DOP-C02 Practice Test 33 — 15 Questions

Question 1

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. After a deployment, some instances fail the health check and are terminated by the Auto Scaling group. What should the DevOps engineer do to prevent this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the deployment group to use an Elastic Load Balancer and configure health checks.. Configuring an Elastic Load Balancer (ELB) with health checks in the CodeDeploy deployment group allows CodeDeploy to monitor instance health during deployment. If an instance fails the ELB health check, CodeDeploy can automatically roll back or stop the deployment, preventing the Auto Scaling group from terminating unhealthy instances. This integrates the deployment lifecycle with load balancer health signals, ensuring only healthy instances serve traffic.

Answer

Configure a CloudWatch alarm to stop the deployment if instances are unhealthy.

Answer

Modify the deployment configuration to deploy to only one instance at a time.

Answer

Increase the desired capacity of the Auto Scaling group to tolerate failures.

Question 2

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The DevOps team wants to monitor the end-to-end latency of API requests, including the time spent in API Gateway and Lambda. Which approach provides the most granular breakdown?

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. AWS X-Ray provides end-to-end tracing with detailed segments for API Gateway and Lambda, allowing per-request breakdown of latency across each component. Option A (Lambda Insights) offers OS-level metrics like CPU and memory, not request-level latency breakdown. Option C (VPC Flow Logs) captures network traffic metadata but not application layer latency. Option D (combining CloudWatch metrics) only gives aggregate statistics and cannot break down latency per request or within a single request's path.

Answer

Enable Lambda Insights to get per-request latency breakdown.

Answer

Enable VPC Flow Logs to capture network round-trip times.

Answer

Use CloudWatch metrics for API Gateway and Lambda, then add them together.

Question 3

A startup is using AWS CodePipeline to deploy a Python web application to AWS Elastic Beanstalk. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (Elastic Beanstalk). The build stage runs unit tests and creates a deployable zip file. The deploy stage uses the Elastic Beanstalk deploy provider. Recently, the deploy stage started failing with the error: 'The API call 'elasticbeanstalk:CreateApplicationVersion' failed with status 403.' The CodePipeline service role has the following permissions: 'elasticbeanstalk:DescribeApplications', 'elasticbeanstalk:DescribeEnvironments', 'elasticbeanstalk:UpdateEnvironment'. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Add the 'elasticbeanstalk:CreateApplicationVersion' and 'elasticbeanstalk:DeleteApplicationVersion' permissions to the CodePipeline service role. The 403 error on elasticbeanstalk:CreateApplicationVersion indicates the CodePipeline service role lacks that specific IAM action. Elastic Beanstalk's deploy provider calls CreateApplicationVersion to register the new application revision, and it also calls DeleteApplicationVersion during cleanup of old revisions. Adding both permissions to the CodePipeline service role resolves the authorization failure without changing the pipeline architecture.

Answer

Change the deploy provider to use CodeDeploy instead of Elastic Beanstalk

Answer

Add 's3:PutObject' permission to the CodePipeline service role to allow it to upload the zip file to S3

Answer

Update the Elastic Beanstalk environment's service role to allow CodePipeline to deploy

Question 4

A company uses AWS CodePipeline to deploy applications. The pipeline must deploy to an Amazon ECS cluster. The security team requires that all deployment actions be logged and auditable. Which configuration should be used?

Accepted Answer

Enable AWS CloudTrail to record all API calls made by CodePipeline.. AWS CloudTrail records all API calls made to AWS services, including those made by CodePipeline when it invokes ECS deployment actions (such as UpdateService, RegisterTaskDefinition, or CreateDeployment). Enabling CloudTrail provides the audit trail required by the security team, capturing who made the call, when, from where, and what the request contained.

Answer

Enable VPC Flow Logs for the ECS cluster's VPC.

Answer

Enable Amazon S3 server access logs for the artifact bucket used by CodePipeline.

Answer

Enable Amazon CloudWatch Logs for the CodePipeline.

Question 5

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group across three Availability Zones. The instances run a Java application that connects to an Amazon RDS Multi-AZ MySQL database. The application also uses Amazon ElastiCache for Redis for session caching. The company recently experienced a severe outage where the ALB's 5xx error rate spiked to 100% for 45 minutes. The root cause was a combination of a slow-running query on the RDS primary instance and a subsequent failover that caused the application to lose connections to the database. The failover happened because the slow query caused the primary to become unresponsive, triggering a Multi-AZ failover. During the failover, the application's connection pool exhausted, and new connections failed. The application logs show a high rate of 'java.sql.SQLTimeoutException' and 'com.mysql.cj.exceptions.CJCommunicationsException'. The DevOps team needs to implement a long-term solution that minimizes the impact of similar incidents. The solution must be cost-effective and require minimal application changes. Which combination of actions should the DevOps team take?

Accepted Answer

Implement Amazon RDS Proxy to manage database connections and add read replicas to offload read traffic.. Amazon RDS Proxy is the correct solution because it efficiently manages database connection pooling, reducing the likelihood of connection exhaustion during failovers. By maintaining a warm connection pool and automatically reconnecting to the new primary after a Multi-AZ failover, RDS Proxy minimizes application-side connection timeouts and errors like SQLTimeoutException and CJCommunicationsException. Adding read replicas offloads read traffic, reducing the load on the primary and mitigating the risk of slow queries causing unresponsiveness. This combination requires minimal application changes and is cost-effective compared to scaling the primary instance.

Answer

Use an Auto Scaling policy for EC2 based on RDS connection count and implement a read replica for the primary.

Answer

Configure Multi-AZ RDS with a synchronous standby and use Amazon RDS for MySQL with enhanced monitoring.

Answer

Increase the instance size of the RDS primary and enable Performance Insights to identify slow queries.

Question 6

A company runs a multi-region application on Amazon EC2 instances across us-east-1 and eu-west-1. The application uses an Amazon Aurora global database for writes in us-east-1 and reads in eu-west-1. The DevOps team wants to monitor the replication lag between the primary and secondary regions. They have set up a CloudWatch alarm on the AuroraReplicaLag metric in both regions. However, they notice that the alarm in eu-west-1 sometimes triggers false positives when the lag spikes briefly but then recovers. The team wants to reduce false alarms while still being alerted to sustained high lag that could impact read replicas. The team is already using a standard CloudWatch alarm with a period of 1 minute and evaluation periods of 1. What should the team change to reduce false positives?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if the lag is high for 3 consecutive minutes.. The false positives occur because a single 1-minute evaluation period triggers on brief, transient lag spikes. Increasing the number of evaluation periods to 3 means the alarm fires only when the lag exceeds the threshold for 3 consecutive 1-minute periods, filtering out short spikes while still catching sustained high lag. This is the standard CloudWatch approach to reduce false positives without losing sensitivity to real issues.

Answer

Increase the alarm threshold to a higher value, such as 10 seconds.

Answer

Reduce the metric period to 30 seconds to get more granular data.

Answer

Create a composite alarm that triggers when both the AuroraReplicaLag and CPUUtilization metrics are high.

Question 7

Refer to the exhibit. An administrator wants to be notified when any EC2 instance is launched in the account. Which combination of services would provide the most efficient and cost-effective solution?

Accepted Answer

Create an Amazon EventBridge rule that matches RunInstances events from CloudTrail and sends to an SNS topic.. The most efficient and cost-effective solution is to create an Amazon EventBridge rule that matches RunInstances events from CloudTrail and sends notifications to an SNS topic. EventBridge provides near real-time event processing with minimal overhead, and CloudTrail captures EC2 instance launch events. This avoids the need for continuous polling or additional services.

Answer

Enable detailed billing reports and create a cost anomaly detection monitor.

Answer

Use AWS Config rules to detect non-compliant instances and trigger an SNS notification.

Answer

Set up a CloudWatch alarm on the RunInstances metric in the EC2 namespace.

Question 8

A company uses CloudWatch Synthetics canaries to monitor a critical API endpoint. Recently, a canary started failing with a '403 Forbidden' error. The DevOps engineer verifies that the canary's IAM role has the necessary permissions to invoke the API and that the API endpoint is publicly accessible. What should the engineer check NEXT?

Accepted Answer

Check if the API requires an API key or other authentication that the canary is not providing.. A 403 Forbidden error indicates that the request reached the API but was denied due to authentication or authorization issues. Since the canary's IAM role has the necessary permissions and the endpoint is publicly accessible, the most likely cause is that the API requires an API key or other authentication mechanism (e.g., a token) that the canary is not providing. Checking for missing authentication is the logical next step.

Answer

Review the canary's CloudWatch Logs for any runtime errors.

Answer

Increase the canary's memory to 512 MB to prevent timeout-related issues.

Answer

Verify that the canary is attached to the correct VPC and subnet.

Question 9

A company uses AWS CodeCommit as a Git repository and CodeBuild for continuous integration. The buildspec.yml file includes steps to run unit tests and package the application. The team wants to ensure that only code from the main branch is deployed to production. They have set up a CodePipeline that triggers on changes to any branch. The pipeline includes a build stage that runs CodeBuild, and then a deploy stage that deploys to production. The team noticed that code from feature branches is being deployed to production accidentally. The team wants to modify the pipeline to prevent this. What is the MOST effective solution?

Accepted Answer

In the CodePipeline source stage, configure the branch filter to only allow the main branch to trigger the pipeline.. The most effective fix is to configure the CodePipeline source stage with a branch filter that only allows the main branch to trigger the pipeline. This prevents feature-branch commits from ever entering the pipeline, stopping the accidental production deployment at the source rather than downstream.

Answer

Use IAM policies to restrict developers from pushing to the main branch.

Answer

Add a manual approval step before the deploy stage and require approval from a senior engineer.

Answer

Modify the CodeBuild project to only build the main branch by specifying the branch in the source configuration.

Question 10

A DevOps engineer is troubleshooting an issue where an Amazon RDS instance's CPU utilization is consistently high. The engineer has enabled Performance Insights and sees that the top SQL query is a SELECT statement that scans many rows. What is the best course of action to reduce CPU utilization?

Accepted Answer

Add appropriate indexes to optimize the query.. Adding appropriate indexes to optimize the query is the best course of action because the high CPU utilization is caused by a SELECT statement that scans many rows. Indexes allow the database to locate rows efficiently without scanning the entire table, reducing CPU load and improving query performance. This directly addresses the root cause identified by Performance Insights.

Answer

Create a read replica to offload read traffic.

Answer

Increase the allocated storage to improve I/O.

Answer

Increase the DB instance size to handle the load.

Question 11

A company uses AWS CodePipeline for CI/CD. During a production deployment, the pipeline fails at the 'Deploy' stage with an error: 'The deployment failed because the deployment group does not have enough capacity to handle the deployment.' The engineer checks the CodeDeploy deployment group and sees that it is configured with a minimum healthy hosts of 100% and a deployment configuration of 'CodeDeployDefault.OneAtATime'. What is the MOST likely cause?

Accepted Answer

The deployment group has only one instance, and the minimum healthy hosts setting prevents the deployment.. With a minimum healthy hosts of 100% and a OneAtATime deployment configuration, CodeDeploy must keep all instances healthy during the deployment. If the deployment group contains only one instance, taking it out of service to deploy would drop healthy hosts below 100%, making the deployment impossible. This is the most likely cause of the capacity error.

Answer

The deployment configuration 'OneAtATime' is not compatible with the deployment group.

Answer

The target group health check is misconfigured, causing all instances to be unhealthy.

Answer

The CodeDeploy agent on the instances is not running.

Question 12

A company experiences a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The DevOps team needs to identify the source IP address and user agent of the request. Which AWS service provides this information?

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs record detailed information about every request made to a bucket, including the requester's IP address, user agent, request time, and operation. This is the only AWS service in the list that captures the source IP and user agent for S3 object-level requests. CloudTrail records API management events but does not log data-plane GET/PUT requests by default.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 13

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team needs to receive notifications when stack creation fails. Which approach should be used to automate this monitoring?

Accepted Answer

Create a CloudWatch Events rule that matches CloudFormation 'CREATE_FAILED' stack events and targets an SNS topic.. CloudWatch Events (now Amazon EventBridge) can match CloudFormation stack events with the detail-type 'CloudFormation Stack Status Change' and filter for CREATE_FAILED, then target an SNS topic for notification. This is the native, event-driven approach for automating failure alerts without polling or log parsing. It provides near-real-time notification with minimal configuration.

Answer

Use AWS Config rules to detect failed stack creations.

Answer

Enable CloudTrail and create a metric filter for 'CreateStack' API calls.

Answer

Stream CloudFormation logs to CloudWatch Logs and create a metric filter for 'CREATE_FAILED'.

Question 14

A DevOps engineer notices that an Amazon RDS for MySQL instance has failed over to a standby replica. The engineer needs to identify the root cause by examining metrics. Which AWS service should the engineer use to view the database load, replication lag, and failover events?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides RDS metrics including DatabaseConnections, ReplicaLag, ReadIOPS, and failover-related events. CloudWatch alarms and the RDS console's monitoring graphs surface failover events and replication lag, making it the correct service for diagnosing an RDS failover root cause.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Question 15

A company uses Amazon Inspector to scan EC2 instances for vulnerabilities. The security team discovers that a critical vulnerability is present on an instance, but the instance is part of an Auto Scaling group. What is the MOST efficient way to remediate this vulnerability while ensuring the Auto Scaling group remains operational?

Accepted Answer

Create a new AMI with the patch, update the Auto Scaling group's launch template, and terminate instances one by one to trigger replacement.. The immutable-infrastructure approach — build a patched AMI, update the Auto Scaling group's launch template, and roll instances — ensures every new instance is born patched and the ASG maintains capacity throughout. Terminating instances one by one triggers replacement with the new AMI while the group stays operational.

Answer

Patch the instance manually via SSH, then create a new AMI from it and update the launch configuration.

Answer

Detach the instance from the Auto Scaling group, patch it, and reattach it.

Answer

Use AWS Systems Manager Patch Manager to patch the instance and then set the instance to not receive future updates.