DOP-C02 Practice Test 2 — 25 Questions

Question 1

A company runs a containerized microservices application on Amazon EKS. The application includes a critical service that processes real-time financial transactions. This service must be highly available and resilient to node failures. The current setup uses a Deployment with 3 replicas and a ClusterIP service. During a recent node failure, the application experienced a brief period of unavailability. Which action should the DevOps engineer take to improve resilience without changing the underlying infrastructure?

Accepted Answer

Configure a PodDisruptionBudget with a maxUnavailable of 1, and add pod anti-affinity rules to spread pods across different nodes.. Option C is correct because a PodDisruptionBudget with maxUnavailable=1 ensures that at most one pod is unavailable during voluntary disruptions, while pod anti-affinity rules force the scheduler to distribute pods across different nodes. This combination prevents a single node failure from taking down all replicas, maintaining service availability without altering the underlying infrastructure.

Answer

Change the service type from ClusterIP to NodePort and configure an external load balancer.

Answer

Increase the number of replicas to 10 and use a node selector to schedule all pods on the largest instance type.

Answer

Enable HorizontalPodAutoscaler with a target CPU utilization of 50% to automatically scale the Deployment.

Question 2

A company runs a stateful web application on EC2 instances behind a Network Load Balancer (NLB) in a single Availability Zone. The application stores session state locally on the instance. The company wants to achieve high availability across multiple AZs with minimal application changes. What should the DevOps engineer do?

Accepted Answer

Replace the NLB with an ALB and enable sticky sessions (session affinity) using the ALB's cookie.. Option D is correct because replacing the NLB with an ALB and enabling sticky sessions (session affinity) using the ALB's cookie allows the stateful web application to maintain session state across multiple AZs without modifying the application code. The ALB generates a cookie (AWSALB) that binds a client's session to a specific target instance, ensuring subsequent requests from the same client are routed to the same EC2 instance. This achieves high availability across AZs with minimal changes, as the application continues to store session state locally on the instance.

Answer

Add more AZs and configure the NLB with cross-zone load balancing.

Answer

Replace the NLB with an ALB and use ElastiCache for session storage.

Answer

Use a Multi-AZ RDS instance to store session state.

Question 3

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. During a recent traffic spike, the application became unavailable for 10 minutes. Analysis shows that the ALB's healthy host count dropped to zero because the instances failed health checks due to high CPU load. What is the MOST effective design change to improve resilience during future traffic spikes?

Accepted Answer

Use predictive scaling with a scheduled scaling policy for known peak times.. Predictive scaling uses historical traffic data to forecast future demand and proactively adjust capacity before a spike occurs. This prevents the CPU from reaching critical levels that cause health check failures, ensuring the ALB always has healthy hosts. Scheduled scaling alone would not adapt to unexpected spikes, but predictive scaling combined with dynamic scaling provides both proactive and reactive resilience.

Answer

Increase the instance size to handle higher load.

Answer

Configure step scaling policies based on CPU utilization.

Answer

Set a higher CPU threshold for health checks.

Question 4

A company's application runs on EC2 instances in a single Availability Zone. The operations team wants to improve resilience without redesigning the application. Which action is the MOST effective?

Accepted Answer

Deploy EC2 instances across multiple Availability Zones using an Auto Scaling group.. Deploying EC2 instances across multiple Availability Zones (AZs) using an Auto Scaling group is the most effective action because it eliminates the single point of failure at the AZ level. If one AZ experiences an outage, the Auto Scaling group automatically launches replacement instances in the remaining healthy AZs, ensuring application availability without requiring any application-level changes. This directly addresses the goal of improving resilience by leveraging AWS's fault-isolated infrastructure.

Answer

Use a larger instance type to handle more traffic.

Answer

Enable EC2 Auto Recovery to automatically restart the instance if it fails.

Answer

Place the instance in a placement group to ensure low latency.

Question 5

A company uses a third-party backup solution to back up its EC2 instances daily. The backups are stored in an S3 bucket with default settings. The company wants to ensure that backups are protected from accidental deletion and are available for at least one year. Which combination of S3 features should the DevOps engineer implement?

Accepted Answer

Enable S3 Object Lock with Governance mode and a retention period of 365 days, and set a lifecycle policy to transition to S3 Glacier Deep Archive after 30 days.. Option D is correct because S3 Object Lock with Governance mode prevents objects from being deleted or overwritten by any user (including the root user) for the specified retention period of 365 days, meeting the one-year availability requirement. The lifecycle policy to transition to S3 Glacier Deep Archive after 30 days reduces storage costs while still keeping the data accessible for retrieval within 12 hours, which is acceptable for backup retention. This combination ensures immutability and cost-effective long-term storage.

Answer

Enable MFA Delete and set a lifecycle policy to transition to S3 Glacier after 30 days.

Answer

Enable versioning and set a lifecycle policy to expire noncurrent versions after 365 days.

Answer

Enable cross-Region replication to a bucket with versioning enabled.

Question 6

A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes orders and stores them in an RDS PostgreSQL database. The company wants to ensure that the order service is resilient to AZ failures and can handle a sudden increase in order volume. Which TWO actions should the DevOps engineer take? (Choose TWO.)

Accepted Answer

Deploy the RDS instance in a Multi-AZ configuration.. Option C is correct because deploying the RDS instance in a Multi-AZ configuration provides automatic failover to a standby replica in a different Availability Zone, ensuring database resilience to AZ failures. Option D is correct because configuring the ECS service to run tasks in multiple Availability Zones distributes the order processing workload across AZs, improving both fault tolerance and scalability during sudden traffic spikes.

Answer

Increase the CPU and memory limits for the ECS task definition.

Answer

Place an Amazon CloudFront distribution in front of the order service.

Answer

Use RDS Proxy to manage database connections.

Question 7

A company wants to design a highly available web application using AWS services. The application must be resilient to the failure of an entire AWS Region. Which THREE components should the architecture include? (Choose THREE.)

Accepted Answer

Amazon Route 53 with a failover routing policy.. Amazon Route 53 with a failover routing policy is correct because it enables DNS-based health checking and automatic traffic routing to a secondary region when the primary region becomes unavailable. This is essential for cross-region disaster recovery, as Route 53 can monitor endpoint health and update DNS records to direct users to the healthy region, ensuring application availability despite a full region failure.

Answer

An Application Load Balancer (ALB) deployed in one Region.

Answer

Amazon EC2 instances in a single Region.

Question 8

A DevOps team is troubleshooting a slow application. They enabled AWS X-Ray tracing and see that one of the downstream services has a high average response time. However, the traces show that the service itself is fast; the delay is in the network call from the upstream service. Which X-Ray feature should the team use to identify the root cause?

Accepted Answer

Examine the trace map to see the connection between services.. The trace map in AWS X-Ray provides a visual representation of the service graph, showing the connections and latency between services. Since the delay is in the network call from the upstream service to the downstream service, the trace map can highlight the specific edge where the high latency occurs, allowing the team to pinpoint whether the issue is due to network congestion, DNS resolution, or a slow HTTP connection. This is the most direct way to identify the root cause of the inter-service communication delay.

Answer

Add annotations to the traces for better filtering.

Answer

View the raw segments of the upstream service.

Answer

Adjust the sampling rules to capture more traces.

Question 9

Refer to the exhibit. A team uses this buildspec.yml in AWS CodeBuild. The build fails because the 'dist' directory does not exist after the build phase. What is the most likely cause?

Accepted Answer

The build command outputs to a 'build' directory, but the artifacts base-directory is set to 'dist'.. The buildspec.yml specifies `artifacts.base-directory: dist`, but the build commands output files to a `build` directory. Since the `dist` directory is never created during the build phase, CodeBuild cannot locate the artifacts, causing the build to fail. This mismatch between the output directory and the artifacts base-directory is the most likely cause.

Answer

The buildspec version is incorrect.

Answer

The Python runtime version 3.8 is not available in CodeBuild.

Answer

The requirements.txt file is missing from the source code.

Question 10

A company is building a multi-tier web application on AWS. The application must be resilient to the failure of an entire Availability Zone. The architecture includes an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group, and an Amazon RDS for MySQL database. Which TWO actions should be taken to achieve this resilience? (Choose two.)

Accepted Answer

Configure the Auto Scaling group to launch EC2 instances in at least two Availability Zones.. Option D is correct because configuring the Auto Scaling group to launch EC2 instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) can continue serving traffic. This is a fundamental pattern for building AZ-resilient compute tiers. Option E is correct because deploying Amazon RDS for MySQL in a Multi-AZ configuration automatically provisions and maintains a synchronous standby replica in a different AZ, providing automatic failover if the primary DB instance fails, thus ensuring database resilience.

Answer

Configure an RDS read replica in a different Availability Zone.

Answer

Use a Single-AZ RDS for MySQL database to keep costs low.

Answer

Place all EC2 instances in the same Availability Zone to reduce cross-AZ data transfer costs.

Question 11

A company is using AWS X-Ray to trace requests through a microservices application. Some traces are incomplete, showing only the root segment without any subsegments. The application uses the X-Ray SDK for Java. What is the most likely cause?

Accepted Answer

The sampling rate is set to a low value, causing many requests to be dropped.. Option D is correct because a low sampling rate in the X-Ray SDK causes the SDK to drop many requests before they are sent to the daemon. When the sampling rate is too low, the SDK may decide not to record subsegments for a given request, resulting in traces that contain only the root segment without any subsegments. This is a common misconfiguration where the sampling decision is made at the segment level, and subsegments are only generated if the segment is sampled in.

Answer

The application is missing the x-amzn-trace-id header in incoming requests.

Answer

The segment document size exceeds the maximum allowed size.

Answer

The X-Ray daemon is not running on the EC2 instances.

Question 12

A company runs a critical application on AWS using Amazon EC2 instances in an Auto Scaling group, an Application Load Balancer (ALB), and an Amazon RDS for PostgreSQL Multi-AZ DB cluster. The application must maintain an RTO of 5 minutes and an RPO of 1 second for database transactions. The current setup meets these requirements, but the DevOps team wants to improve the resilience of the application tier to withstand a regional failure. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Replace the RDS Multi-AZ cluster with Amazon Aurora Global Database to replicate data across regions.. Amazon Aurora Global Database is the correct choice because it provides cross-region replication with a typical RPO of 1 second and RTO of 1 minute, meeting the stated requirements. Unlike standard RDS Multi-AZ, which is limited to a single region, Aurora Global Database replicates data asynchronously across multiple regions with minimal lag, ensuring the database tier can survive a regional failure while maintaining the required RPO of 1 second.

Answer

Use Amazon EFS Replication to replicate application data across regions with a recovery point objective (RPO) of 1 second.

Answer

Extend the existing Auto Scaling group to launch instances in two regions by specifying a second region in the launch template.

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?

Accepted Answer

Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.. AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.

Answer

Use IAM Access Analyzer to validate the roles against a policy template.

Answer

Run AWS Trusted Advisor and check the IAM report for roles with long session durations.

Answer

Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.

Question 14

A DevOps engineer is troubleshooting a production AWS Lambda function that occasionally times out. The function has a timeout of 30 seconds and uses a synchronous invocation. The engineer wants to capture invocation logs to identify the cause. Which approach will provide the MOST detailed diagnostic information?

Accepted Answer

Enable AWS X-Ray tracing on the Lambda function.. Option D is correct because AWS X-Ray provides end-to-end tracing for Lambda functions, capturing detailed timing information for each invocation, including subsegments for downstream calls, function initialization, and execution phases. This allows the engineer to pinpoint exactly where time is being spent, which is essential for diagnosing intermittent timeouts in synchronous invocations.

Answer

Enable AWS CloudTrail data events for Lambda.

Answer

Create a CloudWatch dashboard with function duration metrics.

Answer

Add more logging statements to the function code and check CloudWatch Logs.

Question 15

A company runs a critical application on Amazon ECS with Fargate. The application experiences intermittent slow responses. The DevOps team enabled Container Insights and CloudWatch ServiceLens. However, traces from the application do not appear in ServiceLens. The application uses the AWS X-Ray SDK for tracing. What is the MOST likely cause?

Accepted Answer

The X-Ray daemon is not running in the task definition.. The X-Ray daemon is required to act as a local intermediary that receives trace segments from the X-Ray SDK and forwards them to the AWS X-Ray API. In Amazon ECS with Fargate, the daemon must be explicitly included as a sidecar container in the task definition. Without it, the SDK cannot send traces, which explains why traces are missing from ServiceLens despite the SDK being integrated.

Answer

The X-Ray SDK cannot send traces to AWS X-Ray from Fargate tasks.

Answer

ServiceLens does not support Amazon ECS with Fargate launch type.

Answer

The application is not sending metrics to CloudWatch Container Insights.

Question 16

A DevOps team has set up centralized logging for multiple AWS accounts using Amazon OpenSearch Service. The team uses CloudWatch cross-account observability to collect logs from various accounts into a monitoring account. Recently, logs from one source account stopped appearing in the monitoring account's OpenSearch dashboard. Other source accounts continue to send logs successfully. Which step should the team take to troubleshoot this issue?

Accepted Answer

Check the source account's CloudWatch Logs subscription filter for the OpenSearch destination.. Option B is correct because the most likely cause of logs from a single source account failing to appear is a misconfigured or broken CloudWatch Logs subscription filter. This filter is responsible for forwarding log events from the source account to the OpenSearch destination in the monitoring account. If the filter is missing, misconfigured, or has been accidentally deleted, logs will not be sent, while other accounts continue to work normally.

Answer

Verify that the monitoring account's CloudWatch cross-account observability is enabled.

Answer

Review the source account's CloudWatch Logs retention policy to confirm logs are not expired.

Answer

Ensure the IAM role in the source account has the correct trust policy for the monitoring account.

Question 17

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack fails to create or update. What is the MOST efficient way to achieve this?

Accepted Answer

Configure an SNS topic in the stack's notification options.. Option A is correct because AWS CloudFormation natively supports specifying Amazon SNS topic ARNs in the stack's notification options. When a stack operation (create, update, or delete) fails, CloudFormation automatically publishes a notification to the configured SNS topic without requiring any custom code, additional resources, or external event processing. This is the most efficient approach as it leverages built-in functionality with zero maintenance overhead.

Answer

Create a custom resource in the stack that publishes to Amazon SNS.

Answer

Create a CloudWatch alarm on the StackStatus metric.

Answer

Use Amazon EventBridge to capture CloudFormation events and publish to SNS.

Question 18

A DevOps engineer is designing a deployment pipeline for a serverless application using AWS SAM. The pipeline must include the following stages: source, build, deploy to a development environment, run integration tests, and promote to production after manual approval. Which AWS services and features should be used to implement this pipeline? (Choose two.)

Accepted Answer

AWS CodePipeline to orchestrate the pipeline stages.. AWS CodePipeline is the correct service for orchestrating the pipeline stages because it provides native support for defining source, build, deploy, test, and manual approval stages in a sequential workflow. It integrates directly with AWS SAM and can trigger builds and deployments based on source code changes, making it the ideal orchestrator for this multi-stage pipeline.

Answer

AWS CodeDeploy for deploying the SAM application.

Answer

AWS CodeCommit to build the SAM application.

Question 19

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics for the ALB and is using CloudWatch Logs for the EC2 instances. Recently, users report intermittent 503 errors. The team notices that the ALB's 'RequestCount' metric shows a sudden drop during error periods, while the 'ActiveConnectionCount' remains steady. Which TWO steps should the team take to diagnose the issue? (Choose two.)

Accepted Answer

Enable and analyze the ALB access logs to see the HTTP response codes and target processing time.. Option A is correct because ALB access logs contain detailed per-request data, including HTTP response codes (e.g., 503) and target processing time. Analyzing these logs will reveal whether the 503 errors are coming from the ALB itself (e.g., due to request queue overflow) or from the targets, and whether the sudden drop in RequestCount is due to clients aborting or the ALB throttling requests.

Answer

Check the Amazon Route 53 health checks for the ALB DNS name.

Answer

Review the EC2 instances' CloudWatch metrics for CPU utilization and network traffic.

Answer

Inspect AWS CloudTrail logs for the ALB to see if there are any configuration changes.

Question 20

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database instance fails and AWS automatically fails over to the standby. After the failover, the application cannot connect to the database. The engineer checks the RDS console and sees that the instance status is Available. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The application is using the database's DNS endpoint for the old primary, which is no longer the writer.. After an RDS Multi-AZ failover, the DNS endpoint for the DB instance remains the same but its underlying IP address changes to point to the new primary (formerly the standby). If the application caches the IP address of the old primary or uses a direct connection to the old writer endpoint, it will attempt to connect to a node that is no longer the writer. The correct practice is to always connect using the RDS instance endpoint (CNAME), which automatically resolves to the current writer, and to avoid caching the resolved IP address. Since the instance status is 'Available', the new primary is ready, so the issue is a stale connection target.

Answer

The security group for the RDS instance has changed during failover.

Answer

The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.

Answer

The database instance is still in the process of failover and is not yet accepting connections.