DOP-C02 Practice Test 28 — 15 Questions

Question 1

A Lambda function is timing out. The log above shows a recent invocation. What is the most likely cause?

Accepted Answer

The function timeout is set too low.. The log shows the function timed out at 3000 ms, which is the default Lambda timeout (3 seconds). The correct answer is D because the timeout value is set too low, causing the function to be terminated before it can complete. Option A is incorrect because memory usage is only 64 MB out of 128 MB, so insufficient memory is not the issue. Option B is incorrect because there is only one invocation shown; frequent invocations would cause throttling, not a timeout. Option C is incorrect because the init duration is normal (e.g., 2.34 ms), indicating that a cold start is not the cause; cold starts increase latency but do not cause timeouts if the function runs within the timeout limit.

Answer

The function is running out of memory.

Answer

The function is being invoked too frequently.

Answer

The function is experiencing a cold start.

Question 2

A DevOps engineer is tasked with ensuring that all Amazon S3 buckets in the account have server access logging enabled. The engineer needs to be automatically notified when a new bucket is created without logging enabled. Which AWS service should they use?

Accepted Answer

Use AWS Config with a managed rule to check if S3 bucket logging is enabled, and configure an SNS topic for notifications.. AWS Config provides continuous monitoring and evaluation of your AWS resource configurations. By using the managed rule 's3-bucket-server-access-logging-enabled', AWS Config can automatically check all S3 buckets (including newly created ones) for server access logging. When a bucket is non-compliant, AWS Config can trigger an SNS notification to alert the DevOps engineer, meeting the requirement for automatic notification without custom code.

Answer

Use AWS CloudTrail to detect CreateBucket API calls and trigger a Lambda function to check logging.

Answer

Use AWS Trusted Advisor to check S3 bucket logging and send notifications via Amazon SNS.

Answer

Use Amazon S3 Event Notifications to trigger a Lambda function when a new bucket is created.

Question 3

A company uses AWS Config to evaluate compliance of their AWS resources. They have a custom rule that checks whether EC2 instances have a specific tag. They notice that the rule is not triggering on existing instances. What is a possible reason?

Accepted Answer

The rule is not configured with a trigger type of 'Configuration changes' or 'Periodic'. AWS Config custom rules require a trigger type to evaluate resources. If a rule is not configured with either 'Configuration changes' (triggered when a resource changes) or 'Periodic' (triggered on a schedule), it will never evaluate resources, including existing instances. Without a trigger, the rule remains inactive and cannot perform compliance checks.

Answer

AWS Config does not support custom rules

Answer

The Lambda function does not have permission to describe EC2 instances

Answer

The EC2 instances are not in the resource types being recorded by AWS Config

Question 4

A company uses EC2 instances in an Auto Scaling group behind an ALB. The DevOps team receives alerts that the CPU utilization on the instances is consistently above 90% during peak hours. The Auto Scaling group is configured with a simple scaling policy that adds one instance when CPU exceeds 80% and removes one when below 30%. However, during sudden traffic spikes, the scaling policy reacts too slowly, causing performance degradation. The team wants to improve the scaling responsiveness without over-provisioning. What should the team do?

Accepted Answer

Replace the simple scaling policy with a target tracking scaling policy based on average CPU utilization with a target value of 70%.. A target tracking scaling policy automatically adjusts the size of the Auto Scaling group to keep the average CPU utilization close to the target value (70%). This provides a proactive and responsive scaling mechanism for sudden traffic spikes without manual intervention. Option A is incorrect because increasing the cooldown period would delay scaling actions, worsening the response time. Option B is incorrect because although a step scaling policy can add multiple instances at once, it requires manual configuration of thresholds and step adjustments, and it may not adapt as smoothly to varying spikes as target tracking. Option C is incorrect because scheduled scaling only addresses predictable traffic patterns, not sudden, unpredictable spikes.

Answer

Increase the cooldown period for the simple scaling policy to allow more time for metrics to stabilize.

Answer

Replace the simple scaling policy with a step scaling policy that adds multiple instances when CPU exceeds 80%.

Answer

Create a scheduled scaling action to add instances before peak hours based on historical data.

Question 5

An application log excerpt shows repeated HTTP 500 errors for the /api/orders endpoint, with occasional successful health checks. The application runs on EC2 instances behind an ALB. What is the MOST likely cause of this pattern?

Accepted Answer

The backend service that the /api/orders endpoint depends on is unavailable or failing.. The pattern of repeated HTTP 500 errors for /api/orders with occasional successful health checks strongly indicates that the backend service dependency (e.g., a database, cache, or another microservice) is intermittently failing or unavailable. HTTP 500 errors are server-side errors, meaning the application code is running but cannot complete the request due to a downstream failure. Successful health checks confirm the EC2 instances themselves are healthy and in-service, ruling out instance-level or ALB misconfiguration issues.

Answer

The EC2 instances are running out of memory and the application is crashing.

Answer

The ALB is misconfigured and routing requests to the wrong target group.

Answer

The EC2 instances are not passing health checks and are being deregistered from the target group.

Question 6

A DevOps engineer is troubleshooting a CodePipeline that has a Build stage using AWS CodeBuild. The build logs show 'Error: No such file or directory' for a file that is present in the source repository. What is the most likely cause?

Accepted Answer

The buildspec.yaml specifies an incorrect path for the file relative to the source root.. The error 'No such file or directory' indicates that the build process is attempting to access a file at a path that does not exist relative to the source root. In AWS CodeBuild, the build runs in a temporary directory that contains the source code, and all paths in the buildspec.yaml are relative to the source root by default. If the buildspec.yaml specifies an incorrect relative path (e.g., using an absolute path or a wrong subdirectory), CodeBuild will fail to locate the file, even though it exists in the repository.

Answer

The build commands are not executed because the pre_build phase failed.

Answer

The artifact definition in the buildspec.yaml is incorrect.

Answer

The environment variables in CodeBuild are not set correctly.

Question 7

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most likely security concern?

Accepted Answer

The bucket is now publicly accessible. The CloudTrail log entry shows a PutBucketPolicy action that sets a bucket policy with principal '*', granting public read access to all objects in the bucket. This is a security concern because the bucket becomes publicly accessible, allowing anyone on the internet to read objects. Option A is correct because the bucket policy makes the bucket publicly accessible. Option B is incorrect because the bucket policy does not grant the root user full access; it grants public access. Option C is incorrect because the action is performed by an IAM user (the user field shows 'arn:aws:iam::123456789012:user/admin'), not the root user. Option D is incorrect because the policy allows all principals (public) to read objects, not just authenticated users.

Answer

The bucket policy grants the root user full access

Answer

The root user performed an action that should have been done by an IAM user

Answer

The bucket policy allows only authenticated users to read objects

Question 8

A DevOps engineer notices that an EC2 instance is unresponsive and the CloudWatch alarm 'StatusCheckFailed' is in ALARM state. The instance was launched in a private subnet with no public IP. Which action should the engineer take to diagnose the issue without creating a new instance?

Accepted Answer

Use EC2 Serial Console to connect to the instance.. EC2 Serial Console provides out-of-band access to the instance console, allowing troubleshooting of OS-level issues even when network connectivity is lost. Option A is wrong because modifying the security group to allow SSH from the engineer's IP does not help if the instance is unresponsive at the OS level. Option B is wrong because Systems Manager Session Manager requires the instance to have connectivity to the Systems Manager endpoint and the agent running. Option C is wrong because AWS Personal Health Dashboard provides service health notifications, not instance-level troubleshooting.

Answer

Modify the security group to allow SSH from the engineer's IP.

Answer

Use AWS Systems Manager Session Manager to start a session.

Answer

Check AWS Personal Health Dashboard for instance issues.

Question 9

A company is implementing a CI/CD pipeline using AWS CodePipeline. The source code is stored in an AWS CodeCommit repository. The pipeline must automatically start whenever a change is pushed to any branch. Which configuration is required?

Accepted Answer

Create a CloudWatch Events rule that matches CodeCommit push events and targets the CodePipeline pipeline.. AWS CodePipeline can be triggered automatically by Amazon CloudWatch Events when a CodeCommit repository receives a push event. By creating a CloudWatch Events rule that matches the `codecommit:GitPush` event source and targets the pipeline, the pipeline starts automatically on any branch push without polling or manual intervention.

Answer

Add a branch creation trigger in CodeCommit that starts the pipeline.

Answer

Create an SNS topic and subscribe the pipeline to it, then configure CodeCommit to publish to the topic on push.

Answer

Configure the pipeline to poll the CodeCommit repository every few minutes.

Question 10

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores sensitive user data in an S3 bucket. A Security Engineer needs to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. Which solution meets these requirements?

Accepted Answer

Create an IAM role with a policy that grants s3:PutObject and s3:GetObject access to the specific bucket, and attach the role to the EC2 instances as an instance profile.. Creating an IAM role with a policy that grants s3:PutObject and s3:GetObject access only to the specific S3 bucket, and attaching that role to the EC2 instances as an instance profile, ensures that the instances can only access that bucket. This method uses AWS Identity and Access Management (IAM) to restrict permissions per resource. Option A is incorrect because an S3 bucket policy restricting access to the ALB's security group cannot control what the instances themselves do; the instances can still access S3 directly if they have credentials. Option C is incorrect because a VPC endpoint for S3 provides private connectivity but does not restrict which resources the instances can access; it only ensures traffic stays within the AWS network. Option D is incorrect because security groups cannot filter traffic based on S3 bucket names or policies; they only filter IP addresses and ports, and S3 uses HTTPS which is not restrictable by security group to a specific bucket.

Answer

Attach a bucket policy to the S3 bucket that allows access only from the ALB's security group.

Answer

Configure a VPC endpoint for S3 and modify the route table to route S3 traffic through the endpoint.

Answer

Create a security group that allows outbound HTTPS traffic only to the S3 bucket's IP address range.

Question 11

Which TWO AWS services can be used as source actions in AWS CodePipeline to automatically trigger a pipeline when changes are made? (Choose two.)

Accepted Answer

Amazon S3. Amazon S3 is a valid source action in AWS CodePipeline because you can configure a pipeline to start when a new object is created or an existing object is updated in an S3 bucket. This is achieved by enabling Amazon S3 event notifications (via Amazon S3 Event Notifications) that send events to Amazon CloudWatch Events or directly to AWS CodePipeline using a CloudWatch Events rule, which then triggers the pipeline execution. This allows automatic pipeline runs on code or artifact changes stored in S3.

Answer

Amazon CloudWatch

Answer

Amazon EC2

Answer

AWS CloudFormation

Question 12

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. The instance is part of an Auto Scaling group with a minimum size of 2. What is the quickest way to restore service with minimal data loss?

Accepted Answer

Terminate the instance and let the Auto Scaling group launch a new one.. Terminating the unresponsive instance triggers the Auto Scaling group to automatically launch a replacement instance, restoring service with minimal data loss. Since the Auto Scaling group has a minimum size of 2, it will immediately detect the terminated instance and launch a new one using the launch template or configuration, ensuring the desired capacity is maintained without manual intervention.

Answer

Stop and start the instance from the EC2 console.

Answer

Create a new AMI from the instance and launch a replacement manually.

Answer

Restore the instance from the most recent EBS snapshot.

Question 13

A company uses AWS Elastic Beanstalk to deploy a Java web application. The DevOps team wants to ensure that configuration changes are tracked and can be rolled back if needed. Which Elastic Beanstalk feature should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations to capture environment settings and restore them if needed.. Elastic Beanstalk saved configurations allow you to capture the environment's configuration settings (e.g., instance type, environment variables, platform version) as a JSON file stored in S3. This enables you to restore or recreate an environment with the exact same settings, providing a straightforward rollback mechanism for configuration changes without relying on external tools or pipelines.

Answer

Use AWS CodeCommit to store configuration files and version them.

Answer

Use AWS CodePipeline with a manual approval stage to track changes.

Answer

Use AWS CloudFormation change sets to review changes before deployment.

Question 14

Refer to the exhibit. A DevOps engineer runs this query to investigate a spike in errors. What is the most likely interpretation?

Accepted Answer

The error rate is increasing sharply in the last 15 minutes.. The query counts ERROR messages per 5-minute bin for a specific log stream. The output shows a clear increasing trend from 1 to 12 errors over the last 20 minutes, indicating a recent escalation of errors.

Answer

The error rate is decreasing over time.

Answer

The error rate is stable with no significant change.

Answer

The query is incorrectly filtering log streams.

Question 15

Which TWO measures can be taken to protect data at rest in Amazon S3? (Select TWO.)

Accepted Answer

Enable S3 Server-Side Encryption (SSE-S3 or SSE-KMS). S3 Server-Side Encryption (SSE) and S3 Bucket Policies to deny unencrypted PUT requests are measures to protect data at rest. MFA Delete protects against accidental deletion, not encryption. Cross-region replication is for disaster recovery. S3 Transfer Acceleration speeds up uploads.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the bucket

Answer

Use S3 Transfer Acceleration