DOP-C02 Practice Test 39 — 15 Questions

Question 1

A company uses AWS KMS to encrypt data in S3. They want to audit who used which KMS key and when. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all AWS KMS API calls, including the key ID, the principal who made the request, the time of the request, and the source IP address. These logs are delivered to an S3 bucket and can be queried using CloudTrail Insights or Athena to audit KMS key usage for S3 decryption events.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

AWS Config

Question 2

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application frequently experiences high latency during peak hours. The DevOps team needs to implement a solution that automatically adds capacity based on demand and reduces cost during off-peak hours. Which combination of AWS services should the team use?

Accepted Answer

Use an AWS Auto Scaling group with target tracking scaling policies based on the ALB's request count per target, and attach it to the ALB target group.. Target tracking scaling policies allow the Auto Scaling group to automatically adjust capacity based on a specific metric, such as ALB request count per target, which directly reflects the load on each instance. This ensures that capacity is added during high latency periods and removed during off-peak hours, optimizing both performance and cost. The ALB target group integration ensures that new instances are automatically registered and start receiving traffic.

Answer

Use an AWS Auto Scaling group with scheduled scaling policies that add instances during known peak hours and remove them during off-peak hours.

Answer

Implement Amazon Route 53 weighted routing policies to distribute traffic to multiple ALBs, each fronting a fixed set of EC2 instances.

Answer

Use an AWS Auto Scaling group with simple scaling policies based on CPU utilization and attach it to the ALB target group.

Question 3

An organization uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests that take 30 minutes. The team wants to speed up feedback without skipping tests. Which action should they take?

Accepted Answer

Configure parallel build actions in the Test stage to run tests concurrently.. Running integration tests in parallel within the Test stage reduces the total wall-clock time for the test suite, speeding up feedback without skipping any tests. AWS CodePipeline supports parallel actions within a stage, allowing multiple test suites to execute concurrently, which directly addresses the goal of faster feedback while maintaining test coverage.

Answer

Use a larger build environment for the Test stage.

Answer

Remove the Test stage and rely on post-deployment testing.

Answer

Move the Test stage to after deployment.

Question 4

An organization uses AWS CodeDeploy for automated deployments to EC2 instances. The deployment is failing with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum healthy hosts setting of 75%. The application has 4 instances. What is the MOST likely issue?

Accepted Answer

The deployment failed on 2 instances, leaving only 2 healthy.. With a minimum healthy hosts setting of 75% and 4 instances, at least 3 instances must remain healthy during deployment. If 2 instances fail, only 2 are healthy (50%), which falls below the 75% threshold, causing CodeDeploy to abort the deployment to prevent further impact. This error message directly corresponds to the healthy host count dropping below the configured minimum.

Answer

The AppSpec file references a script that does not exist.

Answer

The IAM instance profile does not have sufficient permissions.

Answer

The CodeDeploy agent is not installed on any of the instances.

Question 5

A company uses AWS CodeDeploy with a blue/green deployment configuration. The engineer wants to automatically roll back the deployment if the new instances fail the health check for 5 minutes. Which setting should the engineer configure?

Accepted Answer

Configure the deployment group to roll back when a CloudWatch alarm is triggered. AWS CodeDeploy blue/green deployments can be configured to automatically roll back when a CloudWatch alarm is triggered. By creating a CloudWatch alarm that monitors the health check endpoint and associating it with the deployment group, the engineer can ensure that if the alarm state persists for 5 minutes (as defined in the alarm's period and evaluation periods), CodeDeploy will automatically initiate a rollback to the previous working version.

Answer

Create a CloudWatch alarm that monitors the health check endpoint

Answer

Set the Auto Scaling group health check grace period to 5 minutes

Answer

Set the deployment configuration's 'timeout' to 5 minutes

Question 6

A developer wants to automate the testing of a serverless application built with AWS Lambda and Amazon API Gateway. Which AWS service is best suited for running integration tests as part of a CI/CD pipeline?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is best suited for running integration tests as part of a CI/CD pipeline because it is a fully managed continuous integration service that can compile source code, run tests, and produce software packages. For a serverless application using Lambda and API Gateway, CodeBuild can execute integration tests against deployed API endpoints, validate Lambda function responses, and integrate seamlessly with other AWS developer tools like CodePipeline. It supports custom build environments and can run test frameworks (e.g., Postman/Newman, Jest) directly in the pipeline.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Answer

AWS CloudFormation

Question 7

Refer to the exhibit. An alarm is configured as shown. The CPU utilization averages 85% for 10 minutes, then spikes to 95% for the next 5 minutes, and returns to 80%. How many times will the SNS topic receive a notification?

Accepted Answer

0. Per the exhibit: Period=300s (5 min), EvaluationPeriods=2, Threshold=90.0, ComparisonOperator=GreaterThanThreshold, no DatapointsToAlarm override (so 2 consecutive breaching 5-minute periods are required to enter ALARM). CPU averages 85% for two 5-minute periods (not breaching, since 85 is not > 90), then 95% for one 5-minute period (breaching), then returns to 80% (not breaching). The single breaching period is immediately preceded and followed by non-breaching periods, so the alarm never accumulates 2 consecutive breaches and never transitions into ALARM -- it stays in OK the entire time. Since neither AlarmActions nor OKActions fire without an actual state transition, and none occurs, the SNS topic receives zero notifications.

Answer

1

Answer

2

Answer

3

Question 8

A company runs a multi-tier web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors during peak traffic. The Auto Scaling group is configured with a step scaling policy based on CPU utilization. CloudWatch metrics show that CPU utilization never exceeds 70%, but the ALB target group reports that some targets are unhealthy. What is the MOST likely cause?

Accepted Answer

The application health check endpoint is returning HTTP 5xx or timing out.. ALB target groups mark targets unhealthy when the configured health check fails — typically because the application endpoint returns 5xx or times out. Unhealthy targets are removed from rotation, and if too few healthy targets remain to serve peak traffic, the ALB returns 503 Service Unavailable. Since CPU never exceeds 70%, the ASG is not scaling out, confirming the bottleneck is health-check failures rather than capacity.

Answer

The ALB is misconfigured with an incorrect security group blocking traffic to the targets.

Answer

The ALB connection draining settings are too short, causing in-flight requests to fail.

Answer

The step scaling policy is too aggressive and is terminating instances prematurely.

Question 9

An organization uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The engineer reviews the deployment logs and finds that the AppSpec file is correctly formatted and the scripts run successfully on some instances. What is the MOST likely cause?

Accepted Answer

The health check grace period for the Auto Scaling group is too short.. The error indicates that instances are failing the deployment health check after the AppSpec scripts run successfully. When the health check grace period for the Auto Scaling group is too short, instances may be marked unhealthy before the application has fully started and passed the target group health checks, causing CodeDeploy to consider them failed. This is the most likely cause because the scripts succeed on some instances but the overall deployment fails due to insufficient healthy instances.

Answer

The CodeDeploy agent is not installed on some instances.

Answer

The target group is not configured to route traffic to the instances.

Answer

The IAM role assigned to the EC2 instances does not have sufficient permissions.

Question 10

A company is using AWS Elastic Beanstalk with a custom platform. The platform is based on Amazon Linux 2 and includes a pre-installed application. The DevOps team needs to inject environment-specific configuration files into the EC2 instances during deployment. Which approach should be used?

Accepted Answer

Use .ebextensions configuration files in the application source bundle. Ebextensions configuration files are the native mechanism in Elastic Beanstalk to inject environment-specific configuration into EC2 instances during deployment. These YAML or JSON files, placed in the .ebextensions directory of the application source bundle, are processed by the Elastic Beanstalk platform engine to execute commands, create files, or modify configuration before the application starts, ensuring the custom platform receives the necessary environment-specific settings.

Answer

Use AWS CloudFormation to update the environment with new configuration

Answer

Use EC2 user-data scripts to download configuration from S3

Answer

Store configuration in AWS Systems Manager Parameter Store and retrieve it in the application

Question 11

A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled JARs) to the repository, causing the repository size to grow rapidly and slowing down clone operations. The team wants to enforce a policy to reject pushes that contain files larger than 50 MB. Which approach should be used?

Accepted Answer

Configure a CodeCommit trigger that invokes an AWS Lambda function to validate file sizes and reject the push.. AWS CodeCommit supports custom triggers that invoke AWS Lambda functions on repository events, including pushes. By configuring a trigger for the 'push' event, a Lambda function can inspect each file in the push payload, check its size against the 50 MB threshold, and programmatically reject the push by returning an error response. This approach enforces the policy at the repository level without requiring client-side changes.

Answer

Set up an Amazon CloudWatch Events rule to monitor repository size and alert when it exceeds a threshold.

Answer

Create an IAM policy that denies the `codecommit:GitPush` action if the file size exceeds 50 MB.

Answer

Use a pre-receive hook in the repository to reject large files by generating an S3 pre-signed URL.

Question 12

A company has a requirement to rotate database credentials every 30 days for an Amazon RDS for MySQL instance. The credentials are currently stored in AWS Secrets Manager. The DevOps engineer needs to implement automatic rotation without modifying the application code. Which solution should be used?

Accepted Answer

Configure Secrets Manager to automatically rotate the secret every 30 days using a Lambda rotation function, and have the application retrieve the secret using the Secrets Manager API.. AWS Secrets Manager natively supports automatic rotation of secrets using a Lambda function that updates both the secret in Secrets Manager and the password in the RDS MySQL instance. This solution meets the 30-day rotation requirement without modifying application code, as the application retrieves the current secret via the Secrets Manager API, which automatically handles versioning and caching.

Answer

Create a scheduled job that runs every 30 days to update the secret in Secrets Manager with a new password.

Answer

Store the credentials in AWS Systems Manager Parameter Store and configure automatic rotation using a Lambda function.

Answer

Use the AWS RDS automatic password rotation feature, which automatically updates the password every 30 days.

Question 13

Drag and drop the steps to troubleshoot an AWS CloudTrail that is not logging API calls.

Accepted Answer

Verify CloudTrail is enabled, then Check bucket policy, then Check log file integrity, then Check IAM role, then Test CloudTrail logging. First verify CloudTrail is enabled, then check bucket policy, then check integrity, then check IAM role, then test.

Answer

Check bucket policy, then Check IAM role, then Verify CloudTrail is enabled, then Check log file integrity, then Test CloudTrail logging

Answer

Verify CloudTrail is enabled, then Check log file integrity, then Check bucket policy, then Check IAM role, then Test CloudTrail logging

Answer

Check IAM role, then Verify CloudTrail is enabled, then Check bucket policy, then Check log file integrity, then Test CloudTrail logging

Question 14

A company uses Amazon Inspector to assess the security of EC2 instances. The security team receives an alert that a high-severity vulnerability (CVE-2023-XXXX) was found on an EC2 instance running a critical application. The application is behind an Application Load Balancer (ALB) and uses an Auto Scaling group. The vulnerability has a known patch, but patching requires a reboot. The security team needs to remediate the vulnerability with minimal downtime. Which approach should the team take?

Accepted Answer

Create a new launch template with an updated AMI that includes the patch. Update the Auto Scaling group to use the new launch template and perform a rolling update.. The correct approach is to bake the patch into a new AMI, create a new launch template, and perform a rolling update of the Auto Scaling group. This uses the immutable infrastructure pattern: new instances come up already patched, the ALB drains connections from old instances as they are replaced, and the rolling update maintains capacity throughout — achieving minimal downtime without manual intervention. It also ensures the fix persists across future scaling events and instance replacements.

Answer

Remove the instance from the Auto Scaling group, disable health checks on the ALB, and apply the patch manually.

Answer

Use AWS Systems Manager Patch Manager to apply the patch on the instance without rebooting, then verify the vulnerability is resolved.

Answer

Stop the vulnerable instance, apply the patch, and start it again. Re-register it with the ALB.

Question 15

A company has deployed a containerized application on Amazon ECS with Fargate. The application is fronted by an Application Load Balancer (ALB). The DevOps team is using CloudWatch Container Insights to monitor the ECS cluster. They notice that the 'MemoryUtilized' metric for the service is consistently above 80%, and the 'CPUUtilized' is around 50%. The ALB's 'TargetResponseTime' is increasing over time. The team wants to resolve the performance issue. Which action should the team take?

Accepted Answer

Increase the memory limit for the ECS task definition to allow the container to use more memory.. The metrics show MemoryUtilized consistently above 80% while CPUUtilized is only around 50%, and TargetResponseTime is rising — this is a classic memory-bound bottleneck. When a container approaches its memory limit, the kernel may reclaim page cache, trigger GC pressure, or begin swapping (if enabled), all of which degrade response time. Increasing the memory limit in the task definition gives the container headroom to operate without memory pressure, directly addressing the root cause.

Answer

Increase the CPU limit for the ECS task definition to improve performance.

Answer

Increase the number of ALB targets by adding more availability zones.

Answer

Increase the desired count of the ECS service to distribute the load across more tasks.