DOP-C02 Practice Test 2 — 30 Questions

Question 1

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Fargate tasks require network connectivity to pull container images from ECR (or Docker Hub) and to send logs to CloudWatch. Without a route to a NAT Gateway (for private subnets) or an Internet Gateway (for public subnets), the task cannot pull the image and fails to start. Option B is incorrect: while the image must exist, the immediate symptom of tasks failing to start when the image is missing would be an 'image not found' error, not a generic failure; the security group already allows inbound traffic on port 8080, but outbound connectivity is the issue. Option C is incorrect: insufficient CPU/memory would cause tasks to enter a 'CPU exhausted' or 'memory exhausted' state, not prevent them from starting entirely. Option D is incorrect: the security group allows inbound traffic, but the issue is about egress connectivity for the task to reach the image registry.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.

Question 2

A DevOps engineer receives a CloudWatch alarm that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance hosts a critical web application. What is the MOST appropriate immediate response to mitigate performance impact?

Accepted Answer

Place the instance into an Auto Scaling group with a scale-out policy based on CPU utilization.. Placing the instance into an Auto Scaling group with a scale-out policy based on CPU utilization allows the group to launch additional instances to handle the increased load, providing immediate mitigation without downtime. Rebooting (A) causes downtime and does not resolve the root cause. Creating a new AMI and launching a larger instance (C) or stopping and resizing (D) both involve significant downtime and are not immediate. Therefore, B is the best immediate response.

Answer

Reboot the EC2 instance to clear any temporary processes.

Answer

Create a new AMI from the instance and launch a new larger instance.

Answer

Stop the instance and change its type to a larger instance size.

Question 3

A company's production environment uses an Amazon ElastiCache Redis cluster for session caching. The operations team reports that the cache hit ratio has dropped significantly, causing increased load on the backend database. What is the MOST likely cause?

Accepted Answer

The cache is under memory pressure and evicting keys to make room.. A sudden drop in cache hit ratio is most commonly caused by memory pressure in the ElastiCache cluster, forcing key evictions. As keys are evicted to free memory, subsequent requests miss the cache and hit the database, reducing the hit ratio. Option B (cluster mode resizing) would cause a temporary disruption but not a sustained drop. Option C (encryption in transit) adds latency but does not affect cache hits. Option D (network partition) would cause cache unavailability, not just a reduced hit ratio.

Answer

The cluster was resized from a single node to a cluster mode.

Answer

The encryption in transit was enabled, adding latency.

Answer

There is a network partition between the application and the cache.

Question 4

An application running on Amazon EC2 instances in an Auto Scaling group is experiencing intermittent connectivity issues. The DevOps team suspects a security group configuration problem. Which approach should the team use to analyze security group traffic and identify denied requests?

Accepted Answer

Enable VPC Flow Logs and query Amazon Athena. VPC Flow Logs capture all network traffic (accepted and rejected) and can be queried using Amazon Athena to identify denied requests. Option A is incorrect because AWS Config records resource configuration changes, not network traffic. Option B is incorrect because AWS CloudTrail logs API calls, not network traffic. Option C is incorrect because AWS Security Hub aggregates security findings from various services but does not log individual traffic flows. Therefore, enabling VPC Flow Logs and querying Athena is the appropriate approach to analyze security group traffic and identify denied requests.

Answer

Use AWS Config to review security group rules

Answer

Check AWS CloudTrail for security group modification events

Answer

Enable AWS Security Hub and review the security findings

Question 5

A company has a production Amazon EKS cluster with multiple node groups. The DevOps team notices that some pods are frequently restarting due to OOMKilled errors, but the cluster-level metrics (CPU, memory) appear normal. Which CloudWatch Container Insights metric should be analyzed to identify the specific node or pod causing the issue?

Accepted Answer

pod_memory_utilization.. Container Insights provides pod-level memory utilization metrics (pod_memory_utilization) that can pinpoint which pod is exceeding its memory limit, causing OOMKilled errors. Option A (node_memory_utilization) is aggregate at node level and may not show individual pod issues. Option B (number_of_running_pods) does not indicate memory usage. Option D (pod_cpu_utilization) is for CPU, not memory.

Answer

node_memory_utilization.

Answer

number_of_running_pods.

Answer

pod_cpu_utilization.

Question 6

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function sometimes fails due to a transient error in a downstream API. The DevOps engineer wants to ensure that failed messages are retried automatically and eventually sent to a dead-letter queue after 3 failed attempts. The SQS queue is configured with a redrive policy that moves messages to a DLQ after 3 receive attempts. However, Lambda functions that fail are not being retried. What is the MOST likely reason?

Accepted Answer

The event source mapping has 'MaximumRetryAttempts' set to 0.. The event source mapping for Lambda has a separate retry policy controlled by 'MaximumRetryAttempts'. When set to 0, Lambda will not retry failed invocations, even though the SQS queue's redrive policy is configured to move messages to the DLQ after 3 receive attempts. Without Lambda retries, the message becomes visible again after the visibility timeout, and the receive count increments, eventually triggering the redrive. Option A is incorrect because batch size does not affect retries. Option B is incorrect because visibility timeout only affects when the message reappears, not the number of retry attempts. Option D is incorrect because the dead-letter queue is configured on the SQS queue, not on the Lambda function.

Answer

The batch size is set to 1, preventing retries.

Answer

The visibility timeout is set too low, causing messages to be retried immediately.

Answer

The dead-letter queue is not configured on the Lambda function.

Question 7

A DevOps engineer is troubleshooting a Lambda function that is timing out. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Increase the function timeout in the Lambda configuration.. Increasing the function timeout allows more time for the function to complete before timing out. Option E is correct because reviewing CloudWatch Logs helps identify timeout errors and execution details. Option A is wrong because setting reserved concurrency to 1 isolates the function but does not diagnose timeout issues. Option C is wrong because VPC configuration can cause network delays but is not a direct diagnostic step for timeout. Option D is wrong because increasing memory allocation may improve performance but does not directly resolve timeouts.

Answer

Set reserved concurrency to 1 to isolate the function.

Answer

Check the VPC configuration for the Lambda function.

Answer

Increase the function memory allocation.

Question 8

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command allows you to run commands (e.g., 'top', 'ps') remotely on EC2 instances to obtain OS-level process details and identify which process is consuming CPU. Option A is wrong because AWS Config records configuration changes, not OS-level processes. Option B is wrong because AWS CloudTrail logs API calls, not system-level metrics. Option D is wrong because Amazon CloudWatch provides aggregated CPU utilization metrics but cannot provide process-level details.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 9

A company runs a containerized application on Amazon ECS with Fargate launch type. The application consists of three microservices: frontend, backend, and database. The ECS cluster is in a VPC with public and private subnets. The frontend service is publicly accessible via an Application Load Balancer (ALB) in public subnets. The backend service communicates with the database service, which runs as a stateful service with persistent storage using Amazon EFS. The DevOps team is using CloudWatch Container Insights and has enabled Prometheus metrics for the ECS cluster. Recently, the team observed that the frontend service's response time has increased significantly, and some requests are timing out. The team checked the ALB metrics and saw an increase in 5xx errors. They also noticed that the backend service's CPU utilization is high, and the database service's disk I/O is high. The team suspects a bottleneck in the backend service. Which course of action should the team take FIRST to identify the root cause?

Accepted Answer

Check the backend service's application logs in CloudWatch Logs to identify errors or slow database queries.. The first step is to analyze the backend service's application logs to identify any errors or slow operations. High CPU and disk I/O may be caused by inefficient queries or code issues. Option A is incorrect because disabling health checks would hide the problem and could route traffic to unhealthy tasks. Option B is incorrect because migrating to RDS does not address the immediate issue and is a significant change without root cause analysis. Option D is incorrect because increasing the desired count without understanding the root cause may temporarily alleviate load but does not fix underlying performance issues and can increase costs.

Answer

Disable the health check for the backend service in the ALB target group.

Answer

Migrate the database service to Amazon RDS for better performance.

Answer

Increase the desired count of the backend service to reduce load per task.

Question 10

A DevOps engineer is managing a CI/CD pipeline using AWS CodePipeline with multiple stages: Source (CodeCommit), Build (CodeBuild), Test (CodeBuild), and Deploy (CodeDeploy). The engineer wants to add manual approval steps before the Test and Deploy stages. Additionally, the pipeline should automatically roll back the deployment if the Deploy stage fails. Which two actions should the engineer take to implement these requirements? (Choose two.)

Accepted Answer

Insert a new stage between Build and Test, and add an Approval action to that stage.. Manual approval actions in AWS CodePipeline must be added as a separate stage, not within an existing stage. By inserting a new stage between Build and Test and adding an Approval action, the pipeline pauses before the Test stage, allowing manual review. Option C is correct because CodeDeploy deployment groups support automatic rollback on deployment failure, which can be enabled in the deployment group configuration to revert to the last known good revision.

Answer

Add an Approval action in the Test stage before the Test build action.

Answer

Add a Lambda function in the pipeline that triggers a rollback if the Deploy stage fails.

Answer

Configure the pipeline's Deploy stage to have a 'Rollback' action that runs on failure.

Question 11

A company is using AWS CodePipeline to deploy a static website to Amazon S3. The pipeline includes a CodeBuild step that minifies JavaScript files. Recently, the build step started failing with an error: 'Error: ENOENT: no such file or directory, open 'index.js''. What is the most likely cause?

Accepted Answer

The CodeBuild project's working directory is not set to the source directory.. The error 'ENOENT: no such file or directory, open 'index.js'' indicates that CodeBuild cannot find the file in the current working directory. This typically happens when the working directory is not set to the source directory where the file resides. Option C correctly identifies this as the most likely cause. Option D is incorrect because the buildspec.yml file does not require a 'phases' section to run.

Answer

The source code was not uploaded to S3 correctly.

Answer

The S3 bucket policy is blocking access to the source code.

Answer

The buildspec.yml file is missing the 'phases' section.

Question 12

A DevOps team is using AWS CodeBuild to run unit tests and package a Java application. They want to cache the Maven local repository (~/.m2) between builds to improve build times. Which TWO steps are necessary to enable caching in CodeBuild? (Select TWO.)

Accepted Answer

Add a 'cache' section in the buildspec file specifying the paths to cache.. To enable caching for the Maven local repository in AWS CodeBuild, two steps are required: (1) Add a `cache` section in the buildspec file specifying the paths to cache (e.g., ~/.m2) — this is option D. (2) Create an S3 bucket to store the cache and configure the CodeBuild project to use that bucket for caching — this is option E. Option A (setting MAVEN_OPTS) is not necessary because the default Maven repository path is already ~/.m2. Option B (uploading as a build artifact) is for saving output artifacts, not for caching. Option C ('Local cache' mode) is a different feature used for Docker layer caching, not for Maven dependencies. Therefore, options D and E are correct.

Answer

Set the MAVEN_OPTS environment variable to use a custom repository path.

Answer

Configure the buildspec to upload the Maven repository as a build artifact.

Answer

Enable 'Local cache' mode in the CodeBuild project.

Question 13

A company is designing a disaster recovery plan for an RDS PostgreSQL database. They have a cross-region read replica. Which THREE steps should they take to ensure a successful failover?

Accepted Answer

Configure applications to use the new database endpoint. To failover a cross-region read replica, promote it to a standalone database instance (Option D). After promotion, update the Route 53 DNS record to point to the new master (Option C) and configure applications to use the new database endpoint (Option B). Option A is incorrect because automated backups are enabled by default on the replica once promoted or can be enabled separately, but they are not required prior to promotion. Option E is incorrect because Multi-AZ is not supported on read replicas in the same region; cross-region replicas also cannot have Multi-AZ before promotion. Multi-AZ can be configured after promotion if desired.

Answer

Enable automated backups on the replica before promotion

Answer

Enable Multi-AZ on the read replica before promotion

Question 14

Refer to the exhibit. A DevOps engineer created an IAM role 'MyLambdaRole' for a Lambda function. The Lambda function needs to write logs to CloudWatch Logs. However, the function is not able to create log streams. What is the most likely missing configuration?

Accepted Answer

The role does not have an inline or managed policy that grants permissions for CloudWatch Logs.. The IAM role must have an inline or managed policy that grants permissions for CloudWatch Logs actions such as logs:CreateLogStream and logs:PutLogEvents. Option A is incorrect because the role name does not need a prefix; the trust policy is what matters. Option C is incorrect because the role ARN format does not affect log stream creation. Option D is incorrect because the trust policy allowing Lambda to assume the role is separate from the permissions to write logs; the question states the function is not able to create log streams, which indicates a permissions issue within the role's policies.

Answer

The role name is not prefixed with 'AWSLambda'.

Answer

The role ARN is incorrectly formatted.

Answer

The trust policy does not allow Lambda to assume the role.

Question 15

A DevOps team is using Amazon CloudWatch Logs to centralize logs from multiple EC2 instances running a custom application. The team notices that logs are missing from some instances intermittently. The CloudWatch agent configuration is identical across all instances. What is the MOST likely cause of the missing logs?

Accepted Answer

The CloudWatch Logs agent's state file has become corrupted due to disk full condition. The CloudWatch Logs agent uses a state file to track which log events have been sent. If the disk becomes full, the state file can become corrupted, causing the agent to lose track of progress and intermittently skip or re-send logs. The identical agent configuration suggests an environmental issue like disk full. Options B, C, and D are incorrect: VPC Flow Logs do not interfere with CloudWatch Logs; CPU credits do not directly cause log loss; IAM role rotation would cause consistent failure, not intermittent issues.

Answer

The VPC Flow Logs are consuming all available network bandwidth

Answer

The EC2 instances are running out of CPU credits, causing the agent to skip log batches

Answer

The IAM role attached to the instances has been rotated incorrectly

Question 16

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an RDS MySQL database. The security team requires that all traffic between the application and the database be encrypted in transit. Currently, the database security group allows inbound traffic from the ECS tasks' security group on port 3306 (MySQL). The application uses the standard MySQL client connection without SSL. After enabling SSL on the RDS instance, the application starts failing to connect. The error logs show 'SSL connection error: protocol version mismatch'. The application runs on a custom Docker image based on Amazon Linux 2. The DevOps engineer needs to fix the connection issue. Which course of action should the engineer take?

Accepted Answer

Update the Docker image to include the latest MySQL client libraries that support TLS 1.2.. The error indicates that the MySQL client in the container does not support the TLS version required by RDS. The simplest solution is to modify the application connection string to use the '--ssl-mode=REQUIRED' flag or equivalent, but the error persists even after that. The actual fix is to update the MySQL client libraries in the container image to a version that supports TLS 1.2, as RDS requires TLS 1.2 or higher. Alternatively, the engineer can configure RDS to accept TLS 1.0, but that is not secure. Changing the security group or using SSH tunneling does not address the TLS version mismatch.

Answer

Update the application code to connect using SSL with the --ssl-mode=REQUIRED flag.

Answer

Modify the RDS parameter group to allow TLS 1.0 and 1.1.

Answer

Create a VPC peering connection and route traffic through a VPN.

Question 17

A DevOps engineer receives an alarm that an EC2 instance's StatusCheckFailed metric has been in ALARM state for 10 minutes. Which action should the engineer take first to investigate?

Accepted Answer

Review the instance's system log and application logs in CloudWatch Logs. When an EC2 instance's StatusCheckFailed metric is in ALARM state, it indicates a problem with the instance itself (OS-level or application-level). Reviewing the instance's system log and application logs in CloudWatch Logs is the first step to diagnose the root cause. Option B (AWS Config) checks configuration compliance, which is not directly related to the health check failure. Option C (CloudTrail) logs API calls but not OS-level issues. Option D (restart) may temporarily resolve the issue but does not provide investigation.

Answer

Use AWS Config to check the instance's configuration compliance

Answer

Check AWS CloudTrail for any API calls that modified the instance

Answer

Restart the EC2 instance to clear the alarm

Question 18

A security engineer runs the above CLI command to investigate IAM user 'Bob'. The output shows Bob logged in and then created a new IAM user. Which additional information should the engineer look for to determine if this was a security incident?

Accepted Answer

The source IP address from the CloudTrail event details.. To determine if the activity is malicious, the engineer should check the source IP address from the CloudTrail event details. The source IP can indicate if the login came from an unexpected location, suggesting compromised credentials. Option A is wrong because the event name (CreateUser) is already known from the command output. Option B is wrong because the time the new user was last modified does not provide direct evidence about the unauthorized nature of the login event. Option D is wrong because the IAM group memberships of the new user do not indicate whether the login itself was unauthorized.

Answer

The event name for the user creation.

Answer

The time the new user was last modified.

Answer

The IAM group memberships of the new user.

Question 19

A company runs a critical application on EC2 instances in an Auto Scaling group. The application must be highly available across multiple Availability Zones. Which TWO configurations are necessary to achieve this? (Choose TWO.)

Accepted Answer

Place an Application Load Balancer in front of the Auto Scaling group.. To achieve high availability across multiple Availability Zones (AZs), two key configurations are required. First, the Auto Scaling group must be configured to launch instances in multiple AZs (Option E). This ensures that if one AZ fails, the application can continue serving traffic from instances in other AZs. Second, an Application Load Balancer (ALB) should be placed in front of the Auto Scaling group (Option D). The ALB distributes incoming traffic across instances in all AZs where the Auto Scaling group has launched instances. It also performs health checks and automatically routes traffic away from unhealthy instances. Option A is incorrect because using a single AZ would create a single point of failure, undermining high availability. Option B is incorrect because Spot Instances can be terminated with little notice, which is unsuitable for a critical application requiring consistent availability. Option C is incorrect because a Classic Load Balancer lacks advanced features like path-based routing and native cross-zone load balancing, making the ALB a better choice for modern applications.

Answer

Use a single Availability Zone to reduce latency.

Answer

Use Spot Instances to reduce costs.

Answer

Use a Classic Load Balancer to distribute traffic.

Question 20

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a sudden spike in connections, causing some application requests to fail with 'Too many connections' errors. The DevOps team needs to automate a response to this incident. What is the MOST effective solution?

Accepted Answer

Create a CloudWatch alarm on the DatabaseConnections metric to trigger a Lambda function that increases the max_connections parameter.. The issue is a spike in connections exceeding max_connections. By monitoring DatabaseConnections with a CloudWatch alarm, you can trigger a Lambda function to increase the max_connections parameter in the DB parameter group (applied immediately or pending reboot) to handle the spike. Option A is incorrect because Multi-AZ provides failover, not load distribution; it does not increase connection capacity. Option C is incorrect: RDS Proxy pools connections but does not change the max_connections limit; it would help prevent the issue but not respond to it. Option D is incorrect because Auto Scaling for RDS changes instance size, which does not directly increase max_connections; moreover, scaling takes time and is not an immediate response to a connection spike.

Answer

Enable Multi-AZ to distribute the load across two instances.

Answer

Use Amazon RDS Proxy to pool and share database connections.

Answer

Use an Auto Scaling policy to increase the RDS instance size.