DOP-C02 Practice Exam 4 — 20 Questions

Question 1

Refer to the exhibit. The CloudWatch alarm is set on CPUUtilization. The instance's CPU at 10:00 is 75%, at 10:05 is 82%, and at 10:10 is 85%. Will the alarm trigger?

Accepted Answer

Yes, but only after 10:10 when two consecutive periods are above the threshold.. The alarm evaluates 2 consecutive periods (each 5 minutes). At 10:05, the average for that period is 82% (above 80), but the previous period (10:00) average is 75% (below 80). So only one period is breached. At 10:10, the average for that period is 85% (above 80), and the previous period (10:05) average is 82% (above 80). So two consecutive periods are breached, triggering the alarm.

Answer

Yes, because the CPU exceeded 80% at 10:05.

Answer

No, because the alarm uses Average statistic and the average over the entire time is below 80%.

Answer

No, because the first data point at 10:00 is below the threshold.

Question 2

A company runs a critical application on an Amazon RDS for MySQL DB instance. During a recent incident, the database became unresponsive. The DevOps team suspects that a long-running query is blocking other operations. Which metric should they monitor in Amazon CloudWatch to detect this type of issue?

Accepted Answer

ActiveTransactions (from Enhanced Monitoring). ActiveTransactions (from Enhanced Monitoring). This metric directly shows the number of active transactions, including long-running ones that can hold locks and cause blocking. Monitoring ActiveTransactions helps detect such issues. Option A (DatabaseConnections) indicates the number of connections but not whether they are actively blocking. Option C (ReadLatency) is a symptom of blocking but not a direct indicator. Option D (CPUUtilization) may be high for many reasons and does not specifically point to blocking.

Answer

DatabaseConnections

Answer

ReadLatency

Answer

CPUUtilization

Question 3

A DevOps engineer needs to grant an IAM user temporary access to an S3 bucket for exactly one hour. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is used to generate temporary, limited-privilege credentials for IAM users or federated users. IAM roles provide temporary credentials but are assumed, not generated for a specific user. Cognito is for identity federation with mobile/web apps. SSO provides single sign-on access.

Answer

Amazon Cognito

Answer

AWS SSO

Answer

AWS IAM

Question 4

Refer to the exhibit. An administrator wants to be notified when any EC2 instance is launched in the account. Which combination of services would provide the most efficient and cost-effective solution?

Accepted Answer

Create an Amazon EventBridge rule that matches RunInstances events from CloudTrail and sends to an SNS topic.. CloudTrail logs all API calls. By creating a CloudWatch Events rule (now Amazon EventBridge) that matches the RunInstances event, you can trigger a Lambda function or send to SNS. This is efficient and cost-effective.

Answer

Enable detailed billing reports and create a cost anomaly detection monitor.

Answer

Use AWS Config rules to detect non-compliant instances and trigger an SNS notification.

Answer

Set up a CloudWatch alarm on the RunInstances metric in the EC2 namespace.

Question 5

A company uses AWS Systems Manager to patch EC2 instances. After a patch window, several instances are unreachable. The engineer checks the SSM Agent logs and finds no errors. What should the engineer do next to diagnose the issue?

Accepted Answer

Check if the instances have outbound internet connectivity to the SSM endpoints.. The SSM Agent requires outbound internet connectivity to the Systems Manager endpoints (or AWS PrivateLink if configured) to communicate with the service. If the patch window or a security group change blocks this connectivity, instances become unreachable despite the agent logs showing no errors. Option A is wrong because restarting the agent does not help if the issue is network connectivity. Option B is wrong because the patch baseline association defines which patches to apply, not connectivity. Option C is wrong because IAM permissions are likely correct since the agent logs show no errors; the issue is network-related, not permissions.

Answer

Restart the SSM Agent on the affected instances.

Answer

Verify that the patch baseline is associated with the instances.

Answer

Review the IAM role attached to the instances for sufficient permissions.

Question 6

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?

Accepted Answer

AWS Config and AWS Systems Manager Automation. AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance. EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Question 7

A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the most appropriate service because it is specifically designed to manage secrets like database passwords, with automatic rotation, encryption, and fine-grained access control. Option A (DynamoDB) is a database, not a secrets manager. Option B (S3) can store encrypted data but lacks built-in secret rotation and management. Option C (Systems Manager Parameter Store SecureString) can store secrets but does not support automatic rotation, making Secrets Manager the better choice.

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store (SecureString)

Question 8

A company needs to store audit logs for 7 years to meet compliance requirements. Which S3 storage class is the most cost-effective for long-term archival?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class designed for long-term archival of data that is accessed rarely (once or twice per year) and can tolerate retrieval times of 12-48 hours. For a 7-year compliance retention requirement, it provides the most cost-effective storage compared to S3 Glacier Flexible Retrieval, S3 Intelligent-Tiering, or S3 Standard.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 Glacier Flexible Retrieval

Question 9

An organization needs to audit all AWS API calls made in their account for compliance purposes. Which AWS service should they enable?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity for auditing and compliance. Option A (Amazon CloudWatch Logs) is incorrect as it is a log management service but does not record API calls. Option B (AWS Config) is incorrect because it tracks resource configuration changes, not API calls. Option D (Amazon GuardDuty) is incorrect because it is a threat detection service, not a comprehensive API audit trail.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 10

A DevOps engineer is troubleshooting an issue where an Amazon RDS instance's CPU utilization is consistently high. The engineer has enabled Performance Insights and sees that the top SQL query is a SELECT statement that scans many rows. What is the best course of action to reduce CPU utilization?

Accepted Answer

Add appropriate indexes to optimize the query.. Adding appropriate indexes can reduce the number of rows scanned by the SELECT query, directly reducing CPU utilization. Option A is incorrect: creating a read replica offloads read traffic from the primary instance, but the problematic query would still run on whichever instance it is executed. If the query is still executed on the primary, the CPU remains high. Additionally, the issue is a specific query scanning many rows, not general read load. Option B is incorrect: increasing allocated storage improves I/O performance but does not reduce CPU usage caused by scanning many rows. Option C is incorrect: increasing the DB instance size provides more CPU capacity, but it does not address the root cause of inefficient querying; optimizing the query is a more cost-effective and sustainable solution.

Answer

Create a read replica to offload read traffic.

Answer

Increase the allocated storage to improve I/O.

Answer

Increase the DB instance size to handle the load.

Question 11

An organization uses AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that all instances have the latest security patches applied automatically. Which action should the team take?

Accepted Answer

Configure a custom Chef recipe in OpsWorks to run 'yum update' on a schedule.. The correct action is to configure a custom Chef recipe in OpsWorks to run 'yum update' on a schedule. OpsWorks uses Chef for configuration management, so a custom recipe can be added to a layer's lifecycle events (e.g., Setup or Configure) or scheduled via a cron job within a recipe to ensure all instances apply the latest security patches automatically. Option B is incorrect because AWS Config rules evaluate compliance but do not perform patching; they require a custom remediation action, which is less direct than OpsWorks' built-in Chef integration. Option C is incorrect because updating the AMI only affects new instances launched from that AMI; running instances are not updated. Option D is incorrect because while AWS Systems Manager Patch Manager can patch instances, OpsWorks does not natively integrate with it; managing patches through OpsWorks' Chef recipes is the more appropriate and direct method for OpsWorks-managed instances.

Answer

Create an AWS Config rule to check for missing patches and trigger an auto-remediation.

Answer

Update the AMI used by the OpsWorks layer to include the latest patches.

Answer

Enable AWS Systems Manager Patch Manager to patch all instances managed by OpsWorks.

Question 12

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

Accepted Answer

You can use AWS Organizations to centrally manage accounts and use StackSets with trusted access.. AWS Organizations can centrally manage accounts, and StackSets can be enabled with trusted access to deploy stacks across accounts. Option D is correct because AWS CloudFormation StackSets allow deploying stacks across multiple accounts. Option B is incorrect because CloudFormation cannot automatically create new AWS accounts. Option C is incorrect because nested stacks operate within a single stack and cannot deploy resources across different accounts from a single template. Option E is incorrect because cross-stack references only work within the same account and region.

Answer

CloudFormation can automatically create new AWS accounts using a template.

Answer

Nested stacks can be used to deploy resources in different accounts from a single template.

Answer

You can use cross-stack references to share resources between accounts.

Question 13

A company wants to automatically detect and respond to suspicious activity in their AWS account. Which service should be used to generate alerts based on threat intelligence?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using threat intelligence. Inspector is for vulnerability scanning. Config is for resource configuration. CloudWatch is for monitoring metrics and logs but does not have built-in threat intelligence.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon CloudWatch

Question 14

A DevOps engineer needs to monitor the health of a web application running on EC2 instances behind an Application Load Balancer (ALB). Which TWO metrics from ALB should be monitored to detect application errors? (Choose TWO.)

Accepted Answer

HTTPCode_Target_5XX_Count.. (HTTPCode_Target_5XX_Count) is correct because it counts HTTP 5XX errors returned by the target (EC2 instances), indicating application errors. Option E (TargetResponseTime) is correct because elevated response times can indicate application performance issues or errors, and is a key metric for detecting application problems. Option A (RequestCount) is incorrect because it simply counts total requests, not errors. Option B (HTTPCode_ELB_5XX_Count) is incorrect because it counts 5XX errors generated by the ALB itself (e.g., due to configuration issues), not application errors. Option D (HealthyHostCount) is incorrect because it indicates the number of healthy targets, not application-level errors.

Answer

RequestCount.

Answer

HTTPCode_ELB_5XX_Count.

Answer

HealthyHostCount.

Question 15

Which THREE are valid AWS Systems Manager capabilities for configuration management? (Select THREE.)

Accepted Answer

Run Command. Run Command enables you to manage configuration by remotely executing commands on instances. Patch Manager automates the process of patching managed instances. State Manager helps you define and maintain the desired state of your instances. OpsCenter (B) is an operational data hub for viewing and resolving operational issues, not primarily for configuration management. Parameter Store (C) provides secure storage for configuration data and secrets, but it is a supporting service rather than a configuration management capability itself.

Answer

OpsCenter

Answer

Parameter Store

Question 16

A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)

Accepted Answer

Use CloudWatch Logs Insights to run queries across multiple log groups.. CloudWatch Logs Insights is purpose-built for querying log data across multiple log groups. It uses a query language to search, filter, and aggregate log events, making it ideal for identifying error patterns across different sources. This option is correct because it directly supports cross-log-group queries without additional data movement or infrastructure.

Answer

Install the CloudWatch Logs agent on an EC2 instance and tail the logs.

Answer

Create a Lambda function that reads logs from each log group and searches for the pattern.

Answer

Use Amazon Kinesis Data Analytics to process the log streams.

Question 17

During an incident, an engineer needs to quickly revoke access to a compromised IAM user. Which action should be taken FIRST?

Accepted Answer

Attach an AWS managed policy that explicitly denies all actions (e.g., AWSDenyAll).. Attaching a deny-all policy (e.g., AWSDenyAll) to the IAM user immediately revokes all permissions, including existing sessions, without risk of breaking dependencies. Deleting the user (B) may fail if the user is referenced by resources or logs, and it does not block existing sessions immediately. Disabling signing certificates (C) only affects programmatic access via CLI/SDK, leaving console sessions active. Rotating access keys (D) invalidates old keys but does not affect existing sessions that already have credentials; sessions remain active until they expire. Therefore, the first action should be to apply a deny-all policy to instantly block all actions.

Answer

Delete the IAM user immediately.

Answer

Disable the user's signing certificates.

Answer

Rotate the user's access keys.

Question 18

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. The application is deployed using AWS CodeDeploy with an in-place deployment configuration. During a recent deployment, the deployment failed because the new application version caused a health check failure, and CodeDeploy did not automatically roll back. What should the engineer do to ensure automatic rollback on health check failure?

Accepted Answer

Enable automatic rollback in the CodeDeploy deployment group and set up a CloudWatch alarm for the ALB health check. CodeDeploy can automatically roll back a deployment when a CloudWatch alarm, such as one monitoring ALB health check failures, enters the ALARM state. By enabling automatic rollback in the deployment group and associating the CloudWatch alarm, the deployment will revert to the previous version as soon as the health check fails, without manual intervention.

Answer

Set up an EC2 instance lifecycle hook to trigger a rollback script when the instance enters a pending state

Answer

Configure an Amazon SQS queue to monitor health checks and invoke a rollback Lambda function

Answer

Modify the Auto Scaling group to replace unhealthy instances automatically

Question 19

A company runs a multi-region application on Amazon EC2 instances across us-east-1 and eu-west-1. The application uses an Amazon Aurora global database for writes in us-east-1 and reads in eu-west-1. The DevOps team wants to monitor the replication lag between the primary and secondary regions. They have set up a CloudWatch alarm on the AuroraReplicaLag metric in both regions. However, they notice that the alarm in eu-west-1 sometimes triggers false positives when the lag spikes briefly but then recovers. The team wants to reduce false alarms while still being alerted to sustained high lag that could impact read replicas. The team is already using a standard CloudWatch alarm with a period of 1 minute and evaluation periods of 1. What should the team change to reduce false positives?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if the lag is high for 3 consecutive minutes.. Increasing the number of evaluation periods to 3 means the alarm triggers only after the lag is high for 3 consecutive minutes, reducing false positives from brief spikes. Option A is wrong because raising the threshold would not address the underlying issue of transient spikes; it would simply ignore lower lag values. Option B is wrong because reducing the period to 30 seconds would generate more data points and likely more false alarms due to short-lived spikes. Option D is wrong because a composite alarm with CPUUtilization is not necessary; the focus is on replication lag, and the solution is to adjust evaluation periods.

Answer

Increase the alarm threshold to a higher value, such as 10 seconds.

Answer

Reduce the metric period to 30 seconds to get more granular data.

Answer

Create a composite alarm that triggers when both the AuroraReplicaLag and CPUUtilization metrics are high.

Question 20

Refer to the exhibit. A CloudFormation template deploys a Lambda function with X-Ray tracing enabled. However, traces are not appearing in the X-Ray console. What is the most likely missing configuration?

Accepted Answer

The Lambda execution role does not have permissions to upload trace data to X-Ray.. The Lambda function's execution role must have permissions to upload trace data to AWS X-Ray. The default AWSLambdaBasicExecutionRole only grants CloudWatch Logs permissions. To enable X-Ray tracing, the role needs the AWSXRayDaemonWriteAccess policy or equivalent permissions. Option A is incorrect because the Node.js 18 runtime does support X-Ray tracing. Option C is incorrect because setting TracingConfig to 'Active' is correct for enabling tracing; 'PassThrough' would only send traces if the upstream request was sampled, which is not the issue here. Option D is incorrect because the function code does not need to explicitly use the X-Ray SDK to generate traces; when tracing is enabled at the service level, the X-Ray daemon automatically sends invocation traces. The absence of traces points to a permissions issue, not a missing SDK.

Answer

The Lambda runtime (nodejs18.x) does not support X-Ray tracing.

Answer

The TracingConfig mode is set to 'Active' but should be 'PassThrough'.

Answer

The Lambda function code does not use the AWS X-Ray SDK.