DOP-C02 Practice Test 25 — 15 Questions

Question 1

A DevOps team uses AWS OpsWorks for configuration management. They have a stack with a custom cookbook that installs and configures an application. After updating the cookbook on GitHub, they need to apply the changes to existing instances without creating new ones. What should the team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'Execute Recipes' feature to run the updated custom recipe on the instances.. AWS OpsWorks provides the 'Execute Recipes' feature, which allows you to run a specific recipe from a cookbook on existing instances without requiring a stack update or instance replacement. This is the direct method to apply changes from an updated custom cookbook to running instances, as it triggers Chef to execute the specified recipe immediately on the selected instances.

Answer

Clone the stack and assign the updated cookbook to the new stack.

Answer

Update the layer's custom cookbook settings and then reboot the instances.

Answer

Update the stack's custom cookbook source and click 'Update Dependencies' on the stack.

Question 2

An application running on AWS Lambda is experiencing cold starts. The team wants to monitor the cold start duration. What should they do?

Accepted Answer

Monitor the 'InitDuration' metric in CloudWatch for the Lambda function.. AWS Lambda automatically publishes the 'InitDuration' metric in CloudWatch for cold starts, which measures the time spent initializing the runtime and code. Option B is incorrect because while CloudWatch Logs Insights can query for 'REPORT' lines, it is more complex and unnecessary since the metric is already available. Option C is incorrect because publishing a custom metric from the Lambda code is redundant; the InitDuration metric is automatically provided. Option D is incorrect because AWS X-Ray can trace cold starts, but the dedicated metric is simpler and directly available.

Answer

Use CloudWatch Logs Insights to query log groups for 'REPORT' lines and calculate duration.

Answer

Publish a custom metric from the Lambda code that measures initialization time.

Answer

Enable AWS X-Ray and trace the Lambda invocation to see cold start duration.

Question 3

A company uses AWS Organizations with multiple accounts. The security team requires that all newly created S3 buckets in any account automatically have default encryption enabled and block public access. Which solution is MOST operationally efficient?

Accepted Answer

Apply a service control policy (SCP) that denies creation of buckets without encryption and public access block. The most operationally efficient solution is to use an SCP in AWS Organizations that denies creation of S3 buckets without default encryption and public access block. This enforces the security requirements at the organization level, preventing non-compliant bucket creation across all accounts without additional automation. Option A relies on CloudTrail and Lambda, which is reactive and adds complexity. Option C is manual and not scalable. Option D uses AWS Config to detect non-compliant buckets but requires additional remediation steps, making it less efficient than a preventive SCP.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to apply settings

Answer

Create a bucket policy on each existing bucket and rely on developers to apply it to new buckets

Answer

Use AWS Config rules to detect non-compliant buckets and send notifications

Question 4

A company wants to enable AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team requires that logs be encrypted at rest and that any unauthorized deletion of log files be prevented. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create a trail in the management account that applies to all accounts in the organization.. Enabling CloudTrail for all accounts in the organization ensures centralized logging. Option D is correct because S3 Object Lock prevents deletion of log files. Option B is incorrect because KMS with a customer managed key provides encryption, but the key must be created beforehand, not just enabled. Option C is incorrect because CloudWatch Logs encryption uses KMS, not S3 SSE. Option E is incorrect because CloudTrail can be configured to log management events by default, and this is not about data events.

Answer

Enable default encryption with SSE-S3 on the S3 bucket where CloudTrail delivers logs.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and enable encryption using an AWS KMS key.

Answer

Enable CloudTrail Insights to detect unusual API activity.

Question 5

Which THREE of the following are valid methods to enforce encryption at rest for Amazon EBS volumes? (Choose three.)

Accepted Answer

Enable EBS encryption by default in the account.. Enabling EBS encryption by default at the account level ensures all new volumes are encrypted. You can also encrypt volumes when creating them via the console or CLI. You cannot encrypt an existing volume directly; you must create a snapshot, copy it with encryption, and create a new volume. Attaching a volume does not encrypt it.

Answer

Use the AWS CLI to encrypt an existing volume in place.

Answer

Attach the volume to an EC2 instance and use OS-level encryption.

Question 6

A team uses AWS CodeBuild to run security scans on code before deployment. They want to ensure that if the security scan fails, the build is marked as FAILED and no further pipeline stages execute. What should they add to the buildspec?

Accepted Answer

Use the 'phases' section with a command that exits with a non-zero status on failure.. In AWS CodeBuild, the build process is controlled by the 'phases' section of the buildspec file. Each phase runs a series of commands sequentially, and if any command exits with a non-zero status (e.g., a security scan tool returns a failure exit code), CodeBuild immediately marks the build as FAILED and stops further execution. This ensures that no subsequent pipeline stages are triggered, as the build status propagates to the pipeline.

Answer

Use the 'artifacts' section to define failure conditions.

Answer

Use the 'env' section to set a variable that fails the build.

Answer

Use the 'reports' section to mark the build as failed if tests fail.

Question 7

Given the above AWS CLI command output, which actions are allowed for the specified policy?

Accepted Answer

ec2:DescribeInstances and s3:GetObject are allowed; s3:ListBucket is denied. The simulate-custom-policy command tests the specified policy against the given actions and resources. For ec2:DescribeInstances, the action is allowed because the policy includes ec2:Describe*. For s3:GetObject, the action is allowed because the policy explicitly allows s3:GetObject. For s3:ListBucket, the action is not allowed because the policy only allows s3:GetObject, not s3:ListBucket. Therefore, ec2:DescribeInstances and s3:GetObject are allowed, while s3:ListBucket is denied. Option B is correct.

Answer

Only s3:GetObject is allowed

Answer

Only ec2:DescribeInstances is allowed

Answer

All three actions are allowed

Question 8

A company experiences intermittent high latency for a web application running on EC2 behind an ALB. They want to monitor and automatically replace instances that have high CPU. Which solution meets this requirement?

Accepted Answer

Create a CloudWatch alarm on CPU utilization that triggers an Auto Scaling policy to replace the instance. You can configure a CloudWatch alarm on the EC2 instance's CPU utilization metric, and then use that alarm to trigger an Auto Scaling lifecycle hook or a scaling policy that terminates the unhealthy instance and launches a replacement. This directly ties performance monitoring to automated instance replacement, meeting the requirement to replace instances with high CPU.

Answer

Use Auto Scaling scheduled scaling actions to replace instances at peak times

Answer

Use AWS Lambda to periodically check CPU and terminate high-CPU instances

Answer

Configure the ALB health check to mark instances unhealthy when CPU is high

Question 9

A company uses AWS CloudFormation to manage its infrastructure. The stack creation recently failed because an IAM role resource was created before the AWS Lambda function that depends on it. The template has no DependsOn clauses. What is the most likely reason for this failure and how can it be fixed?

Accepted Answer

Add a DependsOn clause to the Lambda function resource referencing the IAM role. The most likely reason for the failure is that CloudFormation, by default, parallelizes the creation of resources that do not have explicit dependencies. Since the IAM role and Lambda function have no DependsOn clause, CloudFormation may attempt to create the Lambda function before the IAM role is fully created and its permissions are propagated. Adding a DependsOn clause to the Lambda function resource referencing the IAM role ensures that CloudFormation creates the IAM role first, resolving the dependency and preventing the failure.

Answer

Use AWS Systems Manager Automation to create the resources sequentially

Answer

Use a ChangeSet to roll back the stack and modify the template

Answer

Split the template into two separate stacks and use nested stacks

Question 10

A development team uses AWS CodeBuild to compile a Java application. The build takes 15 minutes on average, but recently it started taking over 30 minutes. The buildspec.yml file is unchanged. What is the most likely cause?

Accepted Answer

The cache for the build project was cleared, forcing a full dependency download.. The most likely cause is that the build project's cache was cleared, forcing a full dependency download. CodeBuild can cache dependencies (e.g., Maven local repository) to speed up builds. If the cache is invalidated or cleared, the build must re-download all dependencies from the internet, significantly increasing build time from 15 minutes to over 30 minutes, even though the buildspec.yml is unchanged.

Answer

The build environment was changed from a Linux to a Windows environment.

Answer

The build project's compute type was downgraded to a smaller instance.

Answer

The buildspec.yml file was updated to include more build commands.

Question 11

An organization uses a multi-account AWS environment with AWS Organizations. During an incident, the security team needs to isolate a compromised account by preventing all API calls from that account's root user and IAM users. Which action should be taken?

Accepted Answer

Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.. A service control policy (SCP) is a feature of AWS Organizations that allows you to centrally control permissions for all accounts in your organization. An SCP can be applied to the root of the organization, an OU, or a specific account. When an SCP that denies all actions is applied to an affected account, it restricts permissions for all principals, including the root user and IAM users in that account. This effectively isolates the compromised account by preventing any API calls. Option A is incorrect because creating a new IAM group with a deny-all policy and adding all users would affect only IAM users, not the root user. Option C is incorrect because an IAM policy attached to IAM users does not affect the root user. Option D is incorrect because applying an SCP that denies all actions only to the root user would leave IAM users unrestricted, failing to fully isolate the account.

Answer

Create a new IAM group with a deny-all policy and add all users to it.

Answer

Attach an IAM policy denying all actions to all IAM users in that account.

Answer

Apply an SCP that denies all actions to the root user only.

Question 12

A development team is using AWS CodeCommit as a source control repository. They want to automate the creation of a new feature branch whenever a developer creates a new Jira issue with a specific label. Which AWS service should be used to listen for Jira webhooks and trigger the branch creation?

Accepted Answer

AWS Lambda with Amazon API Gateway to receive the webhook. AWS Lambda with Amazon API Gateway is the correct choice because API Gateway can expose a public HTTPS endpoint that Jira can send webhook POST requests to. The Lambda function then processes the incoming payload, checks for the specific label, and uses the AWS SDK to create a new branch in CodeCommit. This provides a real-time, event-driven integration without polling or scheduled checks.

Answer

Amazon EventBridge to schedule a rule every minute

Answer

AWS CodePipeline to poll for new Jira issues

Answer

AWS CodeBuild to run a build when a webhook is received

Question 13

A company uses AWS Lambda to process messages from an SQS queue. They need to ensure that if the Lambda function fails, the message is not lost and can be processed again. Which configuration is required?

Accepted Answer

Set the Lambda event source mapping to not delete messages from the queue on failure.. The Lambda event source mapping for SQS can be configured to not delete messages from the queue if the function fails. This ensures that the message remains in the queue and becomes visible again after the visibility timeout expires, allowing it to be retried. Without this setting, Lambda automatically deletes messages upon successful processing, but on failure, the default behavior is to delete them as well, which would cause message loss.

Answer

Set the visibility timeout to less than the Lambda function timeout.

Answer

Enable SQS redrive policy to retry messages.

Answer

Configure a dead-letter queue (DLQ) on the SQS queue.

Question 14

A DevOps team is investigating a production incident where an Amazon RDS for MySQL database experienced a sudden spike in connections and CPU utilization. The team suspects a SQL injection attack. Which TWO actions should the team take to investigate and mitigate the incident?

Accepted Answer

Enable automated backups and ensure point-in-time recovery is configured.. Enabling automated backups and point-in-time recovery ensures that the database can be restored to a state before the suspected SQL injection attack, preserving data integrity and enabling forensic analysis. Option C is correct because RDS Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) to correlate with the spike, while audit logs capture actual SQL queries, which are essential for identifying malicious patterns and confirming the attack vector.

Answer

Delete the error logs to free up storage space.

Answer

Create a read replica to offload traffic from the primary instance.

Answer

Increase the DB instance size to handle the increased load.

Question 15

A company runs a containerized application on Amazon ECS with Fargate. The application needs to be resilient to Availability Zone failures. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Configure the ECS service to spread tasks across multiple Availability Zones.. Spreading tasks across multiple Availability Zones ensures that an AZ failure does not impact all tasks, increasing resilience. Option C is correct because using a multi-AZ Amazon RDS or DynamoDB provides persistent data storage that survives AZ failures. Option D is correct because an Application Load Balancer with targets in multiple AZs distributes traffic and can route requests to healthy targets in other AZs if one fails. Option B is wrong because disabling managed service scaling reduces the application's ability to handle load changes and may impact availability. Option E is wrong because a single service discovery namespace does not provide AZ resilience; it only provides service discovery without redundancy across AZs.

Answer

Disable managed service scaling to avoid resource contention.

Answer

Use a single service discovery namespace for all tasks.