DOP-C02 Practice Test 40 — 15 Questions

Question 1

A company uses AWS CloudTrail to log API activity across multiple accounts. The security team needs to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the audit account, and that any log file validation failures trigger an immediate notification. What should the engineer do to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudTrail log file validation and create a CloudWatch alarm on the DigestDeliveryFailed metric. Enabling CloudTrail log file validation triggers the generation of digest files that contain hash values for verifying log file integrity. CloudTrail also emits the DigestDeliveryFailed metric to CloudWatch when a digest file delivery fails. Creating a CloudWatch alarm on this metric allows you to send immediate notifications via SNS when a validation failure occurs. Option B (Lambda function) is unnecessary because CloudTrail already provides the necessary metrics for this alerting. Option C (SNS notifications for all events) would generate excessive notifications and does not directly address log file validation failures. Option D (CloudWatch Logs and metric filter) is not the standard approach; CloudTrail directly emits the DigestDeliveryFailed metric, which is simpler and more reliable.

Answer

Create a Lambda function that checks the integrity of logs and publishes to SNS

Answer

Configure CloudTrail to deliver logs to the S3 bucket and enable SNS notifications for all events

Answer

Send CloudTrail logs to CloudWatch Logs and create a metric filter for validation errors

Question 2

Refer to the exhibit. A DevOps engineer applies the IAM policy shown to an S3 bucket to enforce server-side encryption. However, users report that some uploads succeed without encryption. What is the most likely reason?

Accepted Answer

The policy only allows the action but does not deny actions that do not meet the condition.. The IAM policy only allows the s3:PutObject action when the encryption condition is met, but it does not include an explicit Deny statement to block uploads that do not satisfy the condition. In IAM, an Allow statement with a condition does not automatically deny requests that fail the condition; it simply does not apply the Allow. If there is another policy (e.g., a bucket policy or an identity-based policy) that grants s3:PutObject without the encryption condition, or if the default S3 behavior permits unencrypted uploads (since S3 does not require encryption by default), then unencrypted uploads can still succeed. To enforce encryption, you must add a Deny statement with a condition like `StringNotEquals` on `s3:x-amz-server-side-encryption` to explicitly reject requests that lack the required encryption header.

Answer

The policy uses StringEquals instead of StringNotEquals.

Answer

The resource ARN is incorrect; it should be the bucket ARN.

Answer

The action should be s3:PutEncryptedObject instead of s3:PutObject.

Question 3

An organization uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The deployment is failing consistently with the error 'ScriptMissing' for the AppSpec lifecycle hook 'ApplicationStop'. The scripts are located in the /opt/scripts directory on the instances. What is the most likely cause of this error?

Accepted Answer

The AppSpec file specifies a path to the script that does not exist on the instance.. The 'ScriptMissing' error in AWS CodeDeploy indicates that the deployment lifecycle hook (in this case, 'ApplicationStop') cannot find the script file at the path specified in the AppSpec file. Since the scripts are located in /opt/scripts, the most likely cause is that the AppSpec file's 'location' field for the ApplicationStop hook points to a path that does not match the actual file location on the instance, or the script file itself is missing from that directory.

Answer

The ApplicationStop hook is not defined in the AppSpec file.

Answer

The CodeDeploy agent is not the latest version.

Answer

The scripts have incorrect file permissions.

Question 4

A startup is using AWS CodeBuild to build and test their application. The build process takes about 10 minutes. Recently, they noticed that some builds are failing randomly with the error 'Could not download dependencies'. The build environment uses a custom Docker image stored in Amazon ECR. The team suspects that the issue is due to network connectivity problems when pulling the Docker image or dependencies from the internet. They want to ensure reliable and faster builds. Which solution should they implement?

Accepted Answer

Configure CodeBuild to use a VPC with a NAT gateway. To improve reliability and speed, configure CodeBuild to use a VPC with a NAT gateway. This provides consistent internet access for pulling dependencies and Docker images, and allows using VPC endpoints for Amazon ECR, reducing network failures. Option D is correct. Option A (using a public Docker Hub) does not address the underlying network issues and may introduce additional points of failure. Option B (increasing build timeout) does not fix the root cause of connectivity problems. Option C (using a larger compute type) does not resolve network connectivity issues.

Answer

Switch to using a public Docker image from Docker Hub

Answer

Increase the build timeout in CodeBuild project settings

Answer

Use a larger compute type for the CodeBuild project

Question 5

A company runs a critical application on Amazon ECS with Fargate. The application experiences intermittent slow responses. The DevOps team enabled Container Insights and CloudWatch ServiceLens. However, traces from the application do not appear in ServiceLens. The application uses the AWS X-Ray SDK for tracing. What is the MOST likely cause?

Accepted Answer

The X-Ray daemon is not running in the task definition.. The X-Ray daemon is required to act as a local intermediary that receives trace segments from the X-Ray SDK and forwards them to the AWS X-Ray API. In Amazon ECS with Fargate, the daemon must be explicitly included as a sidecar container in the task definition. Without it, the SDK cannot send traces, which explains why traces are missing from ServiceLens despite the SDK being integrated.

Answer

The X-Ray SDK cannot send traces to AWS X-Ray from Fargate tasks.

Answer

ServiceLens does not support Amazon ECS with Fargate launch type.

Answer

The application is not sending metrics to CloudWatch Container Insights.

Question 6

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer has updated the files in the S3 bucket. What should the engineer do to ensure users see the latest content?

Accepted Answer

Create an invalidation for the updated file paths.. Creating a CloudFront invalidation for the specific file paths forces the edge locations to fetch the updated content from the S3 origin immediately, ensuring users see the latest files. Option B is incorrect because changing the bucket policy to allow public access does not affect CloudFront's cache; it only controls direct access to the bucket. Option C is incorrect because reducing the TTL affects how long new content is cached but does not clear already-cached outdated content. Option D is incorrect because deleting and recreating the distribution is an overly disruptive solution; a simple invalidation suffices.

Answer

Change the S3 bucket policy to allow public access.

Answer

Reduce the TTL for the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 7

A company needs to ensure that all API calls made to AWS are encrypted in transit. Which of the following is the correct way to enforce this?

Accepted Answer

Use an IAM policy with a condition that denies access unless the request uses HTTPS.. All AWS API endpoints support HTTPS (TLS) by default. To enforce that all API calls are encrypted in transit, you can use an IAM policy with a condition that denies access unless the request uses HTTPS. Specifically, you can use the `aws:SecureTransport` condition key to require encrypted connections. Option A is correct. Option B is incorrect because security groups control network traffic at the instance level but do not enforce encryption for API calls. Option C is incorrect because AWS KMS is used for managing encryption keys, not for enforcing HTTPS. Option D is incorrect because AWS CloudTrail logs API activity but does not enforce encryption.

Answer

Configure security groups to allow only HTTPS traffic.

Answer

Use AWS Key Management Service (KMS) to create a key and require encryption.

Answer

Enable AWS CloudTrail to log all API calls.

Question 8

A DevOps engineer is investigating an incident where an EC2 instance became unreachable. The engineer checks the AWS Management Console and finds the instance is running, but the status check shows '2/2 checks passed' and the system log shows no errors. What should the engineer do NEXT to diagnose the connectivity issue?

Accepted Answer

Check the security group and network ACL rules to ensure inbound traffic is allowed.. Since the instance is running, status checks pass, and the system log shows no errors, the issue is not with the operating system or underlying hardware. The most likely cause is a network-layer restriction, such as security group or network ACL rules blocking inbound traffic. Checking these rules is the correct next step because they control traffic at the instance and subnet levels, respectively, and misconfigurations here are a common cause of unreachability despite healthy instance status.

Answer

Review the CloudWatch metrics for CPU utilization and network throughput.

Answer

Reboot the instance to reset the network interface.

Answer

Stop and start the instance to move it to new underlying hardware.

Question 9

A DevOps engineer is managing the lifecycle of a CloudFormation stack. The engineer needs to update a stack that contains an Auto Scaling group. The update requires a replacement of the Auto Scaling group. What will happen to the existing instances during the update?

Accepted Answer

The existing instances will be terminated after the new Auto Scaling group is created. When a CloudFormation stack update requires replacement of an Auto Scaling group (e.g., due to a change in the `LaunchConfigurationName` or `LaunchTemplate` property), CloudFormation creates the new Auto Scaling group first, then terminates the old instances after the new group is fully operational. This ensures minimal downtime because the new group begins serving traffic before the old one is torn down.

Answer

The stack update will fail because Auto Scaling groups cannot be replaced

Answer

The existing instances will remain running and be associated with the new Auto Scaling group

Answer

The instances will be updated in-place by terminating and recreating each instance one by one

Question 10

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage that runs 'npm install' and 'npm test'. The team notices that the build stage often fails due to network timeouts when downloading npm packages. Which action would MOST reliably resolve this issue?

Accepted Answer

Configure the CodeBuild project to use a VPC with a NAT gateway to the internet.. The network timeouts occur because the CodeBuild project lacks outbound internet access to reach the npm registry. By configuring the CodeBuild project to use a VPC with a NAT gateway, you provide a stable, routable path to the internet via the NAT gateway's elastic IP, eliminating intermittent connectivity issues caused by relying on public endpoints through a non-VPC network path.

Answer

Use a custom Docker image that includes pre-installed npm packages.

Answer

Enable local dependency caching in the buildspec file.

Answer

Increase the build timeout to the maximum value.

Question 11

A company runs a stateless web application on Amazon ECS with Fargate. The application must be highly available across multiple Availability Zones. What is the BEST way to achieve this?

Accepted Answer

Create an ECS service with tasks in multiple AZs and place an ALB in front.. Running an ECS service with tasks in multiple Availability Zones (AZs) and placing an Application Load Balancer (ALB) in front ensures that if one AZ becomes unavailable, the ALB can route traffic to healthy tasks in the remaining AZs. This architecture provides both high availability and fault tolerance for the stateless web application, as the ALB performs health checks and distributes requests across tasks in different AZs.

Answer

Use an Auto Scaling group of EC2 instances in a single AZ and run ECS tasks on them.

Answer

Deploy a CloudFront distribution with multiple origins in different AZs.

Answer

Deploy a single ECS service with tasks in one AZ and use an ALB.

Question 12

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance and an EC2 instance that connects to it. The DB instance has a deletion policy of 'Retain'. The stack fails to delete because the DB instance is retained and still exists. Which TWO actions would allow the stack to be deleted successfully? (Select TWO.)

Accepted Answer

Manually delete the DB instance using the RDS console.. Manually deleting the retained DB instance removes the resource that is blocking the stack deletion. CloudFormation cannot delete a stack that contains a resource with a 'Retain' deletion policy until that resource is manually removed, as the stack expects the resource to no longer exist for the deletion to complete.

Answer

Use the AWS CLI to force delete the stack with the --force option.

Answer

Disable termination protection on the EC2 instance.

Answer

Modify the DB instance to allow deletion by setting DeletionProtection to false.

Question 13

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer (ALB). The application uses an RDS MySQL database. The security team performed a penetration test and discovered that the application is vulnerable to SQL injection. The development team has deployed a WAF web ACL to the ALB that includes rules to block SQL injection attacks. However, after the deployment, the application started returning 403 errors for legitimate requests, and the security team needs to investigate. The team also wants to ensure that only approved AWS services can access the RDS database. The current security groups are configured with a rule that allows inbound traffic from the ALB security group to the RDS database on port 3306. Which combination of actions should the security team take to resolve the issue and improve the security posture?

Accepted Answer

Switch the WAF web ACL to count mode while tuning the rules, and implement an IAM policy to restrict database access to specific AWS services using the aws:SourceArn condition key.. The correct answer. Switching the WAF web ACL to count mode allows the security team to monitor requests that would be blocked without actually blocking them, enabling them to fine-tune the rules to eliminate false positives while still protecting against SQL injection. Additionally, implementing an IAM policy with the aws:SourceArn condition key can restrict database access to only approved AWS services, such as Lambda functions or specific EC2 instances, enhancing the security posture beyond just network-level controls. Option A is incorrect because disabling WAF rules would leave the application vulnerable, and network ACLs are stateless and not sufficient for fine-grained access control. Option B is incorrect because relying solely on security groups with VPC CIDR allows broad access and does not address the false positive issue. Option C is incorrect because adding a second ALB is unnecessary and does not solve the false positive problem, and using count mode alone without IAM policy does not address database access restrictions.

Answer

Disable the WAF rules that are causing false positives and add network ACLs to block all traffic to the database except from the ALB.

Answer

Remove the WAF web ACL and rely on security group ingress rules that allow all traffic from the VPC CIDR to the database.

Answer

Switch the WAF web ACL to count mode and add a second ALB in front of the database to filter traffic.

Question 14

A company uses AWS Systems Manager to manage configuration compliance. They want to ensure that all EC2 instances have a specific security patch installed. Which Systems Manager capability should they use?

Accepted Answer

Patch Manager. Patch Manager is the correct Systems Manager capability because it is specifically designed to automate the process of patching managed instances with security updates and other types of patches. It can scan for missing patches and enforce compliance by applying patches on a schedule or on demand, directly addressing the requirement to ensure all EC2 instances have a specific security patch installed.

Answer

Automation

Answer

Parameter Store

Answer

State Manager

Question 15

A DevOps engineer is investigating why an Amazon ECS service is not scaling out as expected. The service has a target tracking scaling policy based on average CPU utilization. The CloudWatch alarm shows that CPU utilization has exceeded the target for several minutes, but no scaling activity has occurred. What is the most likely cause?

Accepted Answer

The scaling policy has a cooldown period that is still in effect from a previous scaling activity.. Target tracking scaling policies in Amazon ECS have a cooldown period (default 300 seconds) that prevents the policy from initiating additional scaling activities immediately after a previous scaling action. If a recent scaling activity occurred, the cooldown period would still be in effect, causing the policy to ignore the alarm even though CPU utilization has exceeded the target. This is the most likely reason no scaling activity is observed despite the alarm being triggered.

Answer

The ECS service is configured with a minimum healthy percent that prevents scaling out.

Answer

The ECS service does not have an IAM role that allows it to call CloudWatch.

Answer

The CloudWatch alarm is configured with a period that is too long.