DOP-C02 Practice Test 3 — 25 Questions

Question 1

A company uses AWS CodeCommit as a source repository and wants to enforce that all commits are signed using GPG keys. The DevOps team configures a pre-receive hook in CodeCommit to validate commit signatures. However, the hook rejects all commits even when valid GPG signatures are present. What is the most likely cause?

Accepted Answer

CodeCommit does not support pre-receive hooks.. AWS CodeCommit does not support pre-receive hooks. Pre-receive hooks are a feature of self-managed Git repositories (e.g., GitHub Enterprise, GitLab, or on-premises Git servers) that run on the server before accepting a push. CodeCommit uses IAM policies and repository-level settings (such as requiring signed commits via the 'git push --signed' flag) to enforce commit signing, not server-side hooks. Therefore, any attempt to configure a pre-receive hook in CodeCommit will fail, causing all commits to be rejected.

Answer

The GPG key is not registered with the IAM user's profile.

Answer

The hook script has a syntax error.

Answer

The repository is not configured to require signed commits.

Question 2

Which of the following are valid strategies for implementing continuous integration in AWS? (Choose two.)

Accepted Answer

Configure AWS CodeBuild to automatically run tests when a pull request is created in CodeCommit.. Option A is correct because AWS CodeBuild can be configured to automatically run tests when a pull request is created in CodeCommit using a webhook or event rule. This enables continuous integration by validating code changes before merging, ensuring that only tested code is integrated into the main branch.

Answer

Set up AWS CodeDeploy to trigger a build every time a commit is pushed to a repository.

Answer

Use AWS CloudFormation to create a stack that runs tests every time a new commit is pushed.

Question 3

A company uses DynamoDB global tables in two AWS Regions with strong consistency reads. They observe occasional write conflicts that are not being resolved automatically. The application uses DynamoDBMapper with optimistic locking. What should the DevOps engineer do to ensure conflict resolution?

Accepted Answer

Use conditional writes with a version number attribute to ensure updates are applied only to the latest version.. Option D is correct because DynamoDB global tables use last-writer-wins (LWW) for conflict resolution by default, but when using DynamoDBMapper with optimistic locking, the application must implement conditional writes with a version number attribute to ensure updates are applied only to the latest version. This prevents stale updates from overwriting newer data, as the conditional write will fail if the version number in the request does not match the current version in the table, allowing the application to retry with the updated version.

Answer

Implement a custom conflict resolution using DynamoDB Streams and AWS Lambda.

Answer

Switch to eventual consistency reads to reduce conflicts.

Answer

Add a third global table region to increase redundancy.

Question 4

A company's application uses Amazon SQS to decouple microservices. During peak hours, the SQS queue backlog grows significantly, causing processing delays. The DevOps team wants to reduce latency without increasing costs unnecessarily. What should the team do?

Accepted Answer

Configure Auto Scaling for the consumer fleet based on the ApproximateNumberOfMessagesVisible metric.. Option D is correct because scaling the consumer fleet based on the ApproximateNumberOfMessagesVisible metric directly addresses the backlog by adding more processing capacity when the queue grows. This approach reduces latency dynamically without incurring unnecessary costs during off-peak hours, as it only scales up when needed. Auto Scaling with SQS metrics is a cost-effective, elastic solution for handling variable workloads.

Answer

Increase the visibility timeout to allow consumers more time to process messages.

Answer

Use an SQS queue with priority settings to process high-priority messages first.

Answer

Increase the SQS queue's throughput by requesting a quota increase.

Question 5

A company is running a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The DevOps team wants to monitor HTTP 5xx errors and receive alerts when the error rate exceeds 5% over a 5-minute period. Which combination of services and configurations should be used to meet these requirements?

Accepted Answer

Use CloudWatch ALB metrics (HTTPCode_ELB_5XX_Count) and create a CloudWatch Alarm on the Sum statistic with a threshold based on total request count.. Option C is correct because ALB automatically publishes the `HTTPCode_ELB_5XX_Count` metric to CloudWatch, and you can create a CloudWatch alarm using the `Sum` statistic over a 5-minute period. To detect when the error rate exceeds 5%, you need to combine this metric with the `RequestCount` metric in a math expression (e.g., `m1/m2*100 > 5`) or use a composite alarm, as the alarm threshold must be based on the ratio of 5xx errors to total requests, not just the raw count.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query 5xx logs, then create a metric filter and alarm.

Answer

Configure AWS Config rules to check ALB 5xx error counts and trigger alarms.

Answer

Use AWS X-Ray to trace requests and create a CloudWatch alarm based on X-Ray error rate.

Question 6

A company needs to monitor the CPU utilization of its Amazon RDS for PostgreSQL instance. The metric should be available in Amazon CloudWatch with a granularity of 1 minute. Which action should the team take?

Accepted Answer

No additional configuration is needed; RDS automatically sends metrics to CloudWatch.. Amazon RDS for PostgreSQL automatically publishes metrics, including CPU utilization, to CloudWatch with a default granularity of 1 minute for standard instances. No additional configuration is required to enable this basic monitoring. The metrics are collected by the RDS hypervisor layer and sent to CloudWatch without needing an agent or extra setup.

Answer

Install the CloudWatch agent on the RDS instance.

Answer

Enable Enhanced Monitoring for the RDS instance.

Answer

Enable Performance Insights for the RDS instance.

Question 7

A DevOps team is using Amazon CloudWatch Logs to collect application logs from multiple EC2 instances. They notice that some log entries are missing and that the CloudWatch agent is consuming high CPU. The log group has a retention policy of 30 days. Which action should the team take to reduce CPU usage without losing log data?

Accepted Answer

Increase the batch size in the CloudWatch agent configuration.. Increasing the batch size in the CloudWatch agent configuration reduces the number of HTTP API calls made to CloudWatch Logs, which lowers CPU overhead from frequent network I/O and serialization. The agent buffers log events and sends them in larger, less frequent batches, directly addressing high CPU consumption without discarding any log data.

Answer

Use JSON format for logs instead of plain text.

Answer

Set the agent's timezone to UTC.

Answer

Change the log group retention policy to 7 days.

Question 8

A company wants to monitor the number of messages in an Amazon SQS queue and send an alert if the queue depth exceeds 1000 for more than 5 minutes. Which AWS service should be used to create the alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it can monitor SQS queue metrics (such as ApproximateNumberOfMessagesVisible) and trigger an alarm when the metric exceeds a threshold (e.g., 1000) for a specified evaluation period (e.g., 5 minutes). CloudWatch Alarms directly integrate with SQS via the AWS/SQS namespace and support actions like sending notifications through Amazon SNS.

Answer

Amazon EventBridge

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Question 9

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are deployed in multiple AWS regions. The team wants to aggregate the canary results into a single dashboard in the US East (N. Virginia) region. What is the MOST efficient way to achieve this?

Accepted Answer

Create a cross-region CloudWatch dashboard and add metrics from each region using metric math.. Option B is correct because CloudWatch cross-region dashboards allow you to aggregate metrics from multiple regions into a single dashboard without data movement. By using metric math, you can reference metric IDs from different regions directly in the dashboard widget, enabling real-time aggregation of Synthetics canary success/failure rates and latency metrics from all regions into a unified view in US East (N. Virginia). This approach avoids unnecessary data replication, reduces latency, and minimizes operational overhead.

Answer

Replicate the canaries to US East (N. Virginia) and run them from there.

Answer

Set up a Lambda function in each region to push canary results to a central S3 bucket, then create a dashboard from S3.

Answer

Create a CloudWatch Logs Insights query across all regions and visualize results.

Question 10

A company uses Amazon CloudWatch Logs to store logs from multiple applications. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Additionally, logs must be retained for 7 years for compliance. Which THREE steps should the DevOps engineer take to meet these requirements? (Choose THREE.)

Accepted Answer

Set the log group retention policy to 2557 days (7 years).. Option A is correct because CloudWatch Logs log group retention policies accept values in days, and 7 years equals 2557 days (7 × 365.25, accounting for leap years). Setting this retention policy ensures logs are automatically deleted after the compliance period, meeting the 7-year retention requirement without manual intervention.

Answer

Modify the existing log group to use the KMS key by updating the log group settings.

Answer

Set the log group retention policy to 'Never expire' and use lifecycle policies to transition logs to Amazon S3 Glacier after 30 days.

Question 11

A DevOps engineer is monitoring an Amazon EC2 Auto Scaling group. The engineer wants to receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures API calls made to the EC2 Auto Scaling service, including RunInstances and TerminateInstances events. By sending these events to Amazon CloudWatch Logs, you can create metric filters that trigger CloudWatch Alarms, which then publish notifications to an SNS topic. This combination allows you to receive real-time notifications when instances are launched or terminated.

Answer

AWS X-Ray

Answer

AWS Config

Answer

Amazon CloudWatch Alarms

Question 12

A company is using AWS CloudFormation to deploy infrastructure. An engineer needs to ensure that any changes to the production stack are reviewed and approved before they are applied. The engineer also wants to prevent unauthorized changes. Which solution should the engineer implement?

Accepted Answer

Use CloudFormation Change Sets and require manual approval to execute the change set.. CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact running resources before you apply them. By requiring manual approval to execute the change set, the engineer ensures that all modifications are reviewed and approved, preventing unauthorized changes. This directly meets the requirement for a review-and-approval workflow without introducing unnecessary complexity.

Answer

Use CloudFormation StackSets to manage the production stack across multiple accounts.

Answer

Use AWS Service Catalog to create a product for the stack and require approval for any portfolio changes.

Answer

Use AWS CodePipeline to deploy the stack and require manual approval at the deploy stage.

Question 13

A DevOps engineer is designing a monitoring solution for a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The team needs to monitor for errors and latency. Which TWO actions should the engineer take to implement comprehensive monitoring? (Choose TWO.)

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. Option D is correct because AWS X-Ray provides end-to-end tracing for requests as they travel through API Gateway, Lambda, and DynamoDB, enabling the team to identify latency bottlenecks and errors across the entire serverless application. This is essential for comprehensive monitoring of distributed applications, as it captures detailed timing and error data for each component.

Answer

Enable DynamoDB Accelerator (DAX) to reduce latency.

Answer

Enable detailed billing metrics for cost analysis.

Answer

Configure CloudWatch Logs for DynamoDB.

Question 14

A company uses AWS Lambda functions to process incoming events from Amazon S3. The operations team notices that some events are not being processed, and there is no error in the Lambda function logs. What is the most likely cause?

Accepted Answer

The Lambda function has reserved concurrency set to a low value, causing throttling.. When a Lambda function has reserved concurrency set to a low value, it limits the number of concurrent executions allowed for that function. If incoming S3 events exceed this limit, the Lambda service throttles the invocations, causing some events to be silently dropped without generating errors in the function logs because the function never actually runs. This matches the symptom of missing events with no error logs.

Answer

The S3 event notification is configured to send to an SNS topic that is not subscribed to the Lambda function.

Answer

The S3 bucket policy does not allow the Lambda function to be invoked.

Answer

The Lambda function has a timeout that is too short.

Question 15

A DevOps engineer notices that an EC2 instance in an Auto Scaling group is repeatedly failing health checks and being terminated. The engineer needs to capture the root cause by collecting memory dumps and system logs before termination. What should the engineer do?

Accepted Answer

Use EC2Rescue for Windows Server or Linux, configure it to run at instance startup, and extend the Auto Scaling health check grace period.. Option B is correct because EC2Rescue is specifically designed to collect memory dumps and system logs from EC2 instances, and by configuring it to run at startup and extending the Auto Scaling health check grace period, the engineer ensures diagnostics are captured before the instance is terminated for failing health checks. This approach directly addresses the need to gather root cause data from a failing instance that is about to be replaced.

Answer

Configure the CloudWatch Agent to collect memory and system logs and publish them to CloudWatch Logs.

Answer

Use AWS Systems Manager Run Command to execute a script on the instance that collects diagnostics before it is terminated.

Answer

Enable EC2 instance metadata service (IMDS) to capture diagnostic data that persists after termination.

Question 16

A company runs a containerized application on Amazon ECS Fargate. The DevOps team wants to collect custom application metrics (e.g., request count, error rate) and send them to Amazon CloudWatch. The team wants to minimize changes to the application code. Which solution should be used?

Accepted Answer

Run the CloudWatch agent as a sidecar container in the ECS task definition, configured to collect StatsD metrics from the application container.. Option B is correct because the CloudWatch agent can run as a sidecar container in the same ECS task definition and listen for StatsD metrics (over UDP port 8125) from the application container. This approach requires zero changes to the application code—the application simply emits StatsD-formatted metrics, and the CloudWatch agent forwards them to CloudWatch via the PutMetricData API. It minimizes operational overhead while enabling custom metric collection from containerized workloads on Fargate.

Answer

Have the application call the CloudWatch PutMetricData API directly.

Answer

Use the ECS agent's built-in metric collection feature.

Answer

Modify the application to send logs using the embedded metric format.

Question 17

A security engineer reviews the CloudTrail log entry above and notices that a security group was modified to allow SSH access from anywhere. The engineer wants to ensure that such changes are automatically detected and remediated in the future. What should the engineer do?

Accepted Answer

Create an AWS Config rule that checks security group rules and triggers an AWS Systems Manager Automation document to revoke the ingress rule.. Option C is correct because AWS Config can continuously evaluate security group rules against a custom or managed rule (e.g., restricted-ssh) and, upon detecting a noncompliant rule allowing 0.0.0.0/0 on port 22, trigger an AWS Systems Manager Automation document that automatically revokes the offending ingress rule. This provides both detection and remediation without manual intervention, meeting the requirement for automated detection and remediation.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter that alerts on AuthorizeSecurityGroupIngress events with 0.0.0.0/0.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the source IP is 0.0.0.0/0.

Answer

Enable Amazon GuardDuty to detect and block such changes in real time.

Question 18

A company uses AWS Organizations with multiple accounts. The security team needs to automatically isolate a compromised EC2 instance by removing it from its security group and attaching a quarantine security group that only allows traffic to a forensic instance. Which combination of actions should be implemented?

Accepted Answer

Use AWS Config rules with AWS Systems Manager Automation documents to automatically remove the instance from the security group and attach the quarantine group when non-compliant.. Option D is correct because AWS Config rules can evaluate security group membership compliance, and when a non-compliant EC2 instance is detected, an AWS Systems Manager Automation document can be triggered via a remediation action. This automation document can execute the steps to remove the instance from its current security group and attach a quarantine security group, providing a fully automated, event-driven isolation workflow without requiring custom code for orchestration.

Answer

Use Amazon GuardDuty to automatically modify the security group membership of the instance.

Answer

Use AWS Shield Advanced to automatically apply the quarantine security group to the instance.

Answer

Use AWS Lambda functions triggered by Amazon EventBridge to remove the instance from the security group and attach the quarantine group.

Question 19

A DevOps engineer is investigating why an Amazon ECS service is not scaling out as expected. The service has a target tracking scaling policy based on average CPU utilization. The CloudWatch alarm shows that CPU utilization has exceeded the target for several minutes, but no scaling activity has occurred. What is the most likely cause?

Accepted Answer

The scaling policy has a cooldown period that is still in effect from a previous scaling activity.. Option D is correct because target tracking scaling policies in Amazon ECS have a cooldown period (default 300 seconds) that prevents the policy from initiating additional scaling activities immediately after a previous scaling action. If a recent scaling activity occurred, the cooldown period would still be in effect, causing the policy to ignore the alarm even though CPU utilization has exceeded the target. This is the most likely reason no scaling activity is observed despite the alarm being triggered.

Answer

The ECS service is configured with a minimum healthy percent that prevents scaling out.

Answer

The ECS service does not have an IAM role that allows it to call CloudWatch.

Answer

The CloudWatch alarm is configured with a period that is too long.

Question 20

A company has a legacy application running on an EC2 instance that is not part of an Auto Scaling group. The instance is experiencing a memory leak. The DevOps engineer needs to collect memory metrics to analyze the issue without modifying the application. What should the engineer do?

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect memory metrics.. The CloudWatch agent is required to collect custom metrics like memory utilization from an EC2 instance because the standard EC2 monitoring only captures hypervisor-level metrics (CPU, network, disk I/O). By installing and configuring the CloudWatch agent, the engineer can collect memory metrics without modifying the application code, directly addressing the memory leak analysis requirement.

Answer

Use the AWS Management Console to view memory metrics from the EC2 monitoring tab.

Answer

Use EC2Rescue to generate a memory dump and analyze it.

Answer

Enable CloudWatch detailed monitoring on the instance.