleration to improve data transfer speed

Question 9

A company uses AWS Lambda with Amazon DynamoDB to process orders. During peak hours, the Lambda function sometimes fails with throttling errors from DynamoDB. The system must be resilient and cost-effective. What should a DevOps engineer do?

Accepted Answer

Configure DynamoDB auto scaling and implement a dead-letter queue in Lambda to retry failed events.. Configuring DynamoDB auto scaling allows the table to adjust its provisioned capacity based on actual traffic patterns, preventing throttling during peak hours while remaining cost-effective during low usage. Implementing a dead-letter queue (DLQ) in Lambda ensures that failed events (e.g., due to transient throttling) are captured and can be retried or investigated, providing resilience without manual intervention.

Answer

Use Amazon SQS to buffer the requests and have Lambda pull from the queue with a reserved concurrency limit.

Answer

Increase the DynamoDB provisioned read and write capacity units to a high fixed value.

Answer

Provision DynamoDB Accelerator (DAX) to cache reads and reduce throttling.

Question 10

A DevOps engineer needs to set up a monitoring solution for an application running on Amazon EKS. The application emits custom metrics that need to be stored in Amazon CloudWatch and visualized on a dashboard. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch agent to emit custom metrics to CloudWatch.. The CloudWatch agent can be configured to emit custom application metrics to Amazon CloudWatch, which is the required destination for storing the metrics. The agent uses the CloudWatch PutMetricData API to send these metrics, enabling centralized monitoring and alerting within CloudWatch.

Answer

Use CloudWatch Logs Insights to analyze the custom metrics.

Answer

Use Amazon Managed Service for Prometheus to scrape the metrics.

Question 11

An organization has a AWS CodePipeline that deploys a critical application. The pipeline uses a manual approval step before deploying to production. The team wants to ensure that only authorized users can approve the deployment, and that the approval action is logged for compliance. Which combination of actions should the team take? (Select TWO.)

Accepted Answer

Configure the approval action to invoke an AWS Lambda function that validates the approver's IAM role tags.. AWS CodePipeline's manual approval action can be configured to invoke an AWS Lambda function that checks the approver's IAM role tags, ensuring only authorized users (e.g., those with a specific 'approver' tag) can approve. This provides fine-grained, custom authorization beyond basic IAM policies. Option B is correct because enabling AWS CloudTrail captures all approval API calls (e.g., PutApprovalResult) as audit logs, meeting compliance requirements for tracking who approved and when.

Answer

Use Amazon Simple Notification Service (SNS) to send approval notifications and allow any subscriber to approve.

Answer

Use AWS CodeCommit to manage approval permissions via repository policies.

Answer

Store approval logs in Amazon CloudWatch Logs for real-time monitoring.

Question 12

Refer to the exhibit. A DevOps engineer runs the above commands. The build project 'my-project' uses an S3 bucket as source and another S3 bucket for artifacts. The build fails with an 'Access Denied' error when trying to download the source code. What is the most likely cause?

Accepted Answer

The service role does not have s3:GetObject permission on the source bucket. The build project 'my-project' uses an S3 bucket as the source. When CodeBuild downloads source code from S3, the service role must have the s3:GetObject permission on the source bucket. The 'Access Denied' error indicates that the role lacks this permission, making option B the most likely cause.

Answer

The encryption key is a KMS key that the role cannot access

Answer

The source type is S3, but the project expects CodeCommit

Answer

The source location is incorrect

Question 13

A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?

Accepted Answer

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.. An ALB can be configured with an HTTPS listener and a redirect rule that sends HTTP traffic to HTTPS, enforcing encrypted transit at the load balancer level. Option A is incorrect because configuring the web server to only respond to HTTPS does not prevent HTTP traffic from reaching the ALB; the ALB would still accept HTTP. Option C is incorrect because security groups filter traffic based on ports and IP addresses but cannot redirect HTTP to HTTPS; they only allow or deny traffic. Option D is incorrect because while CloudFront can redirect HTTP to HTTPS, the question asks for a configuration on the ALB itself, not an additional service.

Answer

Configure the web server on the EC2 instances to only respond to HTTPS requests.

Answer

Configure the security group of the ALB to only allow inbound HTTPS traffic.

Answer

Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.

Question 14

A company wants to centralize IAM user management across multiple AWS accounts. The company currently uses individual IAM users in each account. What is the BEST practice for centralized access control?

Accepted Answer

Use AWS Organizations and AWS IAM Identity Center (AWS SSO) to manage users centrally.. AWS Organizations with IAM Identity Center (AWS SSO) enables centralized user management and single sign-on across multiple AWS accounts, eliminating the need to manage individual IAM users in each account. Option B is incorrect because creating the same IAM users in each account leads to duplication and inconsistent permissions. Option C is incorrect because cross-account roles still require local IAM users or federated identities to assume those roles, and do not provide centralized user management. Option D is incorrect because IAM federation with an external IdP centralizes authentication but does not inherently manage users across accounts unless combined with AWS Organizations and IAM Identity Center.

Answer

Create the same IAM users in each account with identical permissions.

Answer

Create IAM roles in each account and allow cross-account access from a central account.

Answer

Use IAM federation with an external identity provider and assign permissions based on SAML attributes.

Question 15

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. The upload fails with an Access Denied error because the IAM policy attached to the user includes a condition that requires the request to include the `x-amz-server-side-encryption` header with a value of `AES256`. Since the user attempts to upload without specifying any server-side encryption, the request does not satisfy the condition and is denied. Option A is incorrect because the policy denies unencrypted uploads. Option B is incorrect because the user did not request SSE-S3. Option C is incorrect because automatic encryption does not override the IAM policy condition; the policy explicitly requires the encryption header to be present in the request.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-S3 encryption.

Answer

The upload succeeds and is automatically encrypted with SSE-S3.

Question 16

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Use the CloudWatch Logs console or API to associate the KMS key with the log group. Options A and E are correct. To encrypt CloudWatch Logs with a customer-managed KMS key, you must first create a customer-managed KMS key with a key policy that grants CloudWatch Logs permission to use the key (option E). Then, you associate the key with the log group using the CloudWatch Logs console or API (option A). Option B is wrong because CloudWatch Logs does not support default encryption at the account level. Option C is wrong because you do not update the log group's resource policy; the key policy is set on the KMS key itself. Option D is wrong because encryption is at the log group level, not per log stream.

Answer

Enable default encryption for CloudWatch Logs in the AWS account settings

Answer

Update the log group's resource policy to reference the KMS key

Answer

Associate the KMS key with each log stream individually

Question 17

A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the CloudWatch Logs retention policy on the log group to 90 days.. Setting the CloudWatch Logs retention policy on the log group to 90 days ensures logs are retained for operational analysis and then automatically expire (deleted) after 90 days. Option E is correct because to archive logs to Amazon S3 for compliance, you must use a CloudWatch Logs export task to export logs to S3 before the retention period expires. Option B is incorrect because an S3 lifecycle policy applies to objects already in S3, not to logs in CloudWatch. Option C is incorrect because subscription filters can stream logs in real time to destinations like Lambda or Kinesis, but not directly to S3 for archival. Option D is incorrect because CloudWatch Logs does not have a lifecycle policy to transition logs directly to S3; export is required.

Answer

Set an S3 lifecycle policy on the destination bucket to transition objects to Glacier after 90 days.

Answer

Create a CloudWatch Logs subscription filter to stream logs to Amazon S3 in real time.

Answer

Configure a CloudWatch Logs lifecycle policy to transition logs to Amazon S3 after 90 days.

Question 18

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Accepted Answer

Launch the RDS instance in a private subnet.. (launch RDS in a private subnet) and Option D (enable encryption at rest using AWS KMS) are correct best practices for securing an Amazon RDS database. Launching in a private subnet ensures the database is not directly accessible from the internet, enhancing security. Encryption at rest protects data stored on disk. Option A is incorrect because enabling public accessibility increases exposure to attacks. Option B is incorrect because using a single Availability Zone does not enhance security and may reduce availability. Option E is incorrect because direct IAM user access to the database is not a standard practice; RDS uses database authentication, though IAM database authentication can be used, it's not a direct IAM user access and is not a best practice for all scenarios.

Answer

Enable public accessibility for easy management.

Answer

Use a single Availability Zone to reduce complexity.

Answer

Grant direct IAM user access to the database.

Question 19

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Review the canary's CloudWatch Logs for error details.. CloudWatch Synthetics canaries automatically log execution details, including errors, to CloudWatch Logs. Reviewing these logs provides specific error information, such as 'ClientError' details. Option C is correct because each canary runs as an AWS Lambda function, and the Lambda function's CloudWatch Logs contain runtime logs, including any exceptions or errors thrown during execution. Option A is incorrect because while adding logging could be a long-term improvement, the question asks for diagnostic actions; the canary already logs to CloudWatch Logs, so modifying the script is not necessary for diagnosis. Option D is incorrect because CloudWatch metrics provide aggregate statistics (e.g., success/failure rates) but not detailed error codes or messages. Option E is incorrect because CloudTrail records API calls to create, start, or stop canaries, not the execution details of individual canary runs.

Answer

Modify the canary script to add more logging.

Answer

Examine CloudWatch metrics for the canary.

Answer

Check CloudTrail for CanaryRun API calls.

Question 20

Which TWO AWS services can be used to manage and rotate database credentials automatically? (Select TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. Options A and B are correct. AWS Systems Manager Parameter Store can store database credentials as SecureString parameters, and you can implement automatic rotation using a custom AWS Lambda function. AWS Secrets Manager provides built-in automatic rotation for supported databases (e.g., Amazon RDS, Amazon Redshift) without requiring custom code. Option C (AWS CloudFormation) is an infrastructure-as-code service and does not manage or rotate credentials. Option D (AWS KMS) is a key management service that encrypts data but does not handle credential rotation. Option E (AWS IAM) manages access permissions and roles, not database credentials.

Answer

AWS CloudFormation

Answer

AWS KMS

Answer

AWS IAM