DOP-C02 Practice Test 41 — 15 Questions

Question 1

A DevOps team is designing a disaster recovery plan for an RDS MySQL database. The database must be recoverable with minimal data loss in case of a regional failure. Which solution provides the LOWEST Recovery Point Objective (RPO)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Cross-Region Read Replica.. A Cross-Region Read Replica provides the lowest Recovery Point Objective (RPO) because it uses asynchronous replication to continuously replicate data changes from the primary region to a replica in another region. In the event of a regional failure, you can promote the replica to a standalone primary database, typically losing only a few seconds to minutes of data, depending on replication lag. This minimizes data loss compared to snapshot-based or batch replication methods.

Answer

Take daily automated snapshots and copy them to another Region.

Answer

Use a Multi-AZ deployment with synchronous standby.

Answer

Use RDS Proxy to cache database writes.

Question 2

A company is using AWS Lambda to process streaming data from Amazon Kinesis. The processing rate is slower than expected, and the engineer needs to monitor the number of records that are failing processing. Which metric should be used to create a CloudWatch alarm?

Accepted Answer

IteratorAge. The IteratorAge metric measures the age of the last record in the Lambda function's iterator, indicating how far behind real-time the processing is. A high or increasing IteratorAge suggests that records are being retried or stuck due to processing failures, making it the correct metric to monitor for records failing processing in a Kinesis-triggered Lambda.

Answer

Invocations

Answer

Errors

Answer

Throttles

Question 3

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses an Application Load Balancer (ALB) and an Amazon ElastiCache Redis cluster. Users report that after a scaling event, they are logged out and lose session data. What is the most likely cause?

Accepted Answer

The ElastiCache cluster is not configured for Multi-AZ and a node failure caused all sessions to be lost. The scenario describes a stateful web application that relies on ElastiCache Redis for session storage. If the ElastiCache cluster is not configured for Multi-AZ, a node failure can cause all cached session data to be lost, logging users out. This is the most likely cause of session loss after a scaling event, as scaling events do not directly affect ElastiCache data persistence.

Answer

The ALB health check interval is too short, causing healthy instances to be marked unhealthy

Answer

The ElastiCache cluster is configured with in-transit encryption, causing session tokens to be invalidated

Answer

The Auto Scaling group is using a termination policy that terminates the oldest instance first, which holds active sessions

Question 4

A company uses AWS X-Ray to trace requests through its microservices application. The DevOps engineer notices that some traces are incomplete. What is a possible reason?

Accepted Answer

The X-Ray SDK sampling rate is configured too low, causing many requests to be skipped.. The X-Ray SDK uses a sampling rate to decide which requests to record. If the sampling rate is set too low, a large percentage of requests are skipped, leading to incomplete traces. The DevOps engineer would observe missing segments for requests that were not sampled, even though the daemon and SDK are functioning correctly.

Answer

The X-Ray daemon is not running on the application servers.

Answer

X-Ray cannot trace requests that cross multiple AWS services.

Answer

X-Ray requires the CloudWatch agent to be installed on all EC2 instances.

Question 5

A DevOps team uses AWS Elastic Beanstalk to deploy a web application. They want to implement a blue/green deployment strategy to minimize downtime. Which configuration change should they make?

Accepted Answer

Create a new environment and perform a CNAME swap.. Blue/green deployment in AWS Elastic Beanstalk is achieved by creating a separate environment (the 'green' environment) with the new application version, then swapping the CNAME of the existing 'blue' environment to point to the green environment. This CNAME swap is instantaneous and does not require DNS propagation, minimizing downtime. Option A correctly describes this process.

Answer

Set the deployment policy to 'All at once'.

Answer

Set the deployment policy to 'Rolling' with a batch size of 50%.

Answer

Set the deployment policy to 'Immutable'.

Question 6

A company is using AWS CodeBuild to compile a Java application. The build takes over 30 minutes, which is too long. The project uses the standard build environment. The source code is stored in an S3 bucket. What is the most effective way to reduce build time?

Accepted Answer

Enable local caching for dependencies in the buildspec.yml.. Enabling local caching in the buildspec.yml allows CodeBuild to reuse previously downloaded dependency files (e.g., Maven .m2 repository) across builds, significantly reducing the time spent on dependency resolution. Since the build takes over 30 minutes, caching avoids re-downloading dependencies on every build, which is the most effective optimization for a standard build environment.

Answer

Use a custom build environment with pre-installed Java.

Answer

Store the source code in AWS CodeCommit instead of S3.

Answer

Increase the compute type to a larger instance.

Question 7

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The pipeline has a Source stage that polls the repository for changes. Recently, developers have noticed that the pipeline does not always trigger when code is pushed to the main branch. What is the most likely cause?

Accepted Answer

The number of pushes to the repository has exceeded the CodePipeline poll rate limit.. CodePipeline uses a polling mechanism to check for changes in CodeCommit repositories. When the number of pushes exceeds the default poll rate limit (typically one request per 15 seconds), the pipeline may miss some changes, leading to inconsistent triggering. This is a known limitation of polling-based detection, especially in high-velocity development environments.

Answer

The repository does not have a webhook configured to notify CodePipeline of changes.

Answer

The IAM role used by CodePipeline does not have permission to read from CodeCommit.

Answer

CloudWatch Events is not enabled for the repository.

Question 8

Which TWO actions can be taken to protect an S3 bucket from being publicly accessible? (Select TWO.)

Accepted Answer

Use an SCP to deny s3:PutBucketPolicy.. An SCP (Service Control Policy) can explicitly deny the s3:PutBucketPolicy action at the AWS Organizations level, which prevents any IAM principal in affected accounts from attaching a public bucket policy. This is a preventive guardrail that overrides any permissive IAM permissions, ensuring the bucket cannot be made publicly accessible via policy statements.

Answer

Enable default encryption on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Use CloudFront to serve the bucket content.

Question 9

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must be resilient to regional outages. Which THREE steps should the company take to achieve multi-Region resilience? (Choose THREE.)

Accepted Answer

Configure Route 53 with a failover routing policy to direct traffic to the secondary Region if the primary fails.. Amazon Route 53 with a failover routing policy allows the company to route traffic to a secondary Region when health checks detect a failure in the primary Region. This provides DNS-level failover, which is a fundamental component of multi-Region resilience for HTTP-based applications.

Answer

Use Amazon CloudFront with multiple origins pointing to each Region's API Gateway.

Answer

Deploy Lambda@Edge functions to handle requests at edge locations.

Question 10

An organization manages multiple AWS accounts using AWS Organizations. They want to enforce that all Amazon S3 buckets across accounts have versioning enabled. Which approach is the most scalable and least error-prone?

Accepted Answer

Create an SCP that denies s3:PutBucketVersioning if versioning is not enabled.. A Service Control Policy (SCP) in AWS Organizations can deny the `s3:PutBucketVersioning` action unless versioning is already enabled, effectively preventing the creation or modification of buckets without versioning. This approach is scalable as it applies to all accounts in the organization automatically and is least error-prone because it enforces the policy at the API level, blocking non-compliant actions before they occur.

Answer

Use AWS Config rules to detect buckets without versioning and send alerts.

Answer

Deploy a CloudFormation StackSet to all accounts with a template that enables versioning.

Answer

Manually enable versioning on each bucket after creation.

Question 11

A company's application uses Amazon DynamoDB as its primary data store. The application experiences occasional throttling errors during traffic spikes. The DevOps team needs to implement a solution that ensures consistent performance without manual intervention. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache read requests.. To handle occasional throttling during traffic spikes without manual intervention, the team should use DynamoDB Accelerator (DAX) to cache read requests, reducing read load on the table, and enable DynamoDB Auto Scaling to automatically adjust read and write capacity based on traffic patterns. DAX absorbs spikey read traffic, while Auto Scaling ensures sufficient capacity for writes and uncached reads, together providing consistent performance without manual scaling. Option E (On-Demand) also handles spikes automatically but can be costlier for predictable workloads; the combination of DAX and Auto Scaling is often more cost-effective for read-heavy applications.

Answer

Use eventually consistent reads for all queries.

Answer

Move the data to Amazon RDS with read replicas.

Answer

Switch DynamoDB to On-Demand capacity mode.

Question 12

A company's DevOps team uses AWS CodePipeline to automate deployments. A recent pipeline execution failed at the 'Deploy' stage. The engineer needs to view the detailed logs for the failed action. Which AWS service or feature should the engineer use?

Accepted Answer

CloudWatch Logs. AWS CodePipeline integrates with Amazon CloudWatch Logs to capture and store detailed execution logs for each pipeline action, including the 'Deploy' stage. When a deployment action fails, the engineer can view the associated logs directly from the CodePipeline console or via the CloudWatch Logs console, which provides granular error messages, timestamps, and stack traces necessary for troubleshooting. This is the designated service for accessing action-level logs in CodePipeline.

Answer

S3 access logs

Answer

CodeBuild logs

Answer

CloudTrail

Question 13

A company uses Terraform to manage AWS infrastructure. They have a state file stored in an S3 bucket with DynamoDB locking. After a failed 'terraform apply', the state file is locked. The DevOps engineer tries to run 'terraform plan' but gets an error: 'Error acquiring the state lock'. What should the engineer do to resolve this issue?

Accepted Answer

Run 'terraform force-unlock' with the lock ID. Terraform uses DynamoDB to implement state locking, and after a failed apply, the lock entry remains in the table. The `terraform force-unlock` command with the specific lock ID (obtained from the error message or via `terraform lock` commands) is the designed mechanism to manually release a stuck lock without corrupting the state file. This approach preserves the existing state and avoids data loss.

Answer

Manually delete the lock item from the DynamoDB table

Answer

Wait for the lock to expire automatically

Answer

Delete the state file from S3 and re-run terraform init

Question 14

Refer to the exhibit. The above buildspec.yml is used in AWS CodeBuild. The build is failing during the 'build' phase with a 'FileNotFoundError: setup.py' error. What is the MOST likely cause?

Accepted Answer

The source code does not contain a setup.py file in the root directory.. The error 'FileNotFoundError: setup.py' indicates that the build process is attempting to run a command (likely `python setup.py install` or `pip install -e .`) that requires a `setup.py` file in the root directory of the source code. Since the buildspec.yml does not explicitly override the default build commands, CodeBuild uses the default build command for Python, which expects `setup.py` to be present. Option A is correct because the most likely cause is that the source code repository lacks a `setup.py` file in its root directory, causing the build phase to fail.

Answer

The unit tests in the post_build phase are failing.

Answer

The Python version 3.8 is not supported by CodeBuild.

Answer

The artifacts configuration discarding paths is causing the error.

Question 15

A company runs a microservices architecture on Amazon ECS with Fargate. Services communicate via an internal Application Load Balancer (ALB). The operations team notices that occasional traffic spikes cause increased latency and timeouts. The team wants to improve resilience without over-provisioning. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Enable ECS Service Connect for inter-service communication to manage traffic distribution.. B is correct because ECS Service Connect provides built-in traffic management for inter-service communication, including load balancing, retries, and circuit breaking. This helps distribute traffic more evenly during spikes, reducing latency and timeouts without requiring over-provisioning.

Answer

Increase the CPU and memory limits in the task definitions.

Answer

Use EC2 launch type with Spot Instances to reduce cost.