DOP-C02 Practice Test 1 — 30 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. They want to receive notifications when a stack operation fails, including the specific resource that caused the failure. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack and subscribe to receive stack events.. CloudFormation allows you to specify an SNS topic ARN as a notification option when creating or updating a stack. When a stack operation fails, CloudFormation publishes a notification to that SNS topic, and the notification includes the logical resource ID and the status reason for the failure. This provides real-time, event-driven notifications without requiring polling or additional services.

Answer

Create a CloudWatch alarm on the 'StackFailure' metric.

Answer

Create an AWS Lambda function that polls the CloudFormation DescribeStackEvents API every minute and sends an email on failure.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and configure an SNS notification on the trail.

Question 2

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

Accepted Answer

The Deny statement's Resource specifies only the objects, not the bucket itself. The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.

Answer

The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'

Answer

The bucket is not versioned, so the policy does not apply to object versions

Answer

The policy uses Deny, but an Allow policy from another statement overrides it

Question 3

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

Accepted Answer

Define environment variables in the source code using .ebextensions configuration files.. Ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Answer

Update the environment variables manually in the Elastic Beanstalk console after each deployment.

Answer

Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.

Answer

Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Question 4

A company runs a containerized microservices application on Amazon EKS. The application includes a critical service that processes real-time financial transactions. This service must be highly available and resilient to node failures. The current setup uses a Deployment with 3 replicas and a ClusterIP service. During a recent node failure, the application experienced a brief period of unavailability. Which action should the DevOps engineer take to improve resilience without changing the underlying infrastructure?

Accepted Answer

Configure a PodDisruptionBudget with a maxUnavailable of 1, and add pod anti-affinity rules to spread pods across different nodes.. A PodDisruptionBudget with maxUnavailable=1 ensures that at most one pod is unavailable during voluntary disruptions, while pod anti-affinity rules force the scheduler to distribute pods across different nodes. This combination prevents a single node failure from taking down all replicas, maintaining service availability without altering the underlying infrastructure.

Answer

Change the service type from ClusterIP to NodePort and configure an external load balancer.

Answer

Increase the number of replicas to 10 and use a node selector to schedule all pods on the largest instance type.

Answer

Enable HorizontalPodAutoscaler with a target CPU utilization of 50% to automatically scale the Deployment.

Question 5

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that critical resources, such as an RDS database, are not accidentally deleted when a stack is updated or deleted. Which CloudFormation feature should be used to prevent this?

Accepted Answer

DeletionPolicy attribute with Retain. The DeletionPolicy attribute with the Retain value is the correct choice because it explicitly instructs CloudFormation to preserve the physical resource (e.g., an RDS database) when its corresponding logical resource is deleted from the stack template during an update or when the entire stack is deleted. This prevents accidental deletion of critical stateful resources by ensuring the resource remains in the AWS account even after the stack operation completes.

Answer

Stack policy

Answer

Termination protection

Answer

DependsOn attribute

Question 6

A company is migrating its on-premises applications to AWS and wants to maintain the same level of monitoring for its Linux-based EC2 instances. They currently use Nagios for monitoring. They want a managed AWS service that can monitor instance health, system metrics, and application logs. Which solution should they use?

Accepted Answer

Install the Amazon CloudWatch agent on each EC2 instance to collect system metrics and logs, and send them to CloudWatch.. The Amazon CloudWatch agent (unified CloudWatch agent) can collect system metrics (CPU, memory, disk) and logs from EC2 instances and send them to CloudWatch, providing a managed monitoring solution similar to Nagios. Option B is incorrect because AWS CloudTrail is for auditing API calls, not for monitoring system metrics or logs. Option C is incorrect because AWS Systems Manager Inventory collects software inventory and configuration data, not real-time metrics or logs. Option D is incorrect because AWS Config tracks resource configuration changes for compliance, not for monitoring system health.

Answer

Use AWS CloudTrail to monitor instance activity and capture log files.

Answer

Use AWS Systems Manager Inventory to collect system configuration and log files.

Answer

Use AWS Config to track instance configuration changes and trigger alerts.

Question 7

A security audit reveals that an S3 bucket contains objects that are publicly accessible. The DevOps engineer must prevent any future public access to the bucket and all objects within it. Which THREE actions should the engineer take? (Choose THREE.)

Accepted Answer

Enable Block Public Access settings on the bucket.. Enabling block public access settings on the bucket prevents any future public access, including through ACLs or bucket policies. Option C is correct because removing any bucket policy that grants public read access eliminates one potential vector for public access. Option D is correct because applying an SCP that denies s3:PutBucketPolicy actions that would make objects public ensures that no account in the organization can create a policy that grants public access. Option B is incorrect because disabling object ACLs only removes one method of granting public access; bucket policies can still allow public access. Option E is incorrect because enabling server access logging helps with auditing but does not prevent public access.

Answer

Disable object ACLs on the bucket.

Answer

Enable S3 server access logging.

Question 8

A company's DevOps team is designing a disaster recovery plan for a critical application. The application runs on EC2 instances with an RDS MySQL database. The Recovery Time Objective (RTO) is 15 minutes, and the Recovery Point Objective (RPO) is 1 hour. Which approach BEST meets these requirements?

Accepted Answer

Use a multi-Region application with Route 53 latency-based routing and RDS read replicas in the DR Region.. The best approach for a multi-Region disaster recovery with RTO of 15 minutes and RPO of 1 hour. By deploying the application in multiple regions and using RDS cross-Region read replicas, data is asynchronously replicated with an RPO typically within seconds to minutes, well within 1 hour. In the event of a failure, the read replica can be promoted to a primary instance, and Route 53 routing (preferably failover routing, but latency-based routing can also redirect traffic) can shift traffic to the DR region. This failover can be completed within a few minutes, meeting the 15-minute RTO. Option A fails because daily snapshots exceed the 1-hour RPO and restore times exceed the RTO. Option C incorrectly relies on RDS Multi-AZ, which is a single-region high-availability feature and does not provide cross-region replication; thus it cannot serve as a disaster recovery solution across regions. Option D, pilot light with snapshots, has a longer RTO as it requires restoring instances from snapshots and starting them, likely exceeding 15 minutes.

Answer

Use backup and restore with daily snapshots stored in S3 and cross-Region replication.

Answer

Use a warm standby strategy with a scaled-down copy of the production environment in the DR Region, and replicate data using RDS Multi-AZ with synchronous replication.

Answer

Use a pilot light strategy with EC2 instances stopped and RDS snapshots copied to the DR Region.

Question 9

Refer to the exhibit. A DevOps engineer is troubleshooting an issue where an IAM user is unable to stop an EC2 instance with the tag 'Environment: Development'. The attached IAM policy is shown. Which statement explains the failure?

Accepted Answer

The Allow statement only grants ec2:DescribeInstances, not start/stop.. The IAM policy in the exhibit only grants ec2:DescribeInstances and explicitly denies ec2:RunInstances with a condition. It does not include an Allow for ec2:StopInstances. By default, IAM denies any action that is not explicitly allowed. Therefore, the user lacks permission to stop instances, including the Development-tagged instance. Option C correctly identifies this as the reason for the failure. Option D is incorrect because the policy itself denies stop implicitly due to the missing Allow; it is not necessary to invoke another policy or SCP.

Answer

The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.

Answer

The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.

Answer

The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?

Accepted Answer

Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.. AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.

Answer

Use IAM Access Analyzer to validate the roles against a policy template.

Answer

Run AWS Trusted Advisor and check the IAM report for roles with long session durations.

Answer

Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.

Question 11

An organization is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target group is not configured correctly. Which CodeDeploy component is responsible for registering instances with the load balancer?

Accepted Answer

The deployment group configuration. The deployment group configuration in AWS CodeDeploy specifies the target group or load balancer for the deployment. CodeDeploy automatically registers instances in the Auto Scaling group with the specified target group as part of the deployment process. The AppSpec file hooks section defines custom lifecycle event hooks for scripts, but instance registration is handled by the CodeDeploy service based on the deployment group settings, not by hooks.

Answer

The CodeDeploy agent configuration

Answer

The AppSpec file hooks section

Answer

The application revision bundle

Question 12

Refer to the exhibit. A DevOps engineer deploys this CloudFormation template. The EC2 instance launches, but the httpd service does not start. The engineer connects to the instance and finds that the user data script did not run. What is the most likely cause?

Accepted Answer

The AMI does not have yum installed. The most likely cause is that the AMI does not have yum installed. The CloudFormation template's UserData script uses yum to install httpd, but if the AMI is based on a distribution that does not use yum (e.g., Amazon Linux 2023 uses dnf, or Ubuntu uses apt), the script will fail silently or not execute as intended. Since the script itself is valid and the instance launched, the failure is due to the package manager not being available, preventing the httpd service from starting.

Answer

The UserData is not base64 encoded correctly

Answer

The tags prevent user data from executing

Answer

The AMI uses a different init system than systemd

Question 13

A team uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests against a staging environment. Occasionally, the tests fail due to environment issues, not code issues. The team wants to automatically retry the Test stage up to two times if it fails, but not the Deploy stage. How can this be achieved?

Accepted Answer

Create a CloudWatch Events rule that triggers a Lambda function to retry the failed stage.. The correct approach is to use Amazon EventBridge (formerly CloudWatch Events) to detect a stage failure in CodePipeline and trigger an AWS Lambda function that calls the RetryStageExecution API. This provides automatic retries without manual intervention. CodePipeline's built-in retry setting on a stage action is not automatic; it only allows manual retries via the console or API. Option D (Step Functions) is a valid alternative but adds unnecessary complexity for this use case.

Answer

Configure the Retry setting in the Test stage's action configuration.

Answer

Enable the 'Retry on failure' option in the CodePipeline pipeline settings.

Answer

Use AWS Step Functions to orchestrate the pipeline and implement retries.

Question 14

A DevOps team is implementing a blue/green deployment strategy for a microservice running on Amazon ECS with AWS CodeDeploy. They want to shift 10% of traffic to the new task set for 5 minutes, then shift the remaining 90%. Which deployment configuration should they use?

Accepted Answer

CodeDeployDefault.ECSCanary10Percent5Minutes. The built-in configuration `CodeDeployDefault.ECSCanary10Percent5Minutes` shifts 10% of traffic to the new task set, holds for 5 minutes, then shifts the remaining 90%. This matches the requirement exactly. A custom configuration (D) is unnecessary and not a standard deployment configuration.

Answer

CodeDeployDefault.ECSAllAtOnce

Answer

CodeDeployDefault.ECSLinear10PercentEvery1Minutes

Answer

Custom configuration with 10% initial traffic and 100% after 5-minute interval

Question 15

A development team uses AWS CodeCommit to store source code and AWS CodePipeline to automate builds and deployments. The team wants to ensure that every commit to the main branch triggers a build and deployment to a test environment. Which action should be taken?

Accepted Answer

Configure the source stage of the CodePipeline to use the CodeCommit repository and specify the main branch.. CodePipeline natively integrates with CodeCommit as a source action. By configuring the source stage to use the CodeCommit repository and specifying the main branch, the pipeline automatically triggers on every commit to that branch without any additional infrastructure or polling. This is the simplest and most reliable approach, as CodePipeline uses Amazon CloudWatch Events under the hood to detect changes.

Answer

Create a CodeBuild project that watches the main branch and starts a pipeline.

Answer

Use AWS Lambda to poll the repository and start the pipeline on new commits.

Answer

Set up an Amazon CloudWatch Events rule that matches commits to the main branch and targets the CodePipeline.

Question 16

A company uses AWS CodeBuild to run integration tests as part of a pipeline. The tests require access to an Amazon RDS database. The RDS instance is in a private subnet with no public access. The CodeBuild project is configured with a VPC. Which additional configuration is necessary to ensure the build can connect to the database?

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic from the security group associated with the CodeBuild project.. The CodeBuild project is configured with a VPC, meaning it runs inside a private subnet and uses an elastic network interface (ENI) with an associated security group. To allow the build container to connect to the RDS instance, the RDS security group must have an inbound rule that permits traffic on port 3306 (or the appropriate database port) from the CodeBuild security group. This is a standard network-layer access control; no additional IAM or gateway is required for connectivity.

Answer

Add an IAM policy that grants the CodeBuild service role access to the RDS instance.

Answer

Create a VPC endpoint for Amazon RDS.

Answer

Attach a NAT gateway to the private subnet.

Question 17

Your company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances running a web server. The web servers write access logs to a shared Amazon EFS filesystem. The operations team needs to monitor the web server logs in real-time to detect and alert on 5xx error spikes. Currently, the team manually SSHes into instances to tail logs, which is inefficient and doesn't provide real-time alerting. The team wants a centralized, near-real-time logging solution with minimal operational overhead. They have asked you to design a solution that ingests logs from the EFS filesystem into a centralized log analytics platform. Which solution would you recommend?

Accepted Answer

Install and configure the Amazon CloudWatch Logs agent on each EC2 instance to tail the log files from the EFS mount and send them to CloudWatch Logs. Create a metric filter and alarm for 5xx errors.. Installing the CloudWatch Logs agent on each EC2 instance allows it to tail the log files from the shared EFS mount point and stream them to CloudWatch Logs in near real-time. This provides centralized log ingestion with minimal operational overhead, and you can create a metric filter and alarm to detect and alert on 5xx error spikes without manual SSH access.

Answer

Enable AWS CloudTrail data events for the EC2 instances to capture log file modifications.

Answer

Configure an Amazon EventBridge scheduled rule to invoke an AWS Lambda function that reads new log lines from EFS and publishes them to Amazon CloudWatch Logs.

Answer

Stream the log files to Amazon Kinesis Data Streams using a custom producer, then use a Lambda function to analyze and alert on 5xx errors.

Question 18

A company runs a web application behind an Application Load Balancer (ALB) in a production AWS account. The DevOps team needs to analyze HTTP request patterns and identify the top IP addresses generating errors. They want to store the data cost-effectively for querying with SQL. Which solution meets these requirements?

Accepted Answer

Enable ALB access logs and store them in Amazon S3, then use Amazon Athena to query the logs with SQL.. ALB access logs provide detailed HTTP request data (including source IP, request URI, response code, etc.) and are stored in Amazon S3, which is cost-effective for long-term storage. Amazon Athena allows querying these logs directly with standard SQL without needing to load data into a database, meeting the requirement for SQL-based analysis of top IP addresses generating errors.

Answer

Use CloudWatch Metrics to monitor error rates and top IPs via custom metrics.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query the logs.

Answer

Stream the ALB logs to Amazon Kinesis Data Analytics and use SQL applications.

Question 19

A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?

Accepted Answer

Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.. Attaching an IAM role to the EC2 instance and using the instance profile allows the application to obtain temporary credentials from the EC2 instance metadata service (IMDS). These credentials are automatically rotated by AWS before they expire, and they are never stored on disk—they are fetched on-demand from the metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). This satisfies both the requirement for automatic rotation and the prohibition against disk storage.

Answer

Store the credentials in AWS Secrets Manager and retrieve them at application startup.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and retrieve them using the EC2 instance's IAM role.

Answer

Generate an access key and secret key for an IAM user and store them in a configuration file on the EC2 instance.

Question 20

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration uses a linear traffic shifting with a 10-minute interval. The application logs show that the new version of the application crashes on startup. What is the MOST effective way to handle this situation to ensure successful future deployments?

Accepted Answer

Add a script in the AppSpec file's 'Validate Service' lifecycle hook to check the application health and fail the deployment if the application does not start successfully.. The 'Validate Service' lifecycle hook in the AppSpec file runs after the application is installed and started, allowing you to execute a custom script that verifies the application is healthy. If the script detects that the new version crashes on startup, it can return a non-zero exit code, which causes CodeDeploy to mark that instance as failed and trigger the deployment failure. This provides an early, automated validation that prevents the deployment from proceeding with a broken application, directly addressing the root cause of the crash.

Answer

Increase the interval in the linear traffic shifting to 30 minutes to allow more time for instances to stabilize.

Answer

Configure the deployment to automatically roll back when a failure occurs and ignore the error.

Answer

Switch to a blue/green deployment strategy to minimize the impact on existing instances.