DOP-C02 Practice Test 4 — 25 Questions

Question 1

A company is using Amazon S3 to store sensitive data. The security team mandates that all data must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS). The DevOps engineer must ensure that any new objects uploaded to the bucket are automatically encrypted. What should the engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable default encryption on the S3 bucket and select AWS-KMS as the encryption method.. Enabling default encryption on the S3 bucket with SSE-KMS ensures that all objects uploaded to the bucket are automatically encrypted at rest with AWS KMS. Option A is incorrect because CORS is for cross-origin requests and does not affect encryption. Option B is incorrect because while a bucket policy can enforce encryption headers, it does not provide default encryption; it only denies requests without the header, and default encryption is a simpler and more reliable method. Option D is incorrect because versioning does not encrypt data.

Answer

Enable CORS on the bucket to allow encrypted uploads.

Answer

Apply a bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header with aws:kms.

Answer

Enable S3 Versioning to protect encrypted objects.

Question 2

A company runs a critical microservices architecture on Amazon ECS with Fargate. They want to ensure that if a task fails, it is automatically restarted, and the service remains available across multiple Availability Zones. How should they configure the ECS service?

Accepted Answer

Define an ECS service with a task definition, set desired count across multiple Availability Zones, and use Service Auto Scaling. An ECS service configured with a task definition, desired count across multiple Availability Zones, and Service Auto Scaling ensures resilience. The ECS service scheduler automatically restarts failed tasks, and distributing tasks across AZs provides high availability. Option A is wrong because placing all tasks in a single AZ creates a single point of failure. Option B is wrong because a standalone Fargate task does not have automatic restart; a CloudWatch alarm can restart it but lacks the built-in resilience of an ECS service. Option C is wrong because using a single EC2 instance is a single point of failure and does not provide multi-AZ resilience.

Answer

Place all tasks in the same Availability Zone to reduce latency

Answer

Run a standalone Fargate task and use a CloudWatch alarm to restart it

Answer

Use an EC2 launch type with a single instance to reduce complexity

Question 3

A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the most appropriate service because it is specifically designed to manage secrets like database passwords, with automatic rotation, encryption, and fine-grained access control. Option A (DynamoDB) is a database, not a secrets manager. Option B (S3) can store encrypted data but lacks built-in secret rotation and management. Option C (Systems Manager Parameter Store SecureString) can store secrets but does not support automatic rotation, making Secrets Manager the better choice.

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store (SecureString)

Question 4

A DevOps engineer receives an alert that an EC2 instance has been compromised. The instance is part of an Auto Scaling group. What is the first step the engineer should take to isolate the instance?

Accepted Answer

Detach the instance from the Auto Scaling group and remove it from the load balancer. The first step to isolate a compromised EC2 instance in an Auto Scaling group is to detach it from the Auto Scaling group and remove it from the load balancer. This stops all incoming traffic to the instance, preventing further damage or data exfiltration while preserving the instance for forensic analysis. Option A (snapshot) is useful for preserving evidence but does not isolate the instance. Option C (AMI) similarly does not provide immediate isolation. Option D (terminate) may destroy evidence and should only be done after investigation.

Answer

Create a snapshot of the instance's root volume

Answer

Create an AMI of the instance for analysis

Answer

Terminate the instance immediately

Question 5

A developer is writing an AWS CloudFormation template to create an Amazon S3 bucket. The bucket name must be unique across all AWS accounts. Which property should the developer use to ensure the name is unique?

Accepted Answer

Omit the BucketName property so CloudFormation generates a unique name.. Omit the BucketName property so CloudFormation generates a unique name. Amazon S3 bucket names must be globally unique across all AWS accounts. If you specify a custom BucketName, you must ensure its uniqueness yourself, which is error-prone. By omitting BucketName, CloudFormation automatically generates a unique name that includes a random suffix, guaranteeing global uniqueness. Option A (DeletionPolicy) controls what happens when the stack is deleted, not naming. Option B (setting BucketName to a unique value via parameter) still requires manual uniqueness and is not a property that ensures uniqueness automatically. Option C (UpdateReplacePolicy) controls replacement behavior on updates, not naming. Therefore, omitting BucketName is the simplest way to ensure a unique name.

Answer

Use the DeletionPolicy attribute to retain the bucket.

Answer

Set the BucketName property to a unique value using a parameter.

Answer

Use the UpdateReplacePolicy attribute to control replacement.

Question 6

A company uses Amazon CloudFront to distribute content globally. Users in some regions report slow load times. The DevOps team wants to identify the geographic regions where performance is worst. Which tool should they use?

Accepted Answer

CloudFront reports in the AWS Management Console. CloudFront reports in the AWS Management Console provide performance metrics (e.g., total requests, error rates, latency) broken down by geographic region, enabling the team to identify regions with worst performance. Option A is wrong: CloudWatch metrics for CloudFront are aggregated per distribution, not per region. Option B is wrong: CloudFront access logs in S3 record individual requests but do not aggregate performance by region. Option C is wrong: Amazon Route 53 latency records are used for DNS-based routing decisions, not for analyzing CloudFront performance.

Answer

Amazon CloudWatch Metrics for CloudFront

Answer

CloudFront access logs in S3

Answer

Amazon Route 53 latency records

Question 7

A DevOps engineer needs to ensure that an application running on EC2 can automatically recover from an underlying hardware failure without manual intervention. Which AWS feature should be enabled?

Accepted Answer

Configure EC2 Auto Recovery with a CloudWatch alarm. EC2 Auto Recovery automatically recovers an instance when it becomes impaired due to underlying hardware failure, preserving its instance ID, private IP, and Elastic IP. Option A is incorrect because termination protection only prevents accidental deletion, not recovery. Option C is incorrect because an Auto Scaling group with a minimum size of 1 can replace a failed instance but launches a new instance rather than recovering the same one. Option D is incorrect because CloudWatch detailed monitoring provides more frequent metrics but does not trigger recovery actions.

Answer

Enable termination protection

Answer

Configure an Auto Scaling group with a minimum size of 1

Answer

Enable CloudWatch detailed monitoring

Question 8

A DevOps engineer ran the above command and saw this output. What is the MOST likely cause of the stack creation failure?

Accepted Answer

The launch template name specified in the CloudFormation template is incorrect or does not exist.. The error message indicates that the launch template name specified in the CloudFormation template does not match any existing launch template in the account and Region. CloudFormation resolves the launch template name at stack creation time; if the name is incorrect or the template does not exist, the Auto Scaling group creation fails with a validation error. This is the most direct cause because the launch template name is a required parameter that must reference a pre-existing resource.

Answer

The key pair specified in the launch template does not exist.

Answer

The IAM role does not have permission to create the Auto Scaling group.

Answer

The AMI ID specified in the launch template is not available in this Region.

Question 9

A company stores sensitive data in Amazon S3. A security audit reveals that several S3 buckets are publicly accessible. The DevOps engineer needs to implement a solution that automatically detects and alerts on any S3 bucket that becomes public. Which AWS service should the engineer use?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover, classify, and protect sensitive data, and it can automatically detect and alert on S3 buckets that become publicly accessible. Option B is incorrect because S3 Block Public Access is a preventive control, not detective. Option C is incorrect because AWS Trusted Advisor can check for public buckets but does not provide real-time alerts. Option D is incorrect because AWS Config can track bucket policies but does not automatically alert on public access.

Answer

S3 Block Public Access

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 10

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline has a source stage from CodeCommit, a build stage that runs 'sam build', and a deploy stage that runs 'sam deploy --no-confirm-changeset'. The deploy stage fails with the error 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used by CodeBuild has expired credentials or insufficient permissions to call AWS CloudFormation.. The error 'The security token included in the request is invalid' indicates that the AWS credentials used by CodeBuild to call the CloudFormation API are either expired or lack the necessary permissions. In a CodePipeline with a CodeBuild action, the build project assumes an IAM role to perform actions such as 'sam deploy', which internally calls CloudFormation. If that IAM role's temporary credentials have expired (e.g., due to a long-running build) or the role does not have the required CloudFormation permissions (e.g., cloudformation:CreateChangeSet, cloudformation:ExecuteChangeSet), the API call will fail with this exact error.

Answer

The CloudFormation stack is in a 'ROLLBACK_COMPLETE' state and cannot be updated.

Answer

The CodeBuild project does not have access to the CodeCommit repository.

Answer

The SAM template is invalid and contains syntax errors.

Question 11

A DevOps engineer is troubleshooting a slow web application. The application runs on EC2 instances behind an ALB. The engineer notices that the ALB's TargetResponseTime metric shows high p99 values, but the CPU and memory on the EC2 instances are well below thresholds. What is the most likely cause?

Accepted Answer

The application is waiting on a slow database query or external API call. High p99 TargetResponseTime on the ALB with low CPU and memory on the EC2 instances indicates that the bottleneck is not compute capacity but rather a dependency external to the application server. The application is likely waiting on a slow database query or external API call, which increases response time without consuming significant local CPU or memory. This is a classic symptom of an I/O-bound or network-bound dependency.

Answer

The Auto Scaling group has too many instances, causing increased network overhead

Answer

The ALB is routing requests to instances in different Availability Zones, increasing latency

Answer

The ALB idle timeout is set too low, causing connections to be dropped

Question 12

A company runs a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The function scales up to handle high traffic but sometimes experiences throttling errors (HTTP 429) from Lambda. The company wants to improve the resilience of the application by reducing throttling. The SQS queue is configured as a Lambda event source with a batch size of 10. The Lambda function has a reserved concurrency of 100. Which combination of actions will best reduce throttling? (Choose the single best answer.)

Accepted Answer

Increase the Lambda function's reserved concurrency to 500.. Throttling errors (HTTP 429) occur when Lambda function invocations exceed the account-level concurrency limit or the function's reserved concurrency. By increasing the reserved concurrency from 100 to 500, the function can handle more concurrent invocations, reducing the likelihood of throttling when traffic spikes. This directly addresses the scaling bottleneck without changing the event source or message processing pattern.

Answer

Change the SQS queue to use a FIFO queue to guarantee exactly-once processing.

Answer

Increase the SQS batch size to 50 to process more messages per invocation.

Answer

Use a dead-letter queue (DLQ) for unprocessed messages and set up a CloudWatch alarm to trigger a second Lambda function to reprocess them.

Question 13

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails due to a resource limit exceeded error. Which approach should be used?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack, and subscribe an email endpoint.. CloudFormation natively supports sending stack events (including creation failures) to an SNS topic. By configuring an SNS topic as a notification option in the stack creation request, the DevOps team can subscribe an email endpoint to receive real-time notifications when a resource limit exceeded error occurs, without needing additional services or custom logic.

Answer

Create an Amazon EventBridge rule that matches CloudFormation resource limit exceeded events and sends to SQS.

Answer

Use AWS Config to detect when a stack is in a failed state.

Answer

Enable CloudTrail and create a CloudWatch alarm on the CreateStack API call.

Question 14

A company is running a batch processing job on Amazon EMR that writes results to an Amazon S3 bucket. The job runs daily and takes about 2 hours. The DevOps team wants to be alerted if the job fails or takes longer than 3 hours. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function when the EMR cluster changes to 'TERMINATED' state, then check the job duration and send an alert if it exceeded 3 hours.. It uses CloudWatch Events to detect the EMR cluster's 'TERMINATED' state, which triggers a Lambda function that can check the job duration against the 3-hour threshold and send an alert via SNS if needed. This approach is cost-effective (no polling, event-driven) and operationally efficient, as it decouples monitoring from the job itself and handles both failure and timeout scenarios without modifying the EMR job code.

Answer

Configure Amazon Simple Notification Service (SNS) directly from the EMR job to send notifications on completion.

Answer

Create a CloudWatch alarm on the EMR cluster's EC2 instance CPUUtilization metric to detect abnormal runtime.

Answer

Use Amazon CloudWatch Logs to monitor the job's log stream and create a metric filter for 'FAILED' messages.

Question 15

Which TWO approaches can be used to manage configuration files (e.g., application.properties) across multiple AWS accounts and regions using AWS Systems Manager? (Select TWO.)

Accepted Answer

Use AWS AppConfig to create, manage, and deploy application configurations across accounts and regions.. AWS AppConfig is a feature of AWS Systems Manager that allows you to create, manage, and deploy application configurations across accounts and regions. It supports staged rollouts, validation, and monitoring, making it suitable for managing configuration files like application.properties in multi-account, multi-region environments.

Answer

Use AWS OpsWorks for Chef Automate to store configuration data in Chef data bags.

Answer

Store configuration files in AWS Secrets Manager and retrieve them using the Secrets Manager API.

Answer

Use AWS Systems Manager Run Command to push configuration files to EC2 instances on demand.

Question 16

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 17

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are tamper-proof and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and digital signing to ensure logs have not been tampered with. S3 object lock prevents deletion but not modification. MFA delete protects deletion but not modification. SSE encrypts data at rest but does not protect integrity.

Answer

Server-side encryption (SSE-S3)

Answer

S3 Object Lock

Answer

MFA delete on the S3 bucket

Question 18

A CloudFormation template snippet is shown. An engineer attempts to create a stack with this template and receives an error: 'Bucket my-unique-bucket-name already exists'. What is the most likely cause?

Accepted Answer

The S3 bucket name 'my-unique-bucket-name' is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts and regions. The error 'Bucket my-unique-bucket-name already exists' indicates that the name is already taken by another AWS account, not that the bucket already exists in the current account. CloudFormation cannot create the bucket because the name is not available in the global S3 namespace.

Answer

The bucket policy has a syntax error that prevents the bucket from being created.

Answer

The versioning configuration is incompatible with the bucket policy.

Answer

The bucket policy references the bucket name incorrectly, causing a circular dependency.

Question 19

A company uses AWS CodeBuild to run tests as part of their CI/CD pipeline. They want to store build artifacts in an S3 bucket and ensure that only the latest successful build artifacts are retained. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure CodeBuild to output artifacts to a specific S3 bucket.. CodeBuild can be configured to output artifacts directly to a specified S3 bucket. Option B is correct because an S3 lifecycle policy can be used to automatically delete old artifacts, ensuring only the latest successful build is retained. Option D is incorrect because enabling versioning would keep all versions, contrary to the requirement of retaining only the latest. Option C is incorrect because CodeCommit is for source code, not build artifacts. Option E is incorrect because CloudWatch Logs store logs, not artifacts.

Answer

Store artifacts in an AWS CodeCommit repository.

Answer

Enable versioning on the S3 bucket to keep all versions.

Answer

Use CloudWatch Logs to store build logs.

Question 20

A company wants to implement a configuration management strategy for their EC2 instances that are part of an Auto Scaling group. They need to ensure that new instances are automatically configured with the latest software packages and settings without manual intervention. Which TWO approaches meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS CodeDeploy with an Auto Scaling lifecycle hook to deploy applications to new instances.. Options B and C are correct. Option B uses AWS CodeDeploy with an Auto Scaling lifecycle hook to automatically deploy applications to new instances as they launch. Option C uses EC2 user data scripts to install software and apply configurations during instance launch. Option A is incorrect because AWS OpsWorks is a configuration management service, but it does not automatically integrate with Auto Scaling groups without additional configuration; it is not the simplest automated approach. Option D is incorrect because AWS Config is used for compliance and auditing, not for proactively configuring instances. Option E is incorrect because AWS Systems Manager Run Command requires manual or scheduled execution and does not automatically run on instance launch.

Answer

Use AWS OpsWorks to manage configurations and associate with the Auto Scaling group.

Answer

Use AWS Config rules to enforce configuration settings.

Answer

Use AWS Systems Manager Run Command on a schedule to apply configurations.