DOP-C02 Practice Test 2 — 25 Questions

Question 1

Which THREE actions should a DevOps engineer take to ensure that AWS CloudFormation stacks are securely managed? (Choose three.)

Accepted Answer

Use a service role with least privilege when creating the stack.. Using a service role with least privilege ensures that CloudFormation operates with only the permissions necessary to create, update, and delete resources, rather than inheriting the user's broader permissions. This decouples the user's IAM permissions from the stack's runtime actions, reducing the risk of privilege escalation and unintended resource modifications.

Answer

Set a DeletionPolicy on the stack to retain resources when the stack is deleted.

Answer

Define a StackSetPolicy to control permissions across accounts.

Question 2

A company is implementing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application using the AWS Serverless Application Model (SAM). The pipeline must build and package the application, then deploy it to multiple environments (dev, test, prod) sequentially with manual approval gates before production. Which stage configuration should be used?

Accepted Answer

Use a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, then separate deploy stages for each environment with manual approval actions. It uses a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, which is the recommended approach for SAM-based deployments. The pipeline then separates deploy stages for each environment (dev, test, prod) with manual approval actions before production, satisfying the sequential deployment and manual gate requirements.

Answer

Use a single CloudFormation stack with a change set approval step

Answer

Configure CodePipeline with a deploy action provider set to AWS CloudFormation

Answer

Use CodeDeploy to deploy the SAM template directly to Lambda

Question 3

Which TWO metrics should be monitored in Amazon CloudWatch to detect a potential memory leak in an EC2 instance? (Choose two.)

Accepted Answer

MemoryUtilization (custom metric published via CloudWatch Agent).. MemoryUtilization is a custom metric that must be published via the CloudWatch Agent because EC2 does not expose memory metrics by default. Monitoring this metric over time can reveal a steady upward trend in memory usage that does not drop after processes complete, which is a classic symptom of a memory leak.

Answer

DiskReadOps

Answer

NetworkIn

Answer

CPUUtilization

Question 4

A company uses AWS CodeBuild to run unit tests and package a Java application. The build environment needs to have a specific version of Java installed that is not available in the standard build images. The team wants to minimize build time. How should the engineer configure the build environment?

Accepted Answer

Use a custom build image that already includes the required Java version, stored in Amazon ECR.. Using a custom build image stored in Amazon ECR allows the team to pre-install the exact Java version required, eliminating the need for runtime installation. This minimizes build time by avoiding the overhead of downloading and installing software during every build, while still providing a consistent, reproducible environment.

Answer

Use AWS Lambda to run the tests and package the application.

Answer

Use a standard build image and include a pre-build command to install the required Java version.

Answer

Use the pre-build phase to download and install Java from an S3 bucket.

Question 5

A developer wants to automate the creation of a new Amazon ECS service whenever a new Docker image is pushed to Amazon ECR. Which AWS service should be used to orchestrate this workflow?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture ECR image push events (via the 'ECR Image Action' event type) and route them to a target such as an ECS service or a Lambda function that triggers an ECS service update or creation. This serverless event bus natively integrates with ECR and ECS, making it the simplest and most direct service to orchestrate the workflow without custom polling or additional orchestration logic.

Answer

AWS Step Functions

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Question 6

A development team wants to ensure that their application can continue serving traffic even if an entire AWS Availability Zone (AZ) becomes unavailable. The application runs on Amazon EC2 instances in an Auto Scaling group and uses an Application Load Balancer (ALB). Which configuration should the team implement to meet this requirement?

Accepted Answer

Configure the Auto Scaling group to launch EC2 instances across multiple AZs, and ensure the ALB is enabled for cross-zone load balancing.. Deploying EC2 instances across multiple Availability Zones (AZs) ensures that if one AZ fails, the remaining AZs continue to serve traffic. Enabling cross-zone load balancing on the ALB distributes incoming requests evenly across all healthy instances in all AZs, preventing traffic from being sent only to instances in the same AZ as the client. This architecture meets the requirement for high availability and fault tolerance at the AZ level.

Answer

Use a launch template with multiple instance types to ensure diversity across the fleet.

Answer

Use a single AZ but configure EC2 Auto Scaling to replace unhealthy instances automatically.

Answer

Launch all EC2 instances in the same AZ to minimize latency, and configure the Auto Scaling group to maintain a minimum of two instances.

Question 7

A company is designing a multi-region active-active architecture for a stateless web application. The application uses a DynamoDB table as its data store. The company wants to minimize write latency and ensure that writes are accepted in any region with eventual consistency. Which DynamoDB feature should they use?

Accepted Answer

DynamoDB global tables.. DynamoDB global tables provide a fully managed, multi-region, multi-active solution that automatically replicates data across AWS Regions. This enables low-latency writes in any region with eventual consistency, meeting the requirement for an active-active architecture without custom code or additional infrastructure.

Answer

DynamoDB read replicas in each region.

Answer

Cross-region replication using AWS Lambda function.

Answer

DynamoDB Accelerator (DAX) with multi-region endpoints.

Question 8

A company runs a fleet of EC2 instances behind an Auto Scaling group. The DevOps team wants to detect and respond to memory leaks in their application. They have configured CloudWatch agent to collect memory metrics. However, the metric shows unpredictable spikes. The team needs to correlate these spikes with application logs to identify the root cause. Which solution provides the BEST correlation?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns around the time of memory spikes. CloudWatch Logs Insights allows you to query application logs directly in CloudWatch Logs using a purpose-built query language. By filtering logs around the timestamps of memory spikes, you can correlate specific error patterns or log entries with the metric data, enabling root cause analysis without moving data or adding complexity.

Answer

Export the memory metric and application logs to Amazon S3 and use Amazon Athena to join them

Answer

Enable AWS X-Ray on the application to trace requests and identify memory-heavy requests

Answer

Use Amazon EventBridge to capture EC2 instance state changes and correlate with memory spikes

Question 9

A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?

Accepted Answer

The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).. CodeBuild's security group outbound rules must explicitly allow traffic to the RDS security group on the database port (e.g., 3306 for MySQL). Even though CodeBuild runs in a VPC, if the outbound rules are too restrictive, the build agent cannot establish a TCP connection to the RDS instance, causing a timeout. The security group acts as a virtual firewall for the CodeBuild ENI, and without a matching outbound rule, packets are dropped.

Answer

CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.

Answer

The CodeBuild service role does not have rds:Connect permission.

Answer

The RDS instance is in a different subnet CIDR than CodeBuild's subnet.

Question 10

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an EC2 instance with a UserData script that installs software. The stack creation fails with the error: 'The following resource(s) failed: EC2Instance (AWS::EC2::Instance) – Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack creation timed out or was manually cancelled. The error message 'Resource creation cancelled' indicates that the CloudFormation stack creation was either timed out or manually cancelled, not that the EC2 instance itself failed. CloudFormation has a default timeout of 60 minutes for stack creation, and if the UserData script takes longer than this or the user manually cancels the operation, CloudFormation will mark the resource as cancelled. This is distinct from a resource-specific failure like an invalid instance type or IAM permissions issue, which would produce a different error message such as 'Resource failed to stabilize' or 'API error'.

Answer

The EC2 instance type is not supported in the region

Answer

The IAM role attached to the instance lacks permissions

Answer

The UserData script failed due to a syntax error

Question 11

A company requires that all access to their S3 buckets be encrypted in transit. Which configuration achieves this?

Accepted Answer

Use a bucket policy that denies requests when aws:SecureTransport is false.. Using a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` explicitly enforces encryption in transit for all access to the S3 bucket. This policy ensures that any HTTP (non-TLS) request is denied, while HTTPS requests are allowed, meeting the requirement that all access be encrypted in transit.

Answer

Use CloudFront with the bucket as origin and enforce HTTPS only between viewer and CloudFront.

Answer

Enable default encryption on the bucket.

Answer

Set the bucket policy to require SSE-KMS.

Question 12

A company is designing a highly available architecture for a web application that uses Amazon EC2 instances. The application must be resilient to the failure of a single instance and a single Availability Zone. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Use an Auto Scaling group with a minimum of two instances spread across two Availability Zones.. An Auto Scaling group with a minimum of two instances spread across two Availability Zones ensures that if one instance or one entire AZ fails, the remaining instance(s) in the other AZ can continue serving traffic, and Auto Scaling will automatically launch a replacement instance in the healthy AZ to restore the desired count. Option B is correct because distributing EC2 instances across at least two Availability Zones is the fundamental requirement for AZ-level resilience, as it eliminates a single point of failure at the AZ boundary.

Answer

Place all EC2 instances in a single Availability Zone and use a Network Load Balancer.

Answer

Use a single Application Load Balancer in one Availability Zone.

Answer

Use a single large EC2 instance in one Availability Zone.

Question 13

A company uses AWS CodeBuild to compile and test code. The build process requires a specific version of a library that is not available in the default build environment. Which approach should be used to include this library in the build process?

Accepted Answer

Create a custom Docker image that includes the library and use it as the build environment in CodeBuild.. Creating a custom Docker image that includes the required library ensures the build environment is consistent, reproducible, and avoids repeated download/compile overhead. AWS CodeBuild supports custom Docker images via the `image` field in the buildspec file or the console, allowing you to specify a repository in Amazon ECR or Docker Hub. This approach aligns with infrastructure-as-code best practices by baking dependencies into the environment rather than managing them at build time.

Answer

Modify the buildspec file to include the library as a build artifact.

Answer

Store the compiled library in an Amazon S3 bucket and download it during the build process using the buildspec file.

Answer

Add an install command in the buildspec file to download and compile the library during each build.

Question 14

A company's application running on EC2 instances behind an Application Load Balancer (ALB) is returning intermittent 504 errors. The instances are in an Auto Scaling group with a health check grace period of 300 seconds. What should the DevOps engineer check first to troubleshoot the issue?

Accepted Answer

Check ALB access logs for target response times.. A 504 error indicates the load balancer did not receive a response from the target within the idle timeout period. Checking ALB access logs for target response times is the first step to determine if the backend is slow or unresponsive. Option A is wrong because scaling policies affect the number of instances, not response times. Option B is wrong because health checks verify instance availability, but intermittent slow responses may not cause health check failures. Option C is wrong because security group rules would cause different errors (e.g., connection timeouts) rather than 504s.

Answer

Review the Auto Scaling group scaling policies.

Answer

Verify the target group health checks are passing.

Answer

Check security group rules for the ALB.

Question 15

A company uses AWS CodeBuild to compile and test code. The build takes 30 minutes, but the team wants to reduce build time by caching dependencies. Which approach should be used?

Accepted Answer

Enable local caching in the build project configuration.. AWS CodeBuild's local caching feature allows you to cache intermediate build artifacts (such as dependencies) in a local directory on the build instance, which persists across builds for the same build project. This eliminates the need to re-download dependencies from external sources for every build, significantly reducing build time. The cache is stored in a Docker volume or S3 bucket, but the key benefit is that it is automatically managed by CodeBuild without manual download steps.

Answer

Remove unnecessary dependencies from the build specification.

Answer

Store dependencies in an S3 bucket and download them before each build.

Answer

Use AWS CodeArtifact to store dependencies and pull them during build.

Question 16

A DevOps engineer is designing an AWS CloudFormation template to deploy a three-tier web application. The application must be highly available across multiple Availability Zones. The engineer needs to ensure that the database layer uses a Multi-AZ deployment. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)

Accepted Answer

Select a database engine that supports Multi-AZ deployments.. Not all AWS RDS database engines support Multi-AZ deployments; for example, Amazon Aurora uses a different high-availability mechanism (cluster volume) and does not use the standard Multi-AZ feature. The engineer must verify that the chosen engine (e.g., MySQL, PostgreSQL, Oracle, SQL Server) explicitly supports Multi-AZ to enable synchronous standby replication across Availability Zones. Option E is correct because setting the 'MultiAZ' property to 'true' on the 'AWS::RDS::DBInstance' resource directly instructs CloudFormation to provision a primary DB instance in one AZ and a standby in another AZ, with automatic failover.

Answer

Define a separate 'AWS::RDS::DBSubnetGroup' resource with subnets from at least two Availability Zones.

Answer

Deploy the database with multiple read replicas in different Availability Zones.

Answer

Configure the database to use a DB subnet group with subnets in a single Availability Zone.

Question 17

Which TWO tools can be used to manage configuration drift detection for AWS resources? (Choose two.)

Accepted Answer

AWS Config. AWS Config continuously monitors and records AWS resource configurations and can detect changes against desired baselines, enabling drift detection through rules and compliance checks. AWS CloudFormation Drift Detection directly compares the current state of a stack's resources with the expected template-defined state to identify configuration drift. Both tools provide native mechanisms to detect when resources deviate from their intended configuration.

Answer

AWS Systems Manager Inventory

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 18

A company is using Amazon S3 to store sensitive data. The security team mandates that all data must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS). The DevOps engineer must ensure that any new objects uploaded to the bucket are automatically encrypted. What should the engineer do?

Accepted Answer

Enable default encryption on the S3 bucket and select AWS-KMS as the encryption method.. Enabling default encryption on the S3 bucket with SSE-KMS ensures that all objects uploaded to the bucket are automatically encrypted at rest with AWS KMS. Option A is incorrect because CORS is for cross-origin requests and does not affect encryption. Option B is incorrect because while a bucket policy can enforce encryption headers, it does not provide default encryption; it only denies requests without the header, and default encryption is a simpler and more reliable method. Option D is incorrect because versioning does not encrypt data.

Answer

Enable CORS on the bucket to allow encrypted uploads.

Answer

Apply a bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header with aws:kms.

Answer

Enable S3 Versioning to protect encrypted objects.

Question 19

A company runs a critical microservices architecture on Amazon ECS with Fargate. They want to ensure that if a task fails, it is automatically restarted, and the service remains available across multiple Availability Zones. How should they configure the ECS service?

Accepted Answer

Define an ECS service with a task definition, set desired count across multiple Availability Zones, and use Service Auto Scaling. An ECS service configured with a task definition, desired count across multiple Availability Zones, and Service Auto Scaling ensures resilience. The ECS service scheduler automatically restarts failed tasks, and distributing tasks across AZs provides high availability. Option A is wrong because placing all tasks in a single AZ creates a single point of failure. Option B is wrong because a standalone Fargate task does not have automatic restart; a CloudWatch alarm can restart it but lacks the built-in resilience of an ECS service. Option C is wrong because using a single EC2 instance is a single point of failure and does not provide multi-AZ resilience.

Answer

Place all tasks in the same Availability Zone to reduce latency

Answer

Run a standalone Fargate task and use a CloudWatch alarm to restart it

Answer

Use an EC2 launch type with a single instance to reduce complexity

Question 20

A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the most appropriate service because it is specifically designed to manage secrets like database passwords, with automatic rotation, encryption, and fine-grained access control. Option A (DynamoDB) is a database, not a secrets manager. Option B (S3) can store encrypted data but lacks built-in secret rotation and management. Option C (Systems Manager Parameter Store SecureString) can store secrets but does not support automatic rotation, making Secrets Manager the better choice.

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store (SecureString)