DOP-C02 Practice Test 21 — 15 Questions

Question 1

A DevOps engineer needs to automate the creation of an AWS CodeStar project for a new microservice. The engineer wants to use AWS CloudFormation to define the project and its resources. Which CloudFormation resource should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS::CodeStar::Project. AWS::CodeStar::Project is the correct CloudFormation resource because it directly creates an AWS CodeStar project, which is a project management hub that integrates AWS services like CodeCommit, CodeBuild, CodeDeploy, and CodePipeline for continuous delivery. This resource allows you to define the project template, source repository, and other settings in a single CloudFormation stack, automating the entire CodeStar project creation.

Answer

AWS::ServiceCatalog::CloudFormationProduct

Answer

AWS::CodePipeline::Pipeline

Answer

AWS::CodeBuild::Project

Question 2

A company is designing a disaster recovery (DR) strategy for a stateless web application deployed on Amazon ECS with Fargate. The application is fronted by an Application Load Balancer (ALB) and uses Amazon ElastiCache for Redis for session state. The primary region is us-east-1. The DR plan requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Deploy an ALB with a warm standby ECS service in us-west-2. Use Route 53 health checks to route traffic to the secondary region if primary fails. Use ElastiCache Global Datastore for Redis to replicate data across regions.. It uses ElastiCache Global Datastore for Redis, which provides cross-region replication with an RPO of seconds (well within 15 minutes) and automatic failover, minimizing operational overhead. The warm standby ECS service in us-west-2 with Route 53 health checks allows traffic to be redirected within the 30-minute RTO without manual intervention, as the ALB and ECS service are pre-provisioned.

Answer

Deploy an Active-Active configuration across two AWS regions using Route 53 latency routing. Use ElastiCache for Redis Global Datastore with multi-region writes.

Answer

Deploy a Pilot Light environment in us-west-2 with a scaled-down ECS service and Redis cluster. Use Route 53 DNS failover. On disaster, scale up the ECS service and promote the Redis cluster.

Answer

Use Amazon ECS with Fargate in us-east-1 only, and schedule daily snapshots of ElastiCache for Redis. In case of disaster, restore the snapshot in a new region and update DNS.

Question 3

A company runs a stateful web application on EC2 instances behind an ALB. The application stores session data in memory. The company wants to make the application stateless to improve resilience. Which TWO changes should the company make?

Accepted Answer

Disable sticky sessions on the ALB. To make the application stateless, the company should disable sticky sessions on the ALB (option B) and store session data in Amazon ElastiCache for Redis (option D). Disabling sticky sessions ensures that requests can be routed to any instance, and storing session data externally removes the dependency on in-memory state on individual instances, improving resilience. Option A is incorrect because increasing instance memory does not solve the statefulness issue. Option C is incorrect because enabling sticky sessions would maintain state on instances. Option E is incorrect because using an NLB does not address session state management.

Answer

Increase the instance memory to store more sessions

Answer

Enable sticky sessions (session affinity) on the ALB

Answer

Use an NLB instead of an ALB

Question 4

A DevOps engineer notices that a CodePipeline execution fails at the deploy stage when deploying a Lambda function using AWS CloudFormation. The error message indicates that the stack update failed because the Lambda function's code is too large. What is the most likely cause?

Accepted Answer

The Lambda function deployment package exceeds the maximum allowed size for Lambda.. The error message explicitly states that the Lambda function's code is too large, which directly points to the Lambda deployment package exceeding the maximum allowed size. AWS Lambda has a hard limit of 50 MB for zipped direct uploads (or 250 MB for container images), and CloudFormation will fail the stack update if the package exceeds this limit during a deploy stage.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to update the Lambda function.

Answer

The CloudFormation template exceeds the maximum size limit for templates.

Answer

The artifact stored in the pipeline's S3 bucket exceeds the maximum allowed size for CodePipeline artifacts.

Question 5

A company uses AWS CodePipeline with a GitHub source action. The pipeline triggers on changes to the master branch. However, the pipeline does not trigger when changes are pushed to the master branch. What is the MOST likely cause?

Accepted Answer

The webhook in GitHub is not properly configured or has been removed.. The most likely cause is that the webhook in GitHub is not properly configured or has been removed. CodePipeline relies on a webhook to automatically detect changes in the GitHub repository. If the webhook is missing or misconfigured, the pipeline will not trigger on pushes. Option A is incorrect because the pipeline uses the master branch as specified. Option B is incorrect because AWS regions are independent of GitHub; the webhook is not region-specific. Option D is incorrect because pipeline permissions are not required for the webhook to function; the webhook itself is the key mechanism for triggering.

Answer

The pipeline uses a different branch name.

Answer

The GitHub repository is not in the same AWS region as the pipeline.

Answer

The pipeline does not have permission to access the GitHub repository.

Question 6

A company's security team suspects that an attacker has compromised an IAM user's access keys. The keys were used to launch instances in an unauthorized region. What is the FASTEST way to mitigate the threat?

Accepted Answer

Rotate the access keys immediately.. Rotating the access keys immediately invalidates the compromised keys, preventing further unauthorized use without disrupting the IAM user's other permissions or requiring a full user recreation. This is the fastest mitigation because it directly revokes the attacker's access while allowing the legitimate user to continue using new keys after rotation.

Answer

Delete the IAM user.

Answer

Change the IAM user's password.

Answer

Attach an AWS WAF to block the attacker's IP address.

Question 7

A company experiences an unexpected spike in network traffic to a web application hosted on EC2 instances behind an Application Load Balancer. The DevOps team needs to investigate the source IP addresses generating the traffic. Which AWS service should they use to capture the traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information, including source and destination IPs, ports, and protocols, allowing investigation of source IPs. Option A (CloudWatch Logs) is wrong because it captures application logs, not network traffic. Option B (AWS Config) is wrong because it records resource configuration changes. Option C (CloudTrail) is wrong because it logs API calls, not network traffic.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A DevOps engineer needs to securely store and automatically rotate database credentials for a web application running on Amazon ECS. Which solution should be used?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure rotation. Grant the ECS task IAM role permission to retrieve the secret.. AWS Secrets Manager can store database credentials and automatically rotate them on a schedule. The ECS task can retrieve the credentials using the Secrets Manager secret. Option C is correct. Option A (AWS KMS) is for encryption keys, not credential rotation. Option B (SSM Parameter Store) can store secrets but does not support automatic rotation. Option D (AWS Certificate Manager) is for SSL/TLS certificates.

Answer

Use AWS KMS to generate and rotate a data key for encrypting the credentials in a file on ECS.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString. Use a Lambda function to rotate them.

Answer

Use AWS Certificate Manager to store the credentials as a certificate.

Question 9

A company's security policy requires that all data stored in Amazon S3 must be encrypted at rest using server-side encryption with customer-managed keys (SSE-KMS). When uploading an object via the AWS CLI, which parameter must be included to enforce this?

Accepted Answer

--server-side-encryption aws:kms. The correct parameter to enforce server-side encryption with AWS KMS (SSE-KMS) when uploading an object via the AWS CLI is --server-side-encryption aws:kms, which corresponds to option D. Option A is incorrect because --kms-key-id only specifies the key ID but does not enable encryption by itself; it must be combined with --server-side-encryption aws:kms. Option B is incorrect because --sse AES256 is not a valid AWS CLI parameter; the correct parameter for SSE-S3 is --server-side-encryption AES256. Option C is incorrect because --encryption is not a valid AWS CLI parameter for server-side encryption.

Answer

--kms-key-id <key-id>

Answer

--sse AES256

Answer

--encryption aws:kms

Question 10

A company wants to ensure that all API calls made within its AWS account are logged for auditing purposes. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, making it the correct choice. Option A is incorrect because AWS Config tracks resource configuration changes, not API calls. Option C is incorrect because CloudWatch Logs is for log storage and monitoring, not for recording API calls. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 11

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team needs to search and analyze logs from multiple EC2 instances in real time. Which TWO services can be used to achieve this? (Choose TWO.)

Accepted Answer

Amazon OpenSearch Service.. CloudWatch Logs can stream logs to Amazon OpenSearch Service for real-time search and analytics. Option E is correct because CloudWatch Logs Insights allows real-time querying of log groups directly within CloudWatch. Option B is incorrect: Amazon Athena is designed for querying data in S3, not for real-time log search from EC2 instances. Option C is incorrect: Amazon QuickSight is a business intelligence service for visualization, not real-time log search. Option D is incorrect: Amazon Kinesis Data Analytics is for analyzing streaming data, not directly searching CloudWatch Logs.

Answer

Amazon Athena.

Answer

Amazon QuickSight.

Answer

Amazon Kinesis Data Analytics.

Question 12

A DevOps engineer notices that an EC2 instance running a web application is unresponsive. CloudWatch alarms are not triggering. What is the FIRST step the engineer should take to diagnose the issue?

Accepted Answer

Review the EC2 instance system log and CloudWatch Logs for error messages.. When an EC2 instance is unresponsive but CloudWatch alarms are not triggering, the first diagnostic step is to check the instance system log (console output) and CloudWatch Logs for error messages. This approach follows the principle of gathering evidence before taking action, as the logs may reveal application crashes, kernel panics, or resource exhaustion that caused the unresponsiveness without breaching CloudWatch alarm thresholds.

Answer

Terminate the instance and launch a new one from the latest AMI.

Answer

Restart the EC2 instance immediately to restore service.

Answer

Create a new CloudWatch alarm with a lower threshold to get alerted quicker next time.

Question 13

An organization wants to grant cross-account access to an S3 bucket in Account A to a user in Account B. Which policy configuration is required?

Accepted Answer

A bucket policy in Account A and an IAM user policy in Account B. Cross-account access to an S3 bucket requires both a resource-based policy (bucket policy) on the bucket in Account A granting access to the user in Account B, and an identity-based policy (IAM user policy) in Account B allowing the user to access the bucket. Option A correctly includes both policies. Option B is incorrect because S3 bucket ACLs are legacy and not recommended for cross-account access. Option C is missing the bucket policy in Account A, so it is insufficient. Option D is missing the IAM user policy in Account B, so it is insufficient.

Answer

An S3 bucket ACL granting access to the user in Account B

Answer

An IAM user policy in Account B allowing access to the bucket

Answer

A bucket policy in Account A granting access to the user in Account B

Question 14

A company's production environment consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances run a web application that stores session data in an ElastiCache Redis cluster. The company has enabled detailed CloudWatch metrics and set up a dashboard. The operations team notices that the average CPU utilization across the Auto Scaling group spikes to 95% every 15 minutes, coinciding with a high number of Redis connections. What is the MOST likely cause?

Accepted Answer

The ALB has session stickiness enabled, causing traffic to be routed to the same instances.. ALB session stickiness (sticky sessions) causes the load balancer to route requests from the same client to the same EC2 instance. When a large number of clients connect simultaneously (e.g., due to a periodic batch job), they may all be routed to the same few instances, causing CPU spikes on those instances. The high number of Redis connections corresponds to the sessions being stored in Redis. This explains the 15-minute periodic spikes. Option A is incorrect because Memcached is not used; the question states ElastiCache Redis. Option B is incorrect because the scaling policy is based on CPU utilization, not memory. Option D is incorrect because the cluster size doesn't cause periodic spikes; it would cause consistent high utilization.

Answer

The application is using Memcached instead of Redis, causing increased load.

Answer

The Auto Scaling group's scaling policy is based on memory utilization instead of CPU.

Answer

The ElastiCache cluster is not large enough to handle the number of requests.

Question 15

A DevOps engineer is troubleshooting an issue where an EC2 instance running a web application becomes unresponsive every few hours. CloudWatch logs show no application errors, but the instance's status checks are passing. The engineer suspects a memory leak. Which AWS service can be used to capture memory utilization metrics at a granular level to confirm the leak?

Accepted Answer

CloudWatch Agent. The CloudWatch Agent can be installed on EC2 instances to collect custom metrics such as memory usage and send them to CloudWatch, allowing granular monitoring. Option A is incorrect because EC2 Status Checks only verify system status (e.g., network reachability). Option B is incorrect because AWS Config tracks configuration changes, not performance metrics. Option C is incorrect because CloudTrail records API activity, not system metrics.

Answer

EC2 Status Checks

Answer

AWS Config

Answer

AWS CloudTrail