DOP-C02 Practice Test 24 — 15 Questions

Question 1

A security audit reveals that an IAM user has long-term access keys that have not been rotated in over 90 days. What is the most secure way to enforce key rotation?

Accepted Answer

Use IAM roles instead of long-term access keys.. A custom Lambda function to rotate keys requires you to build and maintain the rotation logic, permission grants, and secret distribution yourself - AWS IAM has no native, built-in automatic key-rotation feature for access keys, so this approach is at best a partial mitigation with real engineering overhead, and it still leaves long-term static credentials in play between rotations. IAM roles are the superior fix because they remove the need for any long-term key or rotation logic at all.

Answer

Use an AWS Lambda function to automatically rotate keys.

Answer

Manually rotate keys every 90 days.

Answer

Delete the user and create a new one.

Question 2

A DevOps engineer needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (option A) is the correct service because it records API calls made to AWS services for auditing, governance, and compliance. Option B (AWS Config) is used to evaluate resource configurations against desired policies, not to record API calls. Option C (VPC Flow Logs) captures network traffic information at the VPC level. Option D (Amazon CloudWatch Logs) is a service for storing and monitoring log files from various sources, but does not itself record API calls.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 3

A development team uses AWS CodePipeline with multiple stages including source, build, and deploy. The pipeline uses an Amazon S3 source action that triggers on changes to a specific bucket. Recently, the pipeline stopped triggering automatically. The IAM role for CodePipeline has the necessary permissions. What is the most likely cause?

Accepted Answer

AWS CloudTrail is not configured to deliver S3 data events to CloudWatch Logs.. CodePipeline's S3 source action does not rely on S3 event notifications to trigger pipeline executions. Instead, it uses Amazon CloudWatch Events (now Amazon EventBridge) to detect changes to the S3 bucket. For this to work, AWS CloudTrail must be configured to deliver S3 data events (specifically `PutObject` API calls) to CloudWatch Logs, which then generates the event that triggers the pipeline. Without CloudTrail data event logging, CodePipeline cannot detect object uploads, even if the IAM role has proper permissions.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The S3 bucket policy denies access to CodePipeline.

Answer

The S3 bucket does not have event notifications configured.

Question 4

A DevOps team is troubleshooting a CloudFormation stack creation failure. The stack uses a service role with the trust policy shown in the exhibit. The error message states: 'Insufficient permissions to create the resource'. Which action should the team take to resolve this issue?

Accepted Answer

Attach IAM policies to the service role that grant permissions to create the resources.. The error 'Insufficient permissions to create the resource' indicates that the service role used by CloudFormation lacks the necessary IAM permissions to perform the resource creation actions. The trust policy shown in the exhibit allows CloudFormation to assume the role, but the role itself must have IAM policies attached that grant the required permissions (e.g., ec2:*, s3:*). Option D is correct because attaching the appropriate IAM policies to the service role resolves the permission issue.

Answer

Modify the CloudFormation template to use the user's IAM role instead of a service role.

Answer

Create a new stack policy that allows the required actions.

Answer

Add the user's IAM role to the trust policy.

Question 5

A company uses AWS Lambda functions to process events from Amazon SQS. Recently, the Lambda function has been throttled, causing messages to accumulate in the dead-letter queue (DLQ). The function’s reserved concurrency is set to 100, and the account’s regional concurrency limit is 1000. What is the MOST likely cause of the throttling?

Accepted Answer

The function’s concurrency is fully utilized due to long-running invocations. The most likely cause of throttling is that the function's reserved concurrency of 100 is fully utilized due to long-running invocations. When invocations take longer to complete, they occupy concurrency for an extended period, preventing new invocations from starting. This leads to messages accumulating in the DLQ. Option D is incorrect because reserved concurrency of 100 is well below the account limit of 1000, so that is not the cause. Option B is incorrect because cold starts cause latency but not throttling; they do not consume concurrency. Option C is incorrect because the queue type (standard vs. FIFO) does not directly cause throttling; Lambda can process from both.

Answer

The Lambda function has a cold start issue

Answer

The SQS queue is not configured as a FIFO queue

Answer

The reserved concurrency is set too high, exceeding the account limit

Question 6

A development team uses AWS CodeCommit as a Git repository. They want to automatically trigger a build in AWS CodeBuild whenever a pull request is created or updated. Which AWS service should be used to detect the pull request events and start the build?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture CodeCommit repository events, such as pull request creation and updates, via its event bus. By setting up an EventBridge rule that matches these specific events, you can directly trigger an AWS CodeBuild project as a target, enabling automated builds without additional orchestration services.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS CodePipeline

Answer

Amazon CloudWatch Logs

Question 7

Match each AWS security and identity service to its function.

Accepted Answer

IAM: Manage user identities and permissions. IAM handles access control, AWS Organizations manages multi-account structure, and AWS Shield protects against DDoS attacks. The distractors incorrectly swap these definitions.

Answer

IAM: Protect against DDoS attacks

Answer

AWS Organizations: Manage user identities and permissions

Answer

AWS Shield: Centrally manage multiple AWS accounts

Question 8

Which TWO actions should be taken to ensure a highly available and resilient architecture for a critical web application on AWS? (Choose two.)

Accepted Answer

Use an Auto Scaling group to maintain a desired number of instances.. Correct: B and E. Option B ensures that the desired number of EC2 instances is maintained, providing automatic scaling and fault tolerance. Option E deploys the application across multiple Availability Zones, which protects against an AZ failure. Option A (CloudFront) enhances content delivery but does not directly ensure high availability of the web application. Option C (Multi-AZ RDS with read replicas) improves read performance and provides disaster recovery, but write availability depends on the primary instance. Option D (backups in a different region) is for disaster recovery, not for immediate availability.

Answer

Enable Amazon CloudFront with multiple origins.

Answer

Use a Multi-AZ RDS deployment with read replicas.

Answer

Store backups in a different AWS Region.

Question 9

A company uses AWS Systems Manager to patch EC2 instances. After a patch window, several instances are unreachable. The engineer checks the SSM Agent logs and finds no errors. What should the engineer do next to diagnose the issue?

Accepted Answer

Check if the instances have outbound internet connectivity to the SSM endpoints.. The SSM Agent requires outbound internet connectivity to the Systems Manager endpoints (or AWS PrivateLink if configured) to communicate with the service. If the patch window or a security group change blocks this connectivity, instances become unreachable despite the agent logs showing no errors. Option A is wrong because restarting the agent does not help if the issue is network connectivity. Option B is wrong because the patch baseline association defines which patches to apply, not connectivity. Option C is wrong because IAM permissions are likely correct since the agent logs show no errors; the issue is network-related, not permissions.

Answer

Restart the SSM Agent on the affected instances.

Answer

Verify that the patch baseline is associated with the instances.

Answer

Review the IAM role attached to the instances for sufficient permissions.

Question 10

A company uses Amazon Route 53 for DNS. They want to ensure that if their primary website endpoint fails, traffic is automatically routed to a secondary endpoint in a different Region. Which routing policy should be used?

Accepted Answer

Failover routing. Failover routing policy allows you to configure an active-passive failover setup.

Answer

Latency routing

Answer

Simple routing

Answer

Weighted routing

Question 11

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Fargate tasks require network connectivity to pull container images from ECR (or Docker Hub) and to send logs to CloudWatch. Without a route to a NAT Gateway (for private subnets) or an Internet Gateway (for public subnets), the task cannot pull the image and fails to start. Option B is incorrect: while the image must exist, the immediate symptom of tasks failing to start when the image is missing would be an 'image not found' error, not a generic failure; the security group already allows inbound traffic on port 8080, but outbound connectivity is the issue. Option C is incorrect: insufficient CPU/memory would cause tasks to enter a 'CPU exhausted' or 'memory exhausted' state, not prevent them from starting entirely. Option D is incorrect: the security group allows inbound traffic, but the issue is about egress connectivity for the task to reach the image registry.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.

Question 12

An organization uses AWS Key Management Service (KMS) with customer-managed keys. The security policy requires automatic key rotation every year. A DevOps engineer notices that the key material is not rotating as expected. What is the most likely cause?

Accepted Answer

The key was created by importing key material; automatic rotation is not supported for imported keys.. Automatic key rotation is not supported for imported key material. Option B is wrong because KMS does not charge extra for automatic rotation. Option C is wrong because KMS does not require re-importing for rotation; it's simply not available. Option D is wrong because the key state does not prevent rotation.

Answer

The key must be re-imported annually to enable rotation.

Answer

The key is not enabled for rotation due to a billing limit.

Answer

The key is in a 'Pending Deletion' state and cannot be rotated.

Question 13

A company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS Multi-AZ database. The DevOps team has configured the EC2 instances to send application logs to CloudWatch Logs using the CloudWatch agent. They also set up a CloudWatch alarm on the ALB's 5xx error count. During a recent deployment, the team noticed that the alarm did not trigger even though the application was returning 5xx errors. The team verified that the CloudWatch agent is running on the instances and logs are appearing in CloudWatch Logs. What should the team do to ensure the alarm triggers correctly?

Accepted Answer

Verify that the CloudWatch alarm is using the correct metric 'HTTPCode_Target_5XX_Count' and that the threshold is appropriate.. The ALB publishes two separate 5xx metrics: HTTPCode_ELB_5XX_Count (errors generated by the load balancer itself, e.g., 503 due to no healthy targets) and HTTPCode_Target_5XX_Count (errors returned by the backend targets). Since the application is returning 5xx errors from the EC2 instances, the alarm should use HTTPCode_Target_5XX_Count. The team likely set the alarm on HTTPCode_ELB_5XX_Count, which would not trigger for backend errors. Option A is not the best because creating a log-based metric filter would create a separate alarm and does not fix the existing ALB alarm. Option B is wrong because switching to HTTPCode_ELB_5XX_Count still tracks the wrong metric. Option C is unrelated because the agent is already working and logs are flowing.

Answer

Create a metric filter on the EC2 instance's log group to count 5xx errors and create an alarm on that.

Answer

Change the CloudWatch alarm to use the 'HTTPCode_ELB_5XX_Count' metric instead.

Answer

Restart the CloudWatch agent on the EC2 instances.

Question 14

A company is running a production application on Amazon ECS with Fargate. The DevOps team needs to monitor the application's performance and set up alerts for high memory usage. Which THREE steps should the team take to achieve this?

Accepted Answer

Create a custom CloudWatch metric and publish memory usage data from the application. Options B, C, and D are correct. To monitor memory usage in ECS Fargate, you must enable the ECS task metadata endpoint (option D), which allows the container to access task metadata and publish custom memory metrics to CloudWatch. Then create a custom CloudWatch metric (option B) and set up a CloudWatch alarm on that metric (option C). Option A is incorrect because CloudWatch does not automatically collect memory metrics from Fargate tasks; custom metrics are required. Option E is incorrect because CloudWatch Container Insights provides visibility into container-level metrics but does not collect memory metrics from Fargate tasks without additional configuration; custom metrics are still needed for memory monitoring.

Answer

Configure CloudWatch to automatically collect memory metrics from Fargate tasks

Answer

Enable Amazon CloudWatch Container Insights for the ECS cluster

Question 15

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They want to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Accepted Answer

Change Sets. Change Sets allow you to preview the proposed changes to a CloudFormation stack before executing them. This enables the DevOps team to review and approve modifications, ensuring that only validated updates are applied. By creating a change set, you can see exactly which resources will be added, modified, or deleted, and then decide whether to execute it.

Answer

Drift detection

Answer

Stack policies

Answer

StackSets