DOP-C02 Practice Test 3 — 30 Questions

Question 1

A DevOps engineer is configuring AWS CloudTrail to log all management events across all regions. The engineer wants to ensure that log files are encrypted at rest using a customer-managed KMS key. What is the correct way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Specify a KMS key ID in the CloudTrail trail configuration and grant CloudTrail permissions to use the key.. AWS CloudTrail supports encryption at rest using a customer-managed AWS KMS key (SSE-KMS). To achieve this, you must specify the KMS key ID in the CloudTrail trail configuration and grant CloudTrail permissions to use that key via the key policy. Option A is wrong because CloudTrail does not support SSE-C (customer-provided keys); it only supports SSE-S3 or SSE-KMS. Option B is wrong because client-side encryption is not a built-in CloudTrail feature and would require custom implementation. Option C is wrong because SSE-S3 uses S3-managed keys, not a customer-managed KMS key. Therefore, D is the only correct way to encrypt CloudTrail logs with a customer-managed KMS key.

Answer

Use SSE-C with a customer-provided key when uploading logs to S3.

Answer

Enable client-side encryption before delivering logs to S3.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Question 2

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

Accepted Answer

Define environment variables in the source code using .ebextensions configuration files.. Ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Answer

Update the environment variables manually in the Elastic Beanstalk console after each deployment.

Answer

Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.

Answer

Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Question 3

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The application experiences increased latency during peak hours. The DevOps engineer investigates and notices that the Read Replicas are not being utilized effectively. The application is configured to use the primary database endpoint. The engineer wants to offload read traffic to the Read Replicas without changing the application code. What is the BEST solution?

Accepted Answer

Configure Amazon RDS Proxy in front of the database and enable read/write splitting.. Amazon RDS Proxy with read/write splitting allows the application to offload read traffic to Read Replicas without code changes. It automatically directs read queries to Read Replicas and write queries to the primary, using a single endpoint. Option A (increasing instance size) does not leverage Read Replicas. Option B (modifying application) requires code changes. Option C (Multi-AZ cluster with read-only endpoint) is invalid because Multi-AZ clusters use a writer and reader endpoint, but the question requires no code changes, and the existing configuration uses a primary endpoint; also, creating a new cluster may not be the simplest solution compared to RDS Proxy.

Answer

Increase the instance size of the primary database to handle the load.

Answer

Modify the application to use separate endpoints for read and write operations.

Answer

Create a new Multi-AZ cluster with a read-only endpoint.

Question 4

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

Accepted Answer

You can use AWS Organizations to centrally manage accounts and use StackSets with trusted access.. AWS Organizations can centrally manage accounts, and StackSets can be enabled with trusted access to deploy stacks across accounts. Option D is correct because AWS CloudFormation StackSets allow deploying stacks across multiple accounts. Option B is incorrect because CloudFormation cannot automatically create new AWS accounts. Option C is incorrect because nested stacks operate within a single stack and cannot deploy resources across different accounts from a single template. Option E is incorrect because cross-stack references only work within the same account and region.

Answer

CloudFormation can automatically create new AWS accounts using a template.

Answer

Nested stacks can be used to deploy resources in different accounts from a single template.

Answer

You can use cross-stack references to share resources between accounts.

Question 5

A company wants to use AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that the instances are automatically configured with the latest security patches upon boot. Which OpsWorks feature should they use?

Accepted Answer

Create a custom Chef recipe that installs security patches and assign it to the setup lifecycle event.. AWS OpsWorks uses Chef recipes to manage instance configuration. By creating a custom Chef recipe that installs the latest security patches and assigning it to the 'setup' lifecycle event, the recipe runs automatically on every new instance boot, ensuring patches are applied before the instance enters service. This is the native OpsWorks mechanism for configuration management during instance provisioning.

Answer

Configure the instances to run a user data script that updates packages.

Answer

Use AWS Systems Manager Patch Manager with an OpsWorks lifecycle event.

Answer

Use a CloudFormation template to apply patches during stack creation.

Question 6

A team uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The deployment fails with an error: 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used in the deploy stage does not have permission to assume the CloudFormation execution role.. The error 'The security token included in the request is invalid' typically occurs when the IAM role used by CodePipeline in the deploy stage lacks the necessary trust relationship or permissions to assume the CloudFormation execution role. In AWS SAM deployments via CodePipeline, the deploy action uses a specified IAM role to call CloudFormation, and if that role cannot assume the CloudFormation service role (or the CloudFormation role itself is misconfigured), the security token becomes invalid. This is a common misconfiguration when the pipeline's IAM role does not include the 'sts:AssumeRole' permission for the CloudFormation execution role ARN.

Answer

The build stage did not produce the correct output artifact.

Answer

The SAM template has a syntax error.

Answer

The 'sam deploy' command is missing the '--capabilities' parameter.

Question 7

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment is set to 'AllAtOnce'. The application revision is a simple index.html. What is the most likely cause?

Accepted Answer

The CodeDeploy agent is not installed or running on the EC2 instances.. The error message indicates that too many instances failed deployment, which is typical when the CodeDeploy agent is not running on the EC2 instances. With an 'AllAtOnce' deployment, all instances are targeted simultaneously, so if the agent is missing on every instance, all will fail immediately, causing the overall deployment to fail. The simple index.html revision is not the issue; the agent is required to execute the AppSpec file and pull the revision from S3 or GitHub.

Answer

The IAM instance profile does not have permissions to download from Amazon S3.

Answer

The application revision is not a compressed archive.

Answer

The deployment configuration 'AllAtOnce' is incompatible with Auto Scaling groups.

Question 8

A company uses AWS CodeBuild to compile a Java application. The buildspec.yml includes a pre_build phase that runs unit tests and a build phase that packages the application. Recently, builds have been failing intermittently with 'OutOfMemoryError' during the test phase. The build environment is set to 'BUILD_GENERAL1_SMALL'. What is the MOST cost-effective solution?

Accepted Answer

Change the build environment to 'BUILD_GENERAL1_MEDIUM' which has more memory.. The 'BUILD_GENERAL1_SMALL' environment provides only 3 GB of memory, which is insufficient for the unit tests, causing intermittent 'OutOfMemoryError'. Upgrading to 'BUILD_GENERAL1_MEDIUM' (7 GB) directly addresses the memory shortage without architectural changes, and it is the most cost-effective solution because it avoids the complexity and additional costs of parallel jobs or test splitting while still resolving the root cause.

Answer

Split the tests into smaller batches using CodeBuild test splitting.

Answer

Configure the buildspec to set MAVEN_OPTS='-Xmx512m' to reduce JVM heap usage.

Answer

Use multiple CodeBuild jobs to run tests in parallel.

Question 9

A company is using a centralized logging solution with Amazon OpenSearch Service. The DevOps team notices that logs from some EC2 instances are missing. The CloudWatch agent is installed and configured on all instances. What should the team do to troubleshoot the issue?

Accepted Answer

Check the CloudWatch agent log file located at /var/log/amazon/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log.. The CloudWatch agent writes detailed operational logs to /var/log/amazon/amazon-cloudwatch-agent/amazon-cloudwatch-agent.log. This file contains errors, warnings, and debug messages that can reveal why logs from specific EC2 instances are not being delivered to Amazon OpenSearch Service. Checking this log is the first and most direct troubleshooting step because it captures agent-level issues such as configuration errors, network connectivity failures, or permission problems.

Answer

Check the CloudWatch agent status using the CloudWatch agent status command.

Answer

Configure a Lambda function to poll the CloudWatch agent for logs.

Answer

Verify that the EC2 instances have an SQS queue configured for log delivery.

Question 10

A company runs a containerized application on Amazon ECS with Fargate launch type. The application is behind an Application Load Balancer (ALB). The operations team notices that the ALB's 5xx error rate increases periodically. The ECS service is configured with a target tracking scaling policy based on CPU utilization. The CloudWatch logs from the application show no errors. The health check on the ALB is configured to hit the /health endpoint. What is the MOST likely cause of the 5xx errors?

Accepted Answer

The health check endpoint is returning a 503 status due to a dependency failure.. The ALB periodically reports 5xx errors because the health check endpoint /health is returning a 503 status code, likely due to a transient dependency failure. When the health check fails, the ALB considers the target unhealthy and returns a 503 (or 502) to clients. The application code itself logs no errors because the failure occurs in a downstream dependency that the health check probes, not in the main application logic. Option A is incorrect because ECS with Fargate does not expose underlying host patching; the ALB would not detect such patching as 5xx errors. Option C is incorrect because a target tracking CPU scaling policy, even if slow, would not cause 5xx errors—it would affect performance but not directly trigger health check failures. Option D is incorrect because the application logs show no errors, ruling out unlogged exceptions as the source.

Answer

The ECS tasks are running on an underlying host that is being patched.

Answer

The target tracking scaling policy is not responding quickly enough to traffic spikes.

Answer

The application is throwing exceptions that are not logged.

Question 11

A company has a multi-region application with an RDS for MySQL database in us-east-1. They want to minimize downtime if the primary region fails. They set up a cross-region read replica in us-west-2. What additional step is needed for automated failover?

Accepted Answer

Use a custom automation to monitor the primary and promote the replica. B is correct because RDS cross-region read replicas do not support automatic failover; you must use custom automation (e.g., AWS Lambda, Amazon Route 53 health checks, or a custom script) to detect primary region failure and promote the read replica to a standalone instance. This promotion breaks the replication link and makes the replica a writable primary, enabling failover.

Answer

Create a second read replica in the secondary region

Answer

Configure automatic backup retention on the replica

Answer

Enable Multi-AZ on the read replica

Question 12

A company uses AWS CodePipeline with a source stage from Amazon S3 and a deploy stage to AWS Elastic Beanstalk. The pipeline has been working for months, but recently the deploy stage started failing with the error 'The S3 object does not exist.' The source artifact is uploaded to the S3 bucket by an external system. Which TWO actions should be taken to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the external system does not overwrite the object after the pipeline execution starts.. The deploy stage fails with 'The S3 object does not exist' when the external system overwrites the source artifact after the pipeline execution starts. CodePipeline references the object by its key at the time the pipeline is triggered; if the object is replaced (i.e., deleted and re-uploaded with the same key), the pipeline may attempt to download a version that no longer exists, especially if the S3 bucket is not versioned. Ensuring the external system does not overwrite the object during execution prevents this race condition.

Answer

Change the source stage to use AWS CodeCommit instead of S3.

Answer

Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Answer

Increase the timeout for the deploy stage in the pipeline.

Question 13

A company runs a stateful application on EC2 instances with instance store volumes. The application requires low-latency access to data. The operations team needs to ensure that instance failure does not result in data loss. Which solution is MOST resilient?

Accepted Answer

Replicate data in real time to an EBS volume and take periodic snapshots.. It combines the low-latency performance of instance store volumes with the durability of EBS snapshots. By replicating data in real time to an EBS volume, the application benefits from the instance store's speed while the EBS volume provides a persistent copy that survives instance failure. Periodic snapshots of the EBS volume add further resilience by enabling point-in-time recovery, ensuring data is not lost even if the instance or its instance store fails.

Answer

Use instance store volumes with RAID 1 across multiple instances.

Answer

Use larger instance types with more instance store capacity.

Answer

Create an AMI of the instance periodically to capture the data.

Question 14

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent 503 errors. The engineer suspects the ALB is returning these errors because the target instances are unhealthy. Which metric should the engineer monitor to confirm this suspicion?

Accepted Answer

HealthyHostCount. The ALB publishes 'HealthyHostCount' metric showing the number of healthy targets. When this count drops to zero, the ALB cannot forward requests and returns 503 errors. Option A (RequestCount) is incorrect because it measures total requests, not health. Option B (UnhealthyHostCount) is a valid metric but does not directly confirm the suspicion that targets are unhealthy; a decreasing HealthyHostCount is more direct. Option D (TargetResponseTime) measures latency, not health status.

Answer

RequestCount

Answer

UnhealthyHostCount

Answer

TargetResponseTime

Question 15

A company runs a containerized application on Amazon ECS with Fargate. The application needs to store session state. Which service provides the MOST resilient and scalable solution?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis provides a highly available, scalable, and low-latency in-memory data store ideal for session state management in a containerized environment. It supports replication and automatic failover, ensuring resilience. Option B (Amazon EFS) is a file storage service with higher latency and not designed for sub-millisecond session retrieval. Option C (ephemeral storage on the container instance) is not durable; data is lost when the container stops or fails. Option D (Amazon S3) is object storage with higher latency and not optimized for frequent read/write operations required for session state.

Answer

Amazon EFS

Answer

Ephemeral storage on the container instance

Answer

Amazon S3

Question 16

A DevOps team wants to monitor the disk space utilization on their EC2 instances. What is the simplest way to achieve this?

Accepted Answer

Install the CloudWatch agent on the EC2 instances and configure the disk metric.. The CloudWatch agent can collect disk space metrics from EC2 instances, which is not available with default CloudWatch metrics. Option A is incorrect because AWS Systems Manager Inventory is used for software inventory and configuration, not real-time disk space monitoring. Option C is incorrect because EC2 detailed monitoring only provides more frequent metrics for standard EC2 metrics (CPU, network, etc.), not disk metrics. Option D is incorrect because EC2 basic monitoring also does not include disk metrics.

Answer

Use AWS Systems Manager Inventory to collect disk space data.

Answer

Enable EC2 detailed monitoring in CloudWatch.

Answer

Use EC2 basic monitoring in CloudWatch.

Question 17

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using customer-managed KMS keys. Additionally, any attempt to upload an unencrypted object must be denied. Which S3 bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: aws:kms. The condition 's3:x-amz-server-side-encryption':'aws:kms' in a Deny statement ensures that only requests with SSE-KMS encryption are allowed, blocking unencrypted uploads or uploads with other encryption types. Option A is wrong because 'true' is not a valid encryption type; the correct value is 'aws:kms'. Option B is wrong because it allows SSE-S3 (AES256), not KMS encryption. Option C is wrong because it checks a KMS encryption context rather than the encryption header, and it does not deny unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: true

Answer

Allow s3:PutObject with condition s3:x-amz-server-side-encryption: AES256

Answer

Allow s3:PutObject with condition kms:EncryptionContext: department:finance

Question 18

A company uses AWS CodePipeline with multiple stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The build stage runs a series of tests, and if they pass, the pipeline proceeds to deploy. Recently, a developer committed a change that passed all tests but caused a production outage. The team wants to add an approval step before the deploy stage, but they also want to ensure that only changes from specific branches can be deployed. What is the MOST secure and maintainable way to enforce this?

Accepted Answer

Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.. It enforces branch-based deployment at the pipeline level, ensuring that only changes from specific branches trigger the production pipeline with the approval step. This approach is secure and maintainable as it leverages AWS CodePipeline's native ability to trigger on branch events, avoiding custom logic or manual verification. By isolating production deployments to a dedicated pipeline, the team reduces the risk of unauthorized or untested code reaching production.

Answer

Use a Lambda function in the pipeline to check the branch name and fail if not allowed.

Answer

Add a manual approval step in the pipeline and rely on the approver to verify the branch.

Answer

Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.

Question 19

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts. They notice that a stack instance in one account is in a 'FAILED' status because of a permissions issue. After fixing the permissions, what is the most efficient way to retry the stack instance operation?

Accepted Answer

Use the 'Update stack instances' operation for the failed target account.. StackSets allow you to update stack instances individually; you can retry the specific failed instance without affecting others. Option A is wrong because updating the entire stack set would affect all accounts, which is inefficient. Option C is wrong because deleting and recreating the stack instance is disruptive. Option D is wrong because manual stack creation outside StackSets defeats the purpose.

Answer

Manually create the stack in the failed account using the same template.

Answer

Update the entire stack set to retry all stack instances.

Answer

Delete the stack instance from the stack set and add it again.

Question 20

Which THREE actions should a DevOps team take to ensure a CI/CD pipeline using AWS CodePipeline is secure? (Choose three.)

Accepted Answer

Use AWS KMS to encrypt artifacts in the pipeline.. AWS CodePipeline can use AWS KMS customer-managed keys (CMKs) to encrypt artifacts stored in S3 or other supported stores. This ensures that pipeline artifacts are encrypted at rest and in transit, protecting sensitive data from unauthorized access. By default, CodePipeline uses an AWS-managed key, but using a customer-managed KMS key gives the team full control over encryption, key rotation, and access policies.

Answer

Require multi-factor authentication (MFA) for pipeline executions.

Answer

Enable AWS CloudTrail to log pipeline executions.