DOP-C02 Practice Test 30 — 15 Questions

Question 1

Which TWO are benefits of using AWS CloudFormation for infrastructure as code? (Select TWO.)

Accepted Answer

Enables declarative infrastructure definition.. AWS CloudFormation uses a declarative approach to infrastructure as code, where you define the desired end state of your resources in a template (JSON or YAML), and CloudFormation handles the provisioning and configuration to achieve that state. This contrasts with imperative scripting, where you must specify every step. Declarative definitions reduce complexity and improve reliability by letting the service manage the orchestration.

Answer

Manages both AWS and on-premises resources.

Answer

Provides a graphical interface for designing infrastructure.

Answer

Automatically optimizes resource costs.

Question 2

A company is using Amazon CloudWatch to monitor its production environment. The operations team receives alerts for the same underlying issue from multiple alarms, causing alert fatigue. The team wants to reduce noise and consolidate alerts into actionable notifications. Which TWO steps should the team take? (Choose two.)

Accepted Answer

Configure the CloudWatch alarms to publish to an SNS topic, and use SNS subscription filter policies to route only critical notifications.. You can configure CloudWatch alarms to publish to an SNS topic and use SNS subscription filter policies to route only critical notifications, thereby reducing noise. Option C is correct because CloudWatch composite alarms allow you to combine multiple alarms into a single alarm that triggers only when specific conditions (e.g., AND/OR logic) are met, consolidating alerts for the same underlying issue. Option B is incorrect because CloudWatch Evidently is used for running experiments and feature flags, not for alert consolidation. Option D is incorrect because CloudWatch Logs Insights is a tool for querying log data, not for combining alarms. Option E is incorrect because AWS Config rules are designed to evaluate resource compliance, not to suppress alarms.

Answer

Use CloudWatch Evidently to run experiments and filter out false alarms.

Answer

Use CloudWatch Logs Insights to query logs and create alarms based on the query results.

Answer

Use AWS Config rules to automatically suppress alarms that are not compliant.

Question 3

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices an increase in false positives blocking legitimate traffic. Which action should be taken to reduce false positives while maintaining security?

Accepted Answer

Adjust the rate-based rule threshold to a higher value.. Adjusting the rate-based rule threshold to a higher value allows more legitimate traffic while still blocking excessive requests. Option A: Removing the rule would weaken security. Option B: AWS Shield Advanced is a DDoS protection service, not a replacement for fine-tuning WAF rules. Option D: Changing action to 'Count' logs requests but does not block them, reducing security.

Answer

Remove the rate-based rule that is causing false positives.

Answer

Replace AWS WAF with AWS Shield Advanced.

Answer

Change the rule action from 'Block' to 'Count'.

Question 4

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences intermittent failures when the ECS service scheduler attempts to place tasks during a deployment. The DevOps engineer notices that tasks fail to start due to insufficient IP addresses in the VPC subnets. What is the MOST resilient solution to prevent this issue?

Accepted Answer

Configure the ECS service to use multiple subnets with larger CIDR blocks across multiple Availability Zones.. Using a larger CIDR block for subnets provides more IP addresses, and using multiple subnets across Availability Zones increases availability and capacity. Option A is wrong because increasing desired count does not solve IP shortage. Option B is wrong because ECS service-linked role does not affect IP allocation. Option C is wrong because VPC endpoints do not provide IP addresses for tasks.

Answer

Create an ECS service-linked role with permissions to allocate IPs.

Answer

Increase the desired task count in the ECS service to pre-warm IP addresses.

Answer

Use VPC endpoints for ECS to reduce IP usage.

Question 5

A company is designing a highly available architecture for a web application using AWS services. The application must be resilient to the failure of an entire AWS Region. Which TWO strategies should the company implement? (Choose TWO.)

Accepted Answer

Deploy the application in multiple AWS Regions and use Route 53 with failover routing policy.. Deploying to multiple regions with Route 53 failover provides cross-region disaster recovery. Option D is correct because using Amazon RDS Multi-AZ with cross-Region read replicas or Aurora Global Database ensures database resilience across regions. Option B is wrong because CloudFront alone does not provide compute failover. Option C is wrong because S3 cross-Region replication is for data, not compute. Option E is wrong because single-region Auto Scaling does not protect against region failure.

Answer

Use Amazon CloudFront with multiple origins in the same region.

Answer

Enable S3 cross-Region replication for static assets.

Answer

Use Auto Scaling groups in a single region with multiple Availability Zones.

Question 6

A company uses Amazon CloudFront to distribute content from an S3 bucket origin. Some users report intermittent access errors. The DevOps team suspects the origin is overwhelmed. What is the MOST effective way to improve resilience?

Accepted Answer

Configure CloudFront to perform health checks on the origin.. Configuring CloudFront to perform health checks on the origin allows it to detect origin issues and trigger failover to a secondary origin, improving resilience. CloudFront origin groups support failover based on error rates, effectively acting as health checks. Option A is incorrect because an ALB is not required for origin failover; CloudFront can directly use multiple S3 buckets as origins. Option B (reducing TTL) increases requests to the origin, worsening the problem. Option C (increasing TTL) reduces load but does not address origin failures or provide failover.

Answer

Set up an origin failover with two S3 buckets behind an Application Load Balancer (ALB).

Answer

Reduce the CloudFront cache TTL to serve fresher content.

Answer

Increase the CloudFront cache TTL to reduce requests to the origin.

Question 7

A company is deploying a web application on Amazon ECS with Fargate. The application consists of a frontend service and a backend service. The DevOps team needs to ensure that the frontend service can communicate with the backend service securely without exposing the backend to the internet. Which THREE steps should the team take? (Choose THREE.)

Accepted Answer

Deploy the backend service in a private subnet with no internet access.. Deploying the backend service in a private subnet with no internet access ensures that the backend is not reachable from the internet, which is a fundamental security requirement. In Amazon ECS with Fargate, tasks in a private subnet use an elastic network interface (ENI) with no public IP address, and outbound traffic can be routed through a NAT gateway if needed, but inbound traffic from the internet is blocked. This isolates the backend from direct external exposure while still allowing communication from the frontend service within the same VPC.

Answer

Deploy the backend service in a public subnet with an internet-facing Application Load Balancer.

Answer

Use an internet-facing Network Load Balancer for the backend service.

Question 8

Refer to the exhibit. A CloudTrail trail named ManagementTrail is configured as shown. Which events will be logged?

Accepted Answer

All management events for the account.. The CloudTrail trail named ManagementTrail is configured to log management events, and by default, when you create a trail in the CloudTrail console, it logs both read and write management events unless you specifically choose to log only one type. The exhibit shows no filtering for read-only or write-only events, so all management events (both read and write) for the account will be logged. This is the standard behavior for a trail that does not have an event selector restricting the event type.

Answer

Only read management events.

Answer

Only write management events.

Answer

Only S3 data events.

Question 9

Which THREE measures can be taken to ensure that EC2 instances are compliant with a security policy that requires all instances to be in a VPC with specific tags? (Select THREE.)

Accepted Answer

Use AWS Config rules to detect non-compliant instances.. AWS Config rules can evaluate EC2 instances against a desired configuration, such as being in a VPC with specific tags. By using a custom or managed rule (e.g., 'required-tags' or 'ec2-instance-in-vpc'), you can detect non-compliant instances and trigger remediation actions. This provides continuous monitoring and reporting of compliance status without blocking the launch itself.

Answer

Use EC2 Auto Scaling to launch instances only in the correct VPC.

Answer

Use CloudWatch alarms to monitor instance launches.

Question 10

Match each AWS CloudFormation concept to its description.

Accepted Answer

Change Set: A preview of how changes to a stack will be applied. Change Set previews stack changes; Stack is a resource collection; Stack Set manages stacks across accounts; Template is a JSON/YAML description.

Answer

Stack Set: A JSON or YAML text file that describes the infrastructure

Answer

Template: Allows you to create, update, or delete stacks across multiple accounts and regions

Question 11

A DevOps engineer creates the CloudFormation template shown in the exhibit. When the stack is created, the EC2 instance is launched but the security group is not applied to the instance. What is the likely cause?

Accepted Answer

The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.. The CloudFormation template does not include a `SecurityGroup` or `SecurityGroupIds` property in the EC2 instance's `AWS::EC2::Instance` resource. Without this explicit reference, the instance launches with the default VPC security group, not the custom security group defined in the template. The security group resource is created successfully, but it is not attached to the instance.

Answer

The security group resource is missing a VpcId property, so it is not created in the same VPC as the instance.

Answer

The security group is created after the instance, so the instance cannot reference it.

Answer

The DependsOn clause should be removed because it causes a circular dependency.

Question 12

Which TWO actions can be used to improve the security of a CI/CD pipeline that uses AWS CodePipeline? (Choose two.)

Accepted Answer

Enable encryption for artifacts stored in the pipeline's S3 bucket.. AWS CodePipeline stores artifacts in an S3 bucket, and enabling default encryption (SSE-S3 or SSE-KMS) ensures that all objects at rest are encrypted, protecting sensitive build outputs and source code from unauthorized access if the bucket is compromised. This is a fundamental security best practice for data at rest in any CI/CD pipeline.

Answer

Configure the source action to poll for changes instead of using webhooks.

Answer

Store secrets in the pipeline environment variables in plain text.

Answer

Use a single IAM role for all pipeline actions to simplify permissions.

Question 13

A company uses AWS CodePipeline with multiple stages: Source (CodeCommit), Build (CodeBuild), Test (CodeBuild), and Deploy (CodeDeploy to EC2). The Test stage runs integration tests that require network access to a private database in a VPC. The CodeBuild project is configured to use a VPC. However, the Test stage fails intermittently with timeout errors. Which TWO actions would MOST likely resolve the issue? (Choose 2)

Accepted Answer

Increase the timeout for the Test stage in the CodeBuild project to accommodate network delays.. The intermittent timeout errors suggest that the Test stage's integration tests are occasionally taking longer than the configured timeout. Increasing the timeout accommodates these delays, preventing premature failures. Option C is correct because a NAT gateway is required for CodeBuild in a VPC to access resources outside the VPC, such as the private database, if the database is in a different subnet or requires internet-routable traffic.

Answer

Remove the VPC configuration from the CodeBuild project and use a public subnet instead.

Answer

Use a larger compute type for the CodeBuild project to improve network performance.

Answer

Configure the security group for the CodeBuild project to allow outbound traffic to the database security group on the required port.

Question 14

A company has a monorepo in AWS CodeCommit with multiple microservices. They want to use AWS CodePipeline to build and deploy only the microservice that changed. What is the MOST efficient approach?

Accepted Answer

Use an AWS Lambda function triggered by CloudWatch Events for CodeCommit to start the specific pipeline for the changed microservice.. It uses an AWS Lambda function triggered by CloudWatch Events (now Amazon EventBridge) on CodeCommit repository events (e.g., push to a specific branch) to detect which microservice changed and then start the corresponding CodePipeline pipeline. This is the most efficient approach as it avoids unnecessary builds of unchanged microservices and does not require splitting the monorepo or adding complex conditional logic within a single pipeline.

Answer

Configure a single pipeline that always builds all microservices.

Answer

Create separate CodeCommit repositories for each microservice.

Answer

Use a single pipeline with multiple build actions that each check if their microservice changed.

Question 15

A company uses AWS CodeCommit for source control. Developers report that their local branches are out of sync with the remote repository, and they are unable to push changes because of 'non-fast-forward' errors. What should the developers do to fix this?

Accepted Answer

Pull the latest changes using 'git pull --rebase' and then push.. The 'non-fast-forward' error occurs when the local branch is behind the remote branch, meaning the remote has commits the local doesn't have. Running 'git pull --rebase' fetches the latest remote changes and replays the local commits on top of them, creating a linear history. After this, the local branch is up to date and the push will succeed without needing to force or create a new branch.

Answer

Create a new branch and push that instead.

Answer

Use 'git push --force' to overwrite the remote branch.

Answer

Delete the remote branch and push again.