DOP-C02 Practice Test 2 — 30 Questions

Question 1

A development team wants to ensure that their application can continue serving traffic even if an entire AWS Availability Zone (AZ) becomes unavailable. The application runs on Amazon EC2 instances in an Auto Scaling group and uses an Application Load Balancer (ALB). Which configuration should the team implement to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Auto Scaling group to launch EC2 instances across multiple AZs, and ensure the ALB is enabled for cross-zone load balancing.. Deploying EC2 instances across multiple Availability Zones (AZs) ensures that if one AZ fails, the remaining AZs continue to serve traffic. Enabling cross-zone load balancing on the ALB distributes incoming requests evenly across all healthy instances in all AZs, preventing traffic from being sent only to instances in the same AZ as the client. This architecture meets the requirement for high availability and fault tolerance at the AZ level.

Answer

Use a launch template with multiple instance types to ensure diversity across the fleet.

Answer

Use a single AZ but configure EC2 Auto Scaling to replace unhealthy instances automatically.

Answer

Launch all EC2 instances in the same AZ to minimize latency, and configure the Auto Scaling group to maintain a minimum of two instances.

Question 2

A company is designing a multi-region active-active architecture for a stateless web application. The application uses a DynamoDB table as its data store. The company wants to minimize write latency and ensure that writes are accepted in any region with eventual consistency. Which DynamoDB feature should they use?

Accepted Answer

DynamoDB global tables.. DynamoDB global tables provide a fully managed, multi-region, multi-active solution that automatically replicates data across AWS Regions. This enables low-latency writes in any region with eventual consistency, meeting the requirement for an active-active architecture without custom code or additional infrastructure.

Answer

DynamoDB read replicas in each region.

Answer

Cross-region replication using AWS Lambda function.

Answer

DynamoDB Accelerator (DAX) with multi-region endpoints.

Question 3

A company runs a fleet of EC2 instances behind an Auto Scaling group. The DevOps team wants to detect and respond to memory leaks in their application. They have configured CloudWatch agent to collect memory metrics. However, the metric shows unpredictable spikes. The team needs to correlate these spikes with application logs to identify the root cause. Which solution provides the BEST correlation?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns around the time of memory spikes. CloudWatch Logs Insights allows you to query application logs directly in CloudWatch Logs using a purpose-built query language. By filtering logs around the timestamps of memory spikes, you can correlate specific error patterns or log entries with the metric data, enabling root cause analysis without moving data or adding complexity.

Answer

Export the memory metric and application logs to Amazon S3 and use Amazon Athena to join them

Answer

Enable AWS X-Ray on the application to trace requests and identify memory-heavy requests

Answer

Use Amazon EventBridge to capture EC2 instance state changes and correlate with memory spikes

Question 4

A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?

Accepted Answer

The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).. CodeBuild's security group outbound rules must explicitly allow traffic to the RDS security group on the database port (e.g., 3306 for MySQL). Even though CodeBuild runs in a VPC, if the outbound rules are too restrictive, the build agent cannot establish a TCP connection to the RDS instance, causing a timeout. The security group acts as a virtual firewall for the CodeBuild ENI, and without a matching outbound rule, packets are dropped.

Answer

CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.

Answer

The CodeBuild service role does not have rds:Connect permission.

Answer

The RDS instance is in a different subnet CIDR than CodeBuild's subnet.

Question 5

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an EC2 instance with a UserData script that installs software. The stack creation fails with the error: 'The following resource(s) failed: EC2Instance (AWS::EC2::Instance) – Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack creation timed out or was manually cancelled. The error message 'Resource creation cancelled' indicates that the CloudFormation stack creation was either timed out or manually cancelled, not that the EC2 instance itself failed. CloudFormation has a default timeout of 60 minutes for stack creation, and if the UserData script takes longer than this or the user manually cancels the operation, CloudFormation will mark the resource as cancelled. This is distinct from a resource-specific failure like an invalid instance type or IAM permissions issue, which would produce a different error message such as 'Resource failed to stabilize' or 'API error'.

Answer

The EC2 instance type is not supported in the region

Answer

The IAM role attached to the instance lacks permissions

Answer

The UserData script failed due to a syntax error

Question 6

A company requires that all access to their S3 buckets be encrypted in transit. Which configuration achieves this?

Accepted Answer

Use a bucket policy that denies requests when aws:SecureTransport is false.. Using a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` explicitly enforces encryption in transit for all access to the S3 bucket. This policy ensures that any HTTP (non-TLS) request is denied, while HTTPS requests are allowed, meeting the requirement that all access be encrypted in transit.

Answer

Use CloudFront with the bucket as origin and enforce HTTPS only between viewer and CloudFront.

Answer

Enable default encryption on the bucket.

Answer

Set the bucket policy to require SSE-KMS.

Question 7

A company is designing a highly available architecture for a web application that uses Amazon EC2 instances. The application must be resilient to the failure of a single instance and a single Availability Zone. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Use an Auto Scaling group with a minimum of two instances spread across two Availability Zones.. An Auto Scaling group with a minimum of two instances spread across two Availability Zones ensures that if one instance or one entire AZ fails, the remaining instance(s) in the other AZ can continue serving traffic, and Auto Scaling will automatically launch a replacement instance in the healthy AZ to restore the desired count. Option B is correct because distributing EC2 instances across at least two Availability Zones is the fundamental requirement for AZ-level resilience, as it eliminates a single point of failure at the AZ boundary.

Answer

Place all EC2 instances in a single Availability Zone and use a Network Load Balancer.

Answer

Use a single Application Load Balancer in one Availability Zone.

Answer

Use a single large EC2 instance in one Availability Zone.

Question 8

A company uses AWS CodeBuild to compile and test code. The build process requires a specific version of a library that is not available in the default build environment. Which approach should be used to include this library in the build process?

Accepted Answer

Create a custom Docker image that includes the library and use it as the build environment in CodeBuild.. Creating a custom Docker image that includes the required library ensures the build environment is consistent, reproducible, and avoids repeated download/compile overhead. AWS CodeBuild supports custom Docker images via the `image` field in the buildspec file or the console, allowing you to specify a repository in Amazon ECR or Docker Hub. This approach aligns with infrastructure-as-code best practices by baking dependencies into the environment rather than managing them at build time.

Answer

Modify the buildspec file to include the library as a build artifact.

Answer

Store the compiled library in an Amazon S3 bucket and download it during the build process using the buildspec file.

Answer

Add an install command in the buildspec file to download and compile the library during each build.

Question 9

A company's application running on EC2 instances behind an Application Load Balancer (ALB) is returning intermittent 504 errors. The instances are in an Auto Scaling group with a health check grace period of 300 seconds. What should the DevOps engineer check first to troubleshoot the issue?

Accepted Answer

Check ALB access logs for target response times.. A 504 error indicates the load balancer did not receive a response from the target within the idle timeout period. Checking ALB access logs for target response times is the first step to determine if the backend is slow or unresponsive. Option A is wrong because scaling policies affect the number of instances, not response times. Option B is wrong because health checks verify instance availability, but intermittent slow responses may not cause health check failures. Option C is wrong because security group rules would cause different errors (e.g., connection timeouts) rather than 504s.

Answer

Review the Auto Scaling group scaling policies.

Answer

Verify the target group health checks are passing.

Answer

Check security group rules for the ALB.

Question 10

A company uses AWS CodeBuild to compile and test code. The build takes 30 minutes, but the team wants to reduce build time by caching dependencies. Which approach should be used?

Accepted Answer

Enable local caching in the build project configuration.. AWS CodeBuild's local caching feature allows you to cache intermediate build artifacts (such as dependencies) in a local directory on the build instance, which persists across builds for the same build project. This eliminates the need to re-download dependencies from external sources for every build, significantly reducing build time. The cache is stored in a Docker volume or S3 bucket, but the key benefit is that it is automatically managed by CodeBuild without manual download steps.

Answer

Remove unnecessary dependencies from the build specification.

Answer

Store dependencies in an S3 bucket and download them before each build.

Answer

Use AWS CodeArtifact to store dependencies and pull them during build.

Question 11

A DevOps engineer is designing an AWS CloudFormation template to deploy a three-tier web application. The application must be highly available across multiple Availability Zones. The engineer needs to ensure that the database layer uses a Multi-AZ deployment. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)

Accepted Answer

Select a database engine that supports Multi-AZ deployments.. Not all AWS RDS database engines support Multi-AZ deployments; for example, Amazon Aurora uses a different high-availability mechanism (cluster volume) and does not use the standard Multi-AZ feature. The engineer must verify that the chosen engine (e.g., MySQL, PostgreSQL, Oracle, SQL Server) explicitly supports Multi-AZ to enable synchronous standby replication across Availability Zones. Option E is correct because setting the 'MultiAZ' property to 'true' on the 'AWS::RDS::DBInstance' resource directly instructs CloudFormation to provision a primary DB instance in one AZ and a standby in another AZ, with automatic failover.

Answer

Define a separate 'AWS::RDS::DBSubnetGroup' resource with subnets from at least two Availability Zones.

Answer

Deploy the database with multiple read replicas in different Availability Zones.

Answer

Configure the database to use a DB subnet group with subnets in a single Availability Zone.

Question 12

Which TWO tools can be used to manage configuration drift detection for AWS resources? (Choose two.)

Accepted Answer

AWS Config. AWS Config continuously monitors and records AWS resource configurations and can detect changes against desired baselines, enabling drift detection through rules and compliance checks. AWS CloudFormation Drift Detection directly compares the current state of a stack's resources with the expected template-defined state to identify configuration drift. Both tools provide native mechanisms to detect when resources deviate from their intended configuration.

Answer

AWS Systems Manager Inventory

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 13

A company is using Amazon S3 to store sensitive data. The security team mandates that all data must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS). The DevOps engineer must ensure that any new objects uploaded to the bucket are automatically encrypted. What should the engineer do?

Accepted Answer

Enable default encryption on the S3 bucket and select AWS-KMS as the encryption method.. Enabling default encryption on the S3 bucket with SSE-KMS ensures that all objects uploaded to the bucket are automatically encrypted at rest with AWS KMS. Option A is incorrect because CORS is for cross-origin requests and does not affect encryption. Option B is incorrect because while a bucket policy can enforce encryption headers, it does not provide default encryption; it only denies requests without the header, and default encryption is a simpler and more reliable method. Option D is incorrect because versioning does not encrypt data.

Answer

Enable CORS on the bucket to allow encrypted uploads.

Answer

Apply a bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header with aws:kms.

Answer

Enable S3 Versioning to protect encrypted objects.

Question 14

A company runs a critical microservices architecture on Amazon ECS with Fargate. They want to ensure that if a task fails, it is automatically restarted, and the service remains available across multiple Availability Zones. How should they configure the ECS service?

Accepted Answer

Define an ECS service with a task definition, set desired count across multiple Availability Zones, and use Service Auto Scaling. An ECS service configured with a task definition, desired count across multiple Availability Zones, and Service Auto Scaling ensures resilience. The ECS service scheduler automatically restarts failed tasks, and distributing tasks across AZs provides high availability. Option A is wrong because placing all tasks in a single AZ creates a single point of failure. Option B is wrong because a standalone Fargate task does not have automatic restart; a CloudWatch alarm can restart it but lacks the built-in resilience of an ECS service. Option C is wrong because using a single EC2 instance is a single point of failure and does not provide multi-AZ resilience.

Answer

Place all tasks in the same Availability Zone to reduce latency

Answer

Run a standalone Fargate task and use a CloudWatch alarm to restart it

Answer

Use an EC2 launch type with a single instance to reduce complexity

Question 15

A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the most appropriate service because it is specifically designed to manage secrets like database passwords, with automatic rotation, encryption, and fine-grained access control. Option A (DynamoDB) is a database, not a secrets manager. Option B (S3) can store encrypted data but lacks built-in secret rotation and management. Option C (Systems Manager Parameter Store SecureString) can store secrets but does not support automatic rotation, making Secrets Manager the better choice.

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store (SecureString)

Question 16

A DevOps engineer receives an alert that an EC2 instance has been compromised. The instance is part of an Auto Scaling group. What is the first step the engineer should take to isolate the instance?

Accepted Answer

Detach the instance from the Auto Scaling group and remove it from the load balancer. The first step to isolate a compromised EC2 instance in an Auto Scaling group is to detach it from the Auto Scaling group and remove it from the load balancer. This stops all incoming traffic to the instance, preventing further damage or data exfiltration while preserving the instance for forensic analysis. Option A (snapshot) is useful for preserving evidence but does not isolate the instance. Option C (AMI) similarly does not provide immediate isolation. Option D (terminate) may destroy evidence and should only be done after investigation.

Answer

Create a snapshot of the instance's root volume

Answer

Create an AMI of the instance for analysis

Answer

Terminate the instance immediately

Question 17

A developer is writing an AWS CloudFormation template to create an Amazon S3 bucket. The bucket name must be unique across all AWS accounts. Which property should the developer use to ensure the name is unique?

Accepted Answer

Omit the BucketName property so CloudFormation generates a unique name.. Omit the BucketName property so CloudFormation generates a unique name. Amazon S3 bucket names must be globally unique across all AWS accounts. If you specify a custom BucketName, you must ensure its uniqueness yourself, which is error-prone. By omitting BucketName, CloudFormation automatically generates a unique name that includes a random suffix, guaranteeing global uniqueness. Option A (DeletionPolicy) controls what happens when the stack is deleted, not naming. Option B (setting BucketName to a unique value via parameter) still requires manual uniqueness and is not a property that ensures uniqueness automatically. Option C (UpdateReplacePolicy) controls replacement behavior on updates, not naming. Therefore, omitting BucketName is the simplest way to ensure a unique name.

Answer

Use the DeletionPolicy attribute to retain the bucket.

Answer

Set the BucketName property to a unique value using a parameter.

Answer

Use the UpdateReplacePolicy attribute to control replacement.

Question 18

A company uses Amazon CloudFront to distribute content globally. Users in some regions report slow load times. The DevOps team wants to identify the geographic regions where performance is worst. Which tool should they use?

Accepted Answer

CloudFront reports in the AWS Management Console. CloudFront reports in the AWS Management Console provide performance metrics (e.g., total requests, error rates, latency) broken down by geographic region, enabling the team to identify regions with worst performance. Option A is wrong: CloudWatch metrics for CloudFront are aggregated per distribution, not per region. Option B is wrong: CloudFront access logs in S3 record individual requests but do not aggregate performance by region. Option C is wrong: Amazon Route 53 latency records are used for DNS-based routing decisions, not for analyzing CloudFront performance.

Answer

Amazon CloudWatch Metrics for CloudFront

Answer

CloudFront access logs in S3

Answer

Amazon Route 53 latency records

Question 19

A DevOps engineer needs to ensure that an application running on EC2 can automatically recover from an underlying hardware failure without manual intervention. Which AWS feature should be enabled?

Accepted Answer

Configure EC2 Auto Recovery with a CloudWatch alarm. EC2 Auto Recovery automatically recovers an instance when it becomes impaired due to underlying hardware failure, preserving its instance ID, private IP, and Elastic IP. Option A is incorrect because termination protection only prevents accidental deletion, not recovery. Option C is incorrect because an Auto Scaling group with a minimum size of 1 can replace a failed instance but launches a new instance rather than recovering the same one. Option D is incorrect because CloudWatch detailed monitoring provides more frequent metrics but does not trigger recovery actions.

Answer

Enable termination protection

Answer

Configure an Auto Scaling group with a minimum size of 1

Answer

Enable CloudWatch detailed monitoring

Question 20

A DevOps engineer ran the above command and saw this output. What is the MOST likely cause of the stack creation failure?

Accepted Answer

The launch template name specified in the CloudFormation template is incorrect or does not exist.. The error message indicates that the launch template name specified in the CloudFormation template does not match any existing launch template in the account and Region. CloudFormation resolves the launch template name at stack creation time; if the name is incorrect or the template does not exist, the Auto Scaling group creation fails with a validation error. This is the most direct cause because the launch template name is a required parameter that must reference a pre-existing resource.

Answer

The key pair specified in the launch template does not exist.

Answer

The IAM role does not have permission to create the Auto Scaling group.

Answer

The AMI ID specified in the launch template is not available in this Region.