DOP-C02 Practice Test 4 — 25 Questions

Question 1

A DevOps team is designing a solution to encrypt data at rest for an Amazon RDS for MySQL database. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use AWS KMS to create a customer managed key and assign it to the RDS instance. To encrypt data at rest for Amazon RDS for MySQL, encryption must be enabled when creating the DB instance (Option D) and a customer managed key from AWS KMS can be used (Option C). Option A is incorrect because you cannot enable encryption on an existing unencrypted RDS instance; it must be done at creation time. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest. Option E is incorrect because storing database files in an encrypted S3 bucket does not encrypt the RDS instance; RDS encryption is managed by AWS KMS and is enabled at the instance level.

Answer

Enable encryption after creating the RDS instance by modifying the instance

Answer

Enable SSL/TLS for the RDS instance

Answer

Store the database files in an encrypted S3 bucket

Question 2

A company uses AWS CodeBuild to build and test code. The build jobs need to access a private S3 bucket to download dependencies. Which THREE steps are required to securely grant access?

Accepted Answer

Configure the S3 bucket policy to allow access from the CodeBuild service principal. To grant CodeBuild access to an S3 bucket, you need an IAM role that allows the required actions, attach it to the CodeBuild project, and also ensure the bucket policy allows the role. KMS key is not required if SSE-S3 is used. VPC endpoint is optional.

Answer

Set up a VPC endpoint for S3

Answer

Create a KMS key and grant CodeBuild access to it

Question 3

A DevOps engineer is troubleshooting a production issue where an application's response time has increased. The application is deployed on Amazon ECS with Fargate. The engineer wants to identify which microservice is causing the latency. Which AWS service should be used?

Accepted Answer

AWS X-Ray to trace requests and analyze service latency.. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, allowing the engineer to pinpoint which service is introducing latency. By analyzing trace segments and subsegments, X-Ray can break down response times for each component in the application, directly addressing the need to identify the specific microservice causing the delay.

Answer

Amazon CloudWatch Synthetics canary to monitor the application endpoint.

Answer

Amazon CloudWatch Logs Insights to query application logs for errors.

Answer

Amazon CloudWatch ServiceLens to visualize service maps and traces.

Question 4

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group across three Availability Zones. The instances run a Java application that connects to an Amazon RDS Multi-AZ MySQL database. The application also uses Amazon ElastiCache for Redis for session caching. The company recently experienced a severe outage where the ALB's 5xx error rate spiked to 100% for 45 minutes. The root cause was a combination of a slow-running query on the RDS primary instance and a subsequent failover that caused the application to lose connections to the database. The failover happened because the slow query caused the primary to become unresponsive, triggering a Multi-AZ failover. During the failover, the application's connection pool exhausted, and new connections failed. The application logs show a high rate of 'java.sql.SQLTimeoutException' and 'com.mysql.cj.exceptions.CJCommunicationsException'. The DevOps team needs to implement a long-term solution that minimizes the impact of similar incidents. The solution must be cost-effective and require minimal application changes. Which combination of actions should the DevOps team take?

Accepted Answer

Implement Amazon RDS Proxy to manage database connections and add read replicas to offload read traffic.. Amazon RDS Proxy is the correct solution because it efficiently manages database connection pooling, reducing the likelihood of connection exhaustion during failovers. By maintaining a warm connection pool and automatically reconnecting to the new primary after a Multi-AZ failover, RDS Proxy minimizes application-side connection timeouts and errors like SQLTimeoutException and CJCommunicationsException. Adding read replicas offloads read traffic, reducing the load on the primary and mitigating the risk of slow queries causing unresponsiveness. This combination requires minimal application changes and is cost-effective compared to scaling the primary instance.

Answer

Use an Auto Scaling policy for EC2 based on RDS connection count and implement a read replica for the primary.

Answer

Configure Multi-AZ RDS with a synchronous standby and use Amazon RDS for MySQL with enhanced monitoring.

Answer

Increase the instance size of the RDS primary and enable Performance Insights to identify slow queries.

Question 5

A DevOps team wants to enforce that all EC2 instances launched in an AWS account have a specific tag 'Environment' with value 'Production' or 'Development'. The team uses AWS CloudFormation to provision resources. Which approach should the team use to enforce tagging compliance at launch?

Accepted Answer

Use an AWS Config rule with an auto-remediation action that applies the required tag to non-compliant resources.. AWS Config rules can evaluate EC2 instances for the presence of the 'Environment' tag with allowed values and, when combined with an auto-remediation action (e.g., using AWS Systems Manager Automation), can automatically apply the missing tag to non-compliant resources. This enforces tagging compliance at launch and throughout the resource lifecycle, even if the instance was launched without the tag. The auto-remediation action can be triggered as soon as the Config rule detects non-compliance, ensuring the tag is applied shortly after launch.

Answer

Configure a CloudFormation stack policy that denies stack updates if the tag is missing.

Answer

Add an IAM policy that denies ec2:RunInstances unless the request includes the required tag.

Answer

Create an AWS Service Catalog portfolio with a tag option constraint that requires the tag.

Question 6

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.. AWS CloudFormation StackSets can deploy a stack containing the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, new accounts automatically receive the stack. This centrally manages the rule with minimal operational overhead. Option B is incorrect because SCPs only deny API actions and cannot deploy a Config rule; they would need a separate mechanism to deploy the rule initially.

Answer

Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.

Answer

Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.

Answer

Use an AWS Config aggregator in the management account to monitor compliance across accounts.

Question 7

A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?

Accepted Answer

Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.. The UpdatePolicy attribute with AutoScalingReplacingUpdate is only supported for AWS::AutoScaling::AutoScalingGroup resources, not for AWS::RDS::DBInstance. Therefore, option D is incorrect. Options A and C are also invalid (CreationPolicy is for signal-based creation, and AutoScalingRollingUpdate is for rolling updates on Auto Scaling groups). Option B, Stack Policy, can protect resources from being updated but does not control how a replacement occurs to minimize downtime or prevent data loss. Thus, none of the provided options are correct for ensuring minimal downtime and data safety during an RDS instance class change that requires replacement.

Answer

Set the CreationPolicy attribute on the database resource.

Answer

Configure a Stack Policy to protect the database resource.

Answer

Set the UpdatePolicy to AutoScalingRollingUpdate.

Question 8

An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.. The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed. This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.

Answer

The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.

Answer

The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.

Answer

The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.

Question 9

A company is using Amazon RDS for MySQL and wants to monitor database connections. They need to set up an alarm when the number of connections exceeds 80% of the maximum connections for more than 5 minutes. Which CloudWatch metric and statistic should be used?

Accepted Answer

DatabaseConnections metric with Average statistic. The Average statistic of the DatabaseConnections metric over a 5-minute period provides a smoothed representation of connection usage, which is appropriate for detecting sustained breaches of the 80% threshold. Using Average reduces sensitivity to transient spikes, ensuring the alarm triggers only when the average number of connections remains above the threshold for the entire evaluation period, aligning with the requirement of 'more than 5 minutes'.

Answer

DatabaseConnections metric with Maximum statistic

Answer

DatabaseConnections metric with Sum and then divide by the number of data points

Answer

DatabaseConnections metric with Sum statistic

Question 10

A DevOps engineer is setting up a CI/CD pipeline for a Node.js application. The application must be built, tested, and deployed to an Amazon ECS cluster. The team wants to use AWS CodeBuild to run unit tests and package the application as a Docker image, and AWS CodePipeline to orchestrate the workflow. Which artifact type should CodeBuild output to be used by a subsequent CodePipeline action?

Accepted Answer

A JSON file with the image details.. CodePipeline's ECS deploy action requires an input artifact containing an imagedefinitions.json file that specifies the image URI. CodeBuild should produce this JSON file as its output artifact, not merely push the image to ECR. The subsequent deploy action reads the JSON file to determine which image to use, so the correct artifact type is a JSON file with image details.

Answer

A Docker image pushed to Amazon ECR.

Answer

A zip file containing the application source code.

Answer

A tarball stored in Amazon S3.

Question 11

A DevOps team uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild that generates the website files, and a deploy stage that copies files to an S3 bucket. The team wants to add a manual approval step before the deploy stage. What should the engineer do?

Accepted Answer

Add an approval action in the pipeline stage before deploy. AWS CodePipeline natively supports a manual approval action that can be added as a stage gate. By inserting an approval action in a stage immediately before the deploy stage, the pipeline will pause and require a designated approver to manually approve or reject the deployment, ensuring human oversight before files are copied to the S3 bucket.

Answer

Use Amazon SNS to send a notification and rely on a Lambda function to resume

Answer

Add a CodeBuild action that waits for an SNS confirmation

Answer

Configure the S3 bucket to send an event to the pipeline after upload

Question 12

A DevOps engineer is designing a resilient architecture for a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences occasional spikes in traffic that cause Lambda function throttling and increased error rates. What is the MOST effective way to improve resilience and reduce throttling?

Accepted Answer

Reserve concurrency for the Lambda function to ensure it always has available capacity.. The stem specifies that traffic spikes cause Lambda function throttling. Reserving concurrency for the Lambda function (Option D) guarantees a dedicated portion of the account-level concurrency limit, preventing other functions from exhausting capacity and directly mitigating throttling. Option B (DynamoDB auto scaling) would only help if the throttling were caused by DynamoDB capacity issues, but the stem makes no mention of database errors. Option A (increasing memory) does not address concurrency limits, and Option C (API Gateway throttling) can limit incoming requests but does not guarantee that Lambda has capacity to process them.

Answer

Increase the Lambda function memory to the maximum allowed.

Answer

Enable DynamoDB auto scaling for the table to handle traffic spikes.

Answer

Set API Gateway throttling limits to match the expected peak traffic.

Question 13

A company has a multi-account AWS environment using AWS Organizations. The security team needs to centrally monitor and analyze VPC Flow Logs from all accounts. The solution must be cost-effective and allow querying across accounts. Which approach should they take?

Accepted Answer

Send VPC Flow Logs from each account to a centralized Amazon S3 bucket, then use Amazon Athena to query the logs.. It uses a centralized Amazon S3 bucket to aggregate VPC Flow Logs from all accounts, which is cost-effective (S3 storage costs are low) and enables cross-account querying via Amazon Athena using standard SQL. This approach avoids per-ingestion costs of services like CloudWatch Logs or Kinesis and provides a serverless, scalable query engine for analyzing logs across accounts.

Answer

Use Amazon Elasticsearch Service (Amazon OpenSearch Service) with a cross-account ingestion pipeline.

Answer

Stream VPC Flow Logs from each account to Amazon Kinesis Data Analytics for real-time analysis.

Answer

Configure each account to send VPC Flow Logs to a central CloudWatch Logs group using cross-account subscription.

Question 14

A company runs a production web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application is deployed across three Availability Zones. The DevOps team recently noticed that the application's error rate is spiking periodically, but they cannot correlate the spikes with any known deployments or changes. The team has enabled detailed CloudWatch metrics for the ALB and EC2, and they are using CloudWatch Logs for application logs. They also have AWS X-Ray enabled for tracing.

The team observes that during error spikes, the ALB's 5XX count increases, but the EC2 instance-level CPU and memory metrics remain normal. The application logs show 'Connection timed out' errors. The team suspects the issue is related to network connectivity but is not sure.

Which course of action should the DevOps team take to identify the root cause of the periodic error spikes?

Accepted Answer

Enable VPC Flow Logs for the subnets and analyze the logs to identify dropped connections during the error spikes.. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including whether the traffic was accepted or rejected. Since the application logs show 'Connection timed out' errors and instance-level metrics are normal, the issue likely lies in the network path (e.g., security groups, NACLs, or subnet routing) rather than the application or compute layer. Analyzing VPC Flow Logs during the error spikes will reveal if connections are being dropped or rejected, pinpointing the root cause of the timeouts.

Answer

Increase the EC2 instance size to handle higher traffic and reduce timeouts.

Answer

Configure a step scaling policy for the Auto Scaling group based on ALB 5XX count.

Answer

Enable ALB access logs and analyze the 5xx response patterns.

Question 15

Refer to the exhibit. A CodeBuild project uses this buildspec. The build fails with the error: 'The runtime version specified is not supported in this environment.' What change should be made?

Accepted Answer

Update the runtime-versions to nodejs: 14.. The CodeBuild managed image for the specified environment (likely Ubuntu Standard 5.0 or similar) only supports Node.js runtime versions 14 and above. The error indicates that Node.js 12 is not available in the runtime-versions section of the buildspec for that environment. Updating to nodejs: 14 aligns with the supported runtime versions in the managed image, resolving the error without requiring custom images or manual installation.

Answer

Add an install command to install Node.js 12 from source.

Answer

Remove the runtime-versions section and install Node.js manually.

Answer

Change the build environment to use a custom image that includes Node.js 12.

Question 16

A company uses AWS CodeCommit for source control. Developers frequently push large binary files, causing the repository size to exceed the recommended limit. What is the most efficient way to manage this situation?

Accepted Answer

Use Git LFS (Large File Storage) and configure it to store binaries in S3.. Git LFS (Large File Storage) replaces large binary files in the repository with lightweight text pointers, while the actual binary content is stored in an external storage backend such as Amazon S3. This keeps the CodeCommit repository small and within recommended limits, and developers continue to use standard Git commands without performance degradation.

Answer

Increase the repository size limit in CodeCommit settings.

Answer

Periodically run a script to remove large files from the commit history.

Answer

Use S3 directly for storing binaries and reference them in code.

Question 17

A DevOps team uses AWS CodePipeline with an S3 source action and CodeBuild as a build provider. The pipeline has a manual approval step before deployment. Recently, the team noticed that the pipeline automatically starts when a new object is uploaded to the S3 bucket, even if the object is not the source code. They want to ensure that the pipeline only triggers on changes to the source code directory. What is the MOST efficient solution?

Accepted Answer

Configure the S3 event notification to use a prefix filter that matches the source code directory.. S3 event notifications support prefix and suffix filters, allowing you to specify that only objects uploaded to a particular directory (e.g., 'source-code/') trigger the event. By configuring the S3 event notification with a prefix filter matching the source code directory, the pipeline will only start when a new object is uploaded to that specific path, ignoring uploads to other directories. This is the most efficient solution as it avoids unnecessary pipeline executions without adding extra components or manual intervention.

Answer

Use Amazon CloudWatch Events to create a custom rule that matches the source code path and triggers the pipeline.

Answer

Enable versioning on the S3 bucket and configure the pipeline to use the latest version.

Answer

Disable the S3 trigger and manually start the pipeline after each code commit.

Question 18

A DevOps team uses AWS CodePipeline to automate deployments. The pipeline has a Deploy stage that uses AWS CloudFormation to create or update a stack. Recently, a stack update failed because the template referenced an AMI that was deprecated. The team wants to automatically roll back the stack to the last known good state if a deployment fails. What should they do?

Accepted Answer

Configure the CloudFormation deployment action in CodePipeline with 'ActionMode' set to 'CREATE_UPDATE' and check the 'Rollback on failure' option.. The CloudFormation deployment action in CodePipeline supports a 'Rollback on failure' option when 'ActionMode' is set to 'CREATE_UPDATE'. When enabled, if the stack update fails, CloudFormation automatically rolls back the stack to the last known good state (the previously deployed stack). This directly addresses the team's requirement to revert to a stable state after a failed deployment due to a deprecated AMI.

Answer

Use the CodePipeline console to enable 'Automatic rollback' for the Deploy stage.

Answer

Set the stack's 'DisableRollback' parameter to 'true' in the template.

Answer

Add a stack policy to the CloudFormation stack that denies updates to the AMI parameter.

Question 19

A company uses AWS CloudFormation to manage infrastructure. A stack update fails with the error: 'UPDATE_ROLLBACK_IN_PROGRESS'. The DevOps engineer needs to investigate the cause. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Review the CloudFormation console to identify which resource failed.. Options C, D, and E are correct. Option C: Reviewing the CloudFormation console directly shows which resource failed, enabling targeted investigation. Option D: Using '--retain-resources' preserves resources that failed to delete during rollback, allowing further analysis. Option E: Stack events contain detailed error messages and status updates that pinpoint the failure cause. Option A is incorrect because change sets are used to preview changes before execution, not for troubleshooting failures. Option B is incorrect because 'describe-stack-resource' returns details for a specific resource but does not provide the overall failure context and is not a primary troubleshooting step.

Answer

Create a change set to see what changes were attempted.

Answer

Use the 'describe-stack-resource' AWS CLI command to get the resource status.

Question 20

A company uses AWS CodeBuild to run unit tests and package a Java application. The build process takes 15 minutes. The team wants to reduce build time by caching dependencies. Which approach should the engineer recommend?

Accepted Answer

Configure CodeBuild to use Amazon S3 for cache storage and specify the cache directory in buildspec.yml. CodeBuild natively supports Amazon S3 for cache storage, allowing you to persist dependency directories across builds. By specifying the cache type as S3 and the path to the dependency cache (e.g., /root/.m2 for Maven) in the buildspec.yml, subsequent builds can reuse previously downloaded dependencies, significantly reducing build time without additional infrastructure.

Answer

Store the compiled dependencies in a separate CodeCommit repository and clone it during the build

Answer

Mount an Amazon EFS file system to the build container and persist the cache across builds

Answer

Use an Application Load Balancer in front of a private artifact repository