DOP-C02 Practice Exam 3 — 20 Questions

Question 1

A security engineer runs the above CLI command to investigate IAM user 'Bob'. The output shows Bob logged in and then created a new IAM user. Which additional information should the engineer look for to determine if this was a security incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The source IP address from the CloudTrail event details.. To determine if the activity is malicious, the engineer should check the source IP address from the CloudTrail event details. The source IP can indicate if the login came from an unexpected location, suggesting compromised credentials. Option A is wrong because the event name (CreateUser) is already known from the command output. Option B is wrong because the time the new user was last modified does not provide direct evidence about the unauthorized nature of the login event. Option D is wrong because the IAM group memberships of the new user do not indicate whether the login itself was unauthorized.

Answer

The event name for the user creation.

Answer

The time the new user was last modified.

Answer

The IAM group memberships of the new user.

Question 2

A company runs a critical application on EC2 instances in an Auto Scaling group. The application must be highly available across multiple Availability Zones. Which TWO configurations are necessary to achieve this? (Choose TWO.)

Accepted Answer

Place an Application Load Balancer in front of the Auto Scaling group.. To achieve high availability across multiple Availability Zones (AZs), two key configurations are required. First, the Auto Scaling group must be configured to launch instances in multiple AZs (Option E). This ensures that if one AZ fails, the application can continue serving traffic from instances in other AZs. Second, an Application Load Balancer (ALB) should be placed in front of the Auto Scaling group (Option D). The ALB distributes incoming traffic across instances in all AZs where the Auto Scaling group has launched instances. It also performs health checks and automatically routes traffic away from unhealthy instances. Option A is incorrect because using a single AZ would create a single point of failure, undermining high availability. Option B is incorrect because Spot Instances can be terminated with little notice, which is unsuitable for a critical application requiring consistent availability. Option C is incorrect because a Classic Load Balancer lacks advanced features like path-based routing and native cross-zone load balancing, making the ALB a better choice for modern applications.

Answer

Use a single Availability Zone to reduce latency.

Answer

Use Spot Instances to reduce costs.

Answer

Use a Classic Load Balancer to distribute traffic.

Question 3

A company's DevOps team is designing an automated incident response workflow using AWS Systems Manager Incident Manager and AWS Lambda. The workflow should automatically acknowledge incidents and send notifications to the appropriate response team. Which TWO actions should the team take to achieve this?

Accepted Answer

Have the Lambda function publish a message to an SNS topic that the response team subscribes to.. The Lambda function can publish a message to an SNS topic, which sends notifications to the response team. Option E is correct because an Amazon EventBridge rule can match Incident Manager events (e.g., incident creation) and trigger the Lambda function to acknowledge the incident and initiate notifications. Option B is incorrect because CloudWatch alarms do not directly invoke Incident Manager; incidents are created through response plans or EventBridge. Option C is incorrect because Incident Manager's built-in 'Acknowledge' and 'Notify' actions are not independent actions; they are part of a response plan, and the question asks for actions to implement the workflow using Lambda. Option D is incorrect because AWS Step Functions is unnecessary overhead for this simple workflow; a direct integration between EventBridge, Lambda, and SNS suffices.

Answer

Configure the CloudWatch alarm to directly invoke the Lambda function for incident creation.

Answer

Use Incident Manager's built-in 'Acknowledge' and 'Notify' actions in a response plan.

Answer

Use AWS Step Functions to orchestrate the Lambda function and SNS topic.

Question 4

A company uses Amazon RDS for MySQL and has enabled automated backups. The database administrator accidentally deleted a critical row from a table. The deletion occurred 15 minutes ago. What is the fastest way to recover the lost data?

Accepted Answer

Perform a Point-in-Time Restore to a time just before the deletion.. Point-in-Time Restore (PITR) is the fastest method to recover the deleted data. Since automated backups are enabled, RDS allows restoring to any point within the backup retention period, down to the second. By restoring to a time just before the deletion (approximately 15 minutes ago), the lost row is recovered without needing to manually apply binary logs or create a snapshot. Option B is incorrect because RDS does not provide an 'undo last transaction' feature. Option C is incorrect because although binary logs can be used to replay transactions, this process is manual, time-consuming, and not the fastest AWS-native approach. Option D is incorrect because creating a manual snapshot from the current instance would include the deletion, and restoring it would not recover the lost data.

Answer

Use the RDS console to undo the last transaction.

Answer

Use the binary log to replay transactions before the deletion.

Answer

Create a manual snapshot of the current instance and restore it.

Question 5

A DevOps team needs to monitor failed API calls in their AWS account. They want to receive notifications when specific IAM actions, such as DeleteBucket, fail. Which service should they use?

Accepted Answer

AWS CloudTrail and Amazon EventBridge.. AWS CloudTrail captures API calls, and Amazon EventBridge (formerly CloudWatch Events) can be used to create rules that match specific failed API calls (e.g., DeleteBucket) and trigger notifications. Option B is incorrect because AWS Config rules monitor resource configuration compliance, not API call failures. Option C is incorrect because S3 server access logs log requests made to an S3 bucket, not IAM API calls. Option D is incorrect because CloudWatch Logs and metric filters are used to monitor log data, but they are not the primary service for capturing API calls; CloudTrail is needed for that.

Answer

AWS Config rules.

Answer

Amazon S3 server access logs.

Answer

CloudWatch Logs and metric filters.

Question 6

A team manages a large fleet of EC2 instances using AWS Systems Manager. They want to enforce a consistent configuration across all instances, including installed software packages, firewall rules, and user accounts. The team also needs to audit configuration changes and remediate drift automatically. Which AWS service should the team use?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct choice because it is designed to enforce a consistent configuration across EC2 instances by defining and applying desired state configurations (DSCs). It can manage software packages, firewall rules, and user accounts, and it automatically remediates drift by re-applying the desired state on a schedule. This directly meets the requirement for configuration enforcement, auditing, and automated drift remediation.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS Systems Manager Run Command

Answer

AWS Config

Question 7

A company is migrating its on-premises applications to AWS and wants to maintain the same level of monitoring for its Linux-based EC2 instances. They currently use Nagios for monitoring. They want a managed AWS service that can monitor instance health, system metrics, and application logs. Which solution should they use?

Accepted Answer

Install the Amazon CloudWatch agent on each EC2 instance to collect system metrics and logs, and send them to CloudWatch.. The Amazon CloudWatch agent (unified CloudWatch agent) can collect system metrics (CPU, memory, disk) and logs from EC2 instances and send them to CloudWatch, providing a managed monitoring solution similar to Nagios. Option B is incorrect because AWS CloudTrail is for auditing API calls, not for monitoring system metrics or logs. Option C is incorrect because AWS Systems Manager Inventory collects software inventory and configuration data, not real-time metrics or logs. Option D is incorrect because AWS Config tracks resource configuration changes for compliance, not for monitoring system health.

Answer

Use AWS CloudTrail to monitor instance activity and capture log files.

Answer

Use AWS Systems Manager Inventory to collect system configuration and log files.

Answer

Use AWS Config to track instance configuration changes and trigger alerts.

Question 8

A security audit reveals that an S3 bucket contains objects that are publicly accessible. The DevOps engineer must prevent any future public access to the bucket and all objects within it. Which THREE actions should the engineer take? (Choose THREE.)

Accepted Answer

Enable Block Public Access settings on the bucket.. Enabling block public access settings on the bucket prevents any future public access, including through ACLs or bucket policies. Option C is correct because removing any bucket policy that grants public read access eliminates one potential vector for public access. Option D is correct because applying an SCP that denies s3:PutBucketPolicy actions that would make objects public ensures that no account in the organization can create a policy that grants public access. Option B is incorrect because disabling object ACLs only removes one method of granting public access; bucket policies can still allow public access. Option E is incorrect because enabling server access logging helps with auditing but does not prevent public access.

Answer

Disable object ACLs on the bucket.

Answer

Enable S3 server access logging.

Question 9

A company uses AWS Lambda with Amazon DynamoDB to process orders. During peak hours, the Lambda function sometimes fails with throttling errors from DynamoDB. The system must be resilient and cost-effective. What should a DevOps engineer do?

Accepted Answer

Configure DynamoDB auto scaling and implement a dead-letter queue in Lambda to retry failed events.. Configuring DynamoDB auto scaling allows the table to adjust its provisioned capacity based on actual traffic patterns, preventing throttling during peak hours while remaining cost-effective during low usage. Implementing a dead-letter queue (DLQ) in Lambda ensures that failed events (e.g., due to transient throttling) are captured and can be retried or investigated, providing resilience without manual intervention.

Answer

Use Amazon SQS to buffer the requests and have Lambda pull from the queue with a reserved concurrency limit.

Answer

Increase the DynamoDB provisioned read and write capacity units to a high fixed value.

Answer

Provision DynamoDB Accelerator (DAX) to cache reads and reduce throttling.

Question 10

A company uses Amazon CloudFront to distribute content globally. Users in some regions report slow load times. The DevOps team wants to identify the geographic regions where performance is worst. Which tool should they use?

Accepted Answer

CloudFront reports in the AWS Management Console. CloudFront reports in the AWS Management Console provide performance metrics (e.g., total requests, error rates, latency) broken down by geographic region, enabling the team to identify regions with worst performance. Option A is wrong: CloudWatch metrics for CloudFront are aggregated per distribution, not per region. Option B is wrong: CloudFront access logs in S3 record individual requests but do not aggregate performance by region. Option C is wrong: Amazon Route 53 latency records are used for DNS-based routing decisions, not for analyzing CloudFront performance.

Answer

Amazon CloudWatch Metrics for CloudFront

Answer

CloudFront access logs in S3

Answer

Amazon Route 53 latency records

Question 11

A company uses an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances in an Auto Scaling group. During an incident, the DevOps team notices that the ALB is returning 503 errors. The instances are healthy according to the target group health checks. What is the MOST likely cause?

Accepted Answer

The ALB's surge queue is full, causing it to reject requests.. 503 errors from an ALB typically indicate that the target group has no healthy instances, or all instances are marked unhealthy. However, the question says instances are healthy according to health checks, so the issue might be that the ALB itself is at capacity (e.g., surge queue full). The most common cause when health checks are passing but 503s persist is that the ALB's connection surge queue is full, often due to too many connections or slow targets. Option A is wrong because an ALB with no listeners would return 502 or 504, not 503. Option B is wrong because security group rules usually cause timeouts, not 503. Option C is wrong because 503 is not a typical throttling response; throttling returns 429.

Answer

The ALB has no listeners configured.

Answer

The security group for the ALB is blocking traffic from the clients.

Answer

The ALB is throttling requests due to a surge.

Question 12

A company runs a critical application on an Amazon RDS for MySQL DB instance. During a recent incident, the database became unresponsive. The DevOps team suspects that a long-running query is blocking other operations. Which metric should they monitor in Amazon CloudWatch to detect this type of issue?

Accepted Answer

ActiveTransactions (from Enhanced Monitoring). ActiveTransactions (from Enhanced Monitoring). This metric directly shows the number of active transactions, including long-running ones that can hold locks and cause blocking. Monitoring ActiveTransactions helps detect such issues. Option A (DatabaseConnections) indicates the number of connections but not whether they are actively blocking. Option C (ReadLatency) is a symptom of blocking but not a direct indicator. Option D (CPUUtilization) may be high for many reasons and does not specifically point to blocking.

Answer

DatabaseConnections

Answer

ReadLatency

Answer

CPUUtilization

Question 13

A DevOps engineer needs to grant an IAM user temporary access to an S3 bucket for exactly one hour. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is used to generate temporary, limited-privilege credentials for IAM users or federated users. IAM roles provide temporary credentials but are assumed, not generated for a specific user. Cognito is for identity federation with mobile/web apps. SSO provides single sign-on access.

Answer

Amazon Cognito

Answer

AWS SSO

Answer

AWS IAM

Question 14

A company uses AWS Systems Manager to patch EC2 instances. After a patch window, several instances are unreachable. The engineer checks the SSM Agent logs and finds no errors. What should the engineer do next to diagnose the issue?

Accepted Answer

Check if the instances have outbound internet connectivity to the SSM endpoints.. The SSM Agent requires outbound internet connectivity to the Systems Manager endpoints (or AWS PrivateLink if configured) to communicate with the service. If the patch window or a security group change blocks this connectivity, instances become unreachable despite the agent logs showing no errors. Option A is wrong because restarting the agent does not help if the issue is network connectivity. Option B is wrong because the patch baseline association defines which patches to apply, not connectivity. Option C is wrong because IAM permissions are likely correct since the agent logs show no errors; the issue is network-related, not permissions.

Answer

Restart the SSM Agent on the affected instances.

Answer

Verify that the patch baseline is associated with the instances.

Answer

Review the IAM role attached to the instances for sufficient permissions.

Question 15

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?

Accepted Answer

AWS Config and AWS Systems Manager Automation. AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance. EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Question 16

A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the most appropriate service because it is specifically designed to manage secrets like database passwords, with automatic rotation, encryption, and fine-grained access control. Option A (DynamoDB) is a database, not a secrets manager. Option B (S3) can store encrypted data but lacks built-in secret rotation and management. Option C (Systems Manager Parameter Store SecureString) can store secrets but does not support automatic rotation, making Secrets Manager the better choice.

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store (SecureString)

Question 17

A company needs to store audit logs for 7 years to meet compliance requirements. Which S3 storage class is the most cost-effective for long-term archival?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class designed for long-term archival of data that is accessed rarely (once or twice per year) and can tolerate retrieval times of 12-48 hours. For a 7-year compliance retention requirement, it provides the most cost-effective storage compared to S3 Glacier Flexible Retrieval, S3 Intelligent-Tiering, or S3 Standard.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 Glacier Flexible Retrieval

Question 18

An organization needs to audit all AWS API calls made in their account for compliance purposes. Which AWS service should they enable?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity for auditing and compliance. Option A (Amazon CloudWatch Logs) is incorrect as it is a log management service but does not record API calls. Option B (AWS Config) is incorrect because it tracks resource configuration changes, not API calls. Option D (Amazon GuardDuty) is incorrect because it is a threat detection service, not a comprehensive API audit trail.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 19

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

Accepted Answer

You can use AWS Organizations to centrally manage accounts and use StackSets with trusted access.. AWS Organizations can centrally manage accounts, and StackSets can be enabled with trusted access to deploy stacks across accounts. Option D is correct because AWS CloudFormation StackSets allow deploying stacks across multiple accounts. Option B is incorrect because CloudFormation cannot automatically create new AWS accounts. Option C is incorrect because nested stacks operate within a single stack and cannot deploy resources across different accounts from a single template. Option E is incorrect because cross-stack references only work within the same account and region.

Answer

CloudFormation can automatically create new AWS accounts using a template.

Answer

Nested stacks can be used to deploy resources in different accounts from a single template.

Answer

You can use cross-stack references to share resources between accounts.

Question 20

A company wants to automatically detect and respond to suspicious activity in their AWS account. Which service should be used to generate alerts based on threat intelligence?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using threat intelligence. Inspector is for vulnerability scanning. Config is for resource configuration. CloudWatch is for monitoring metrics and logs but does not have built-in threat intelligence.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon CloudWatch