DOP-C02 Practice Test 23 — 15 Questions

Question 1

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Which TWO steps must be taken to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a statement to the KMS key policy that allows CloudWatch Logs to use the key.. To encrypt CloudWatch Logs at rest with a customer-managed KMS key, you must add a statement to the KMS key policy granting CloudWatch Logs permission to use the key (option B). Then, use the put-log-group-encryption API to associate the KMS key with the log group (option E). Option C is incorrect because CloudWatch Logs uses key policies, not grants. Option D is incorrect because you specify the key ARN at the log group level, not per log stream. Option A is incorrect because you do not need to recreate the log group; you can associate the key with an existing log group.

Answer

Recreate the log group after associating the key.

Answer

Create a KMS grant to allow CloudWatch Logs to use the key.

Answer

Specify the KMS key ARN when creating each log stream.

Question 2

A company uses Amazon CloudWatch Logs to centralize logs from multiple EC2 instances running a web application. The DevOps team needs to create a metric filter that parses logs for HTTP status codes (e.g., 4xx and 5xx) and increment a metric. Additionally, they need to create a CloudWatch alarm on the error count. Which of the following are required to achieve this? (Select TWO.)

Accepted Answer

Define the metric filter pattern to match HTTP status codes in the log entries.. The correct answers are B and C. A metric filter must be defined on a log group (option C) to extract metrics, and the filter pattern must match the HTTP status codes in the log entries (option B). Option A is not required because CloudWatch Logs can publish metrics without an additional IAM role; the log group already has sufficient permissions. Option D is incorrect because subscription filters are for streaming logs to other destinations, not for creating metrics. Option E is not required because the CloudWatch Logs agent or the unified CloudWatch agent can send logs, but the question does not specify which agent; the default agent suffices.

Answer

Create an IAM role that allows CloudWatch Logs to read the log data and publish metrics.

Answer

Configure a subscription filter to forward the logs to a Lambda function that creates the metric.

Answer

Install the CloudWatch Agent on the EC2 instances to send the logs.

Question 3

A company's Security team wants to detect and alert on the creation of IAM users with console access. Which THREE services should be used?

Accepted Answer

AWS CloudTrail. CloudTrail logs the CreateUser and CreateLoginProfile API calls. CloudWatch Logs can receive CloudTrail logs and create metric filters. CloudWatch Alarms can trigger on the metric. Config can track resource changes but not as efficient for alerting on API calls. GuardDuty does not specifically focus on IAM user creation.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 4

A company is designing a resilient architecture for a web application using AWS Global Accelerator and two Application Load Balancers in different AWS Regions. The application is stateless and uses a global DynamoDB table for data. What is the primary benefit of using Global Accelerator in this architecture?

Accepted Answer

It provides static IP addresses and automatically routes traffic to the closest healthy ALB, improving availability and performance.. Global Accelerator provides static IP addresses and directs traffic to the nearest healthy endpoint, improving resilience and performance. Option A is wrong because Global Accelerator does not cache content. Option C is wrong because DNS routing is not the primary benefit; Global Accelerator uses anycast. Option D is wrong because Global Accelerator does not replace ALB; it works with ALBs.

Answer

It replaces the need for an Application Load Balancer.

Answer

It provides DNS-based failover between Regions.

Answer

It caches static content at AWS edge locations.

Question 5

A company uses AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific attribute in their SAML assertion can decrypt the data. Which KMS key policy should be used?

Accepted Answer

Modify the KMS key policy to include a condition that allows kms:Decrypt only if the SAML assertion contains the specific attribute.. KMS key policies are resource-based policies that can use IAM condition keys. To enforce a requirement based on a SAML assertion, you must first configure the IAM role's trust policy to map the SAML attribute to a session tag using sts:TagSession. Then, the KMS key policy can include a condition such as aws:PrincipalTag/attribute_name to allow kms:Decrypt only when that session tag matches the expected value. This ensures compliance at the key level, independent of S3 bucket policies. Note that saml:sub and other SAML condition keys are not supported in KMS key policies; they are only valid in IAM trust policies.

Answer

Create an S3 bucket policy that denies kms:Decrypt unless the request includes a specific tag.

Answer

Attach a resource-based policy to the S3 bucket that allows decryption only for users with the specific attribute.

Answer

Use an IAM policy that grants kms:Decrypt only if the user has the specific attribute.

Question 6

A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?

Accepted Answer

Upload the recipe to a custom cookbook repository and assign it to the 'Configure' lifecycle event in the stack settings.. In AWS OpsWorks, lifecycle events (such as Configure) are tied to layers, not individual instances. To run a custom recipe on all instances during the Configure event, you must upload the recipe to a custom cookbook repository (e.g., S3 or Git) and then assign that recipe to the Configure lifecycle event in the stack's layer settings. This ensures OpsWorks Chef runs the recipe on every instance in that layer whenever the Configure event fires (e.g., after scaling or instance state changes).

Answer

Modify the stack's CloudFormation template to include the recipe.

Answer

Add the recipe commands to the instance's user data script.

Answer

Use AWS CodeDeploy to trigger the recipe during the Configure event.

Question 7

A DevOps engineer runs the command above to retrieve CPU utilization for an EC2 instance, but gets no data points. The instance is running and has basic monitoring enabled. What is the most likely reason?

Accepted Answer

The IAM user executing the command lacks 'cloudwatch:GetMetricStatistics' permission.. The command likely fails because the IAM user executing it does not have the 'cloudwatch:GetMetricStatistics' permission. Basic monitoring publishes CPUUtilization metrics every 5 minutes (300 seconds), so a period of 300 seconds is valid. The dimension name 'InstanceId' is correct as shown. Option A is wrong because the dimension name is case-sensitive and 'InstanceId' is correct. Option B is wrong because basic monitoring is enabled by default and publishes CPUUtilization. Option C is wrong because 300 seconds equals the default 5-minute interval, which is the minimum supported period for basic monitoring.

Answer

The dimension name should be 'InstanceId' with a different case.

Answer

The instance has basic monitoring disabled.

Answer

The period of 300 seconds is less than the minimum supported period.

Question 8

A company uses AWS OpsWorks for configuration management. The operations team needs to apply a configuration change to all instances in a layer without downtime. Which approach should they use?

Accepted Answer

Use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command'.. The correct approach is to use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command'. This allows applying configuration changes to all instances in the layer without downtime, as OpsWorks executes the recipe on each instance without requiring instance recreation. Option B is incorrect because Auto Scaling lifecycle hooks are used to execute actions during instance launch or termination, not for runtime configuration updates. Option C is incorrect because cloning a layer creates a new layer and does not apply changes to existing instances; switching traffic would involve additional steps and potential downtime. Option D is incorrect because manually SSHing into each instance is error-prone, not scalable, and violates best practices for configuration management.

Answer

Use an Auto Scaling lifecycle hook to apply the change during instance launch.

Answer

Clone the layer and update the clone with the new configuration, then switch traffic.

Answer

SSH into each instance and manually apply the change.

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all accounts automatically forward their CloudWatch Logs to a central logging account. Which solution should the team implement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a subscription filter and Lambda function in each account. AWS CloudFormation StackSets allows you to deploy infrastructure components across multiple accounts and regions in an AWS Organization. In this case, you can create a StackSet that includes a CloudWatch Logs subscription filter and a Lambda function to forward logs from each account to a central logging account. The subscription filter triggers the Lambda function to forward logs to a destination in the central account. This ensures all accounts automatically forward their CloudWatch Logs. Option A is incorrect because AWS Config aggregator aggregates configuration and compliance data, not logs. Option B is incorrect because AWS Service Catalog is used to create and manage IT service catalogs for approved products, not for log forwarding. Option D is incorrect because AWS Organizations does not have a native capability to forward logs; it manages policies and account structure.

Answer

Enable AWS Config aggregator in the central account

Answer

Use AWS Service Catalog to create a product for log forwarding

Answer

Configure AWS Organizations to automatically forward logs

Question 10

A company's production EC2 instance running a web application becomes unresponsive. The operations team checks CloudWatch metrics and sees a CPU Utilization spike to 100% for the last 10 minutes. What is the MOST efficient first step to restore service?

Accepted Answer

Reboot the EC2 instance from the AWS Management Console or CLI. Rebooting the EC2 instance is the most efficient first step to restore service when the instance is unresponsive due to a CPU spike. A reboot can quickly resolve transient software issues or resource exhaustion without data loss. Option A (checking CloudWatch Logs) delays recovery—investigation should come after restoration. Option B (creating an AMI and launching a new instance) is time-consuming and unnecessary for initial recovery. Option D (terminating and launching a new instance) risks data loss and is more drastic than rebooting.

Answer

Check the instance's system logs in CloudWatch Logs to identify the root cause

Answer

Create an AMI of the instance and launch a new instance from that AMI

Answer

Terminate the instance and launch a new one from the latest AMI

Question 11

A DevOps team needs to monitor failed API calls in their AWS account. They want to receive notifications when specific IAM actions, such as DeleteBucket, fail. Which service should they use?

Accepted Answer

AWS CloudTrail and Amazon EventBridge.. AWS CloudTrail captures API calls, and Amazon EventBridge (formerly CloudWatch Events) can be used to create rules that match specific failed API calls (e.g., DeleteBucket) and trigger notifications. Option B is incorrect because AWS Config rules monitor resource configuration compliance, not API call failures. Option C is incorrect because S3 server access logs log requests made to an S3 bucket, not IAM API calls. Option D is incorrect because CloudWatch Logs and metric filters are used to monitor log data, but they are not the primary service for capturing API calls; CloudTrail is needed for that.

Answer

AWS Config rules.

Answer

Amazon S3 server access logs.

Answer

CloudWatch Logs and metric filters.

Question 12

Drag and drop the steps to set up an AWS CodePipeline with a source stage from CodeCommit and a deploy stage to Elastic Beanstalk.

Accepted Answer

Create S3 bucket, then create CodeCommit repository and push code, then create pipeline, then configure source, then configure deploy.. The correct order is: first create the S3 bucket for artifacts, then create the CodeCommit repository and push code, then create the pipeline, then configure source, then configure deploy.

Answer

Create pipeline, then create S3 bucket, then create CodeCommit repository and push code, then configure source, then configure deploy.

Answer

Configure source, then configure deploy, then create S3 bucket, then create CodeCommit repository and push code, then create pipeline.

Answer

Create CodeCommit repository and push code, then create S3 bucket, then create pipeline, then configure deploy, then configure source.

Question 13

A company's application runs on EC2 instances in a single Availability Zone. The operations team wants to improve resilience without redesigning the application. Which action is the MOST effective?

Accepted Answer

Deploy EC2 instances across multiple Availability Zones using an Auto Scaling group.. Deploying EC2 instances across multiple Availability Zones (AZs) using an Auto Scaling group is the most effective action because it eliminates the single point of failure at the AZ level. If one AZ experiences an outage, the Auto Scaling group automatically launches replacement instances in the remaining healthy AZs, ensuring application availability without requiring any application-level changes. This directly addresses the goal of improving resilience by leveraging AWS's fault-isolated infrastructure.

Answer

Use a larger instance type to handle more traffic.

Answer

Enable EC2 Auto Recovery to automatically restart the instance if it fails.

Answer

Place the instance in a placement group to ensure low latency.

Question 14

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. During a security incident, the security team needs to isolate a compromised instance for forensic analysis without affecting the application's availability. What is the MOST effective action to take?

Accepted Answer

Deregister the instance from the target group and stop the instance for forensic analysis.. Deregistering the instance from the target group removes it from the Application Load Balancer's routing, ensuring no new traffic is sent to it while existing connections drain (connection draining). Stopping the instance preserves its memory and disk state for forensic analysis without impacting application availability, as the remaining healthy instances continue to serve traffic.

Answer

Modify the security group of the instance to deny all inbound and outbound traffic.

Answer

Terminate the compromised instance immediately to prevent further damage.

Answer

Change the subnet route table to route traffic away from the compromised instance.

Question 15

A company wants to automate the recovery of an Amazon RDS DB instance in a different region if the primary region becomes unavailable. Which service should they use?

Accepted Answer

RDS cross-region automated backups.. RDS cross-region automated backups can be restored to a different region. Option A is incorrect because RDS Multi-AZ only provides failover within the same region. Option C is incorrect because read replicas can be promoted but require manual intervention. Option D is incorrect because RDS does not support CloudFormation for automated recovery across regions.

Answer

RDS Multi-AZ deployment.

Answer

RDS read replicas.

Answer

AWS CloudFormation custom resource.