DOP-C02 Practice Test 42 — 15 Questions

Question 1

A company uses AWS CloudFormation to create a stack with a Lambda function that uses a VPC. The stack creation fails with 'CREATE_FAILED: The provided execution role does not have permissions to call ec2:CreateNetworkInterface on the resource'. What is the likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Lambda execution role is missing the ec2:CreateNetworkInterface permission.. When a Lambda function is configured to run inside a VPC, it requires the `ec2:CreateNetworkInterface` permission to create an Elastic Network Interface (ENI) in the VPC subnets. The error message explicitly states that the execution role lacks this permission, which is a required IAM action for VPC-enabled Lambda functions. Without this permission, CloudFormation cannot provision the ENI, causing the stack creation to fail.

Answer

The VPC does not have a subnet with internet access.

Answer

The CloudFormation template does not specify a security group.

Answer

The Lambda function code has a syntax error.

Question 2

A company wants to ensure its RDS Multi-AZ deployment automatically fails over to a standby instance in a different Availability Zone. Which additional step is required?

Accepted Answer

No additional step; RDS Multi-AZ handles automatic failover.. Amazon RDS Multi-AZ automatically handles failover to the standby instance in a different Availability Zone without any additional configuration. When the primary DB instance becomes unavailable, RDS automatically detects the failure and flips the DNS record to point to the standby instance, typically within 60–120 seconds. No manual intervention or extra services like Route 53 health checks are required for this built-in failover mechanism.

Answer

Create an Amazon Route 53 health check to update the DNS record.

Answer

Configure a read replica in another AZ.

Answer

Deploy the standby instance in a different VPC.

Question 3

A company uses AWS Lambda functions to process incoming events. The DevOps team notices that some functions are timing out after 30 seconds, but the configured timeout is 1 minute. They want to capture the actual invocation duration for all invocations to analyze performance. What is the most efficient way to achieve this?

Accepted Answer

Enable detailed CloudWatch Logs for the Lambda functions and parse the 'REPORT' log entries to extract the 'Duration' value.. Lambda automatically writes a REPORT log entry to CloudWatch Logs at the end of each invocation, which includes the exact 'Duration' in milliseconds. Parsing these logs is the most efficient approach since it requires no code changes, no additional infrastructure, and leverages existing logging with no extra cost beyond standard CloudWatch Logs ingestion.

Answer

Add custom metrics using the AWS SDK within the Lambda function code to record the duration.

Answer

Configure Amazon Kinesis Data Streams to receive Lambda invocation records and compute duration using a consumer application.

Answer

Use AWS CloudTrail to capture Lambda execution events and analyze the 'duration' field.

Question 4

Which TWO AWS services can be used to monitor and detect unauthorized access to AWS resources? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing VPC Flow Logs, DNS logs, and AWS CloudTrail management and data events. It uses machine learning and integrated threat intelligence to detect anomalies such as unusual API calls, crypto-mining activity, or compromised credentials, making it a correct choice for detecting unauthorized access.

Answer

AWS Shield

Answer

Amazon Inspector

Answer

AWS Config

Question 5

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to know who attempted to decrypt data using a specific KMS key and whether the attempt succeeded. Which AWS service should the team use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey, as events in the CloudTrail logs. By examining CloudTrail events for the specific KMS key ID, the security team can see who called the Decrypt API and whether the call succeeded (HTTP 200) or failed (e.g., AccessDenied). This provides the exact audit trail needed for incident response.

Answer

AWS Config

Answer

KMS key policies

Answer

CloudWatch Logs

Question 6

A company uses AWS CloudFormation to manage infrastructure. The DevOps team wants to deploy a stack across multiple accounts using AWS CodePipeline. Which approach is BEST for automating cross-account deployments?

Accepted Answer

Use a single pipeline in the management account with IAM roles that assume cross-account roles.. AWS CodePipeline can assume an IAM role in the target account (via a cross-account role) to perform CloudFormation deployments. This allows a single pipeline in the management account to automate deployments across multiple accounts without manual triggers or separate pipelines, adhering to the principle of least privilege and centralized control.

Answer

Use AWS CloudFormation StackSets to deploy the stack across accounts.

Answer

Create a separate pipeline in each account and trigger them manually.

Answer

Use an S3 bucket with cross-account access and Lambda to invoke CloudFormation.

Question 7

A financial services company uses Chef for configuration management. They need to enforce security compliance across thousands of EC2 instances. The compliance requirements include specific file permissions, firewall rules, and user account settings. They want to automatically remediate non-compliant instances. Which approach is MOST effective?

Accepted Answer

Use Chef recipes to define desired state and enforce compliance on each client run.. Chef is already in use for configuration management, and its core strength is enforcing desired state through recipes. By running Chef client on each EC2 instance (via cron or Systems Manager), non-compliant instances are automatically remediated on each convergence cycle without needing separate detection or notification tools. This approach directly addresses the requirement for automated remediation using the existing toolchain.

Answer

Use AWS Config rules to detect non-compliance and send notifications.

Answer

Use AWS CloudWatch Events to trigger a Lambda function that runs remediation scripts.

Answer

Use AWS Systems Manager Patch Manager to apply patches.

Question 8

Refer to the exhibit. A developer runs the AWS CLI command to start a build in AWS CodeBuild. The build project 'my-project' uses an S3 bucket as the source. What is the MOST likely cause of the error?

Accepted Answer

The CodeBuild service role does not have s3:GetObject permission on the source bucket.. The error occurs because CodeBuild needs to download the source code from the S3 bucket during the build. The CodeBuild service role, not the developer's IAM user, makes the s3:GetObject API call to retrieve the source object. Without this permission on the service role, the build fails with an access denied error.

Answer

The S3 bucket name is misspelled in the build project configuration.

Answer

The developer's IAM user does not have s3:GetObject permission.

Answer

The S3 bucket is in a different region than the CodeBuild project.

Question 9

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an S3 bucket. The Security team requires that the application never uses long-term credentials and that access is scoped to the specific ECS task. Which approach should be used?

Accepted Answer

Create an IAM role for the ECS task and reference it in the task definition. ECS tasks using the Fargate launch type can assume an IAM role that is specified in the task definition. This IAM role provides temporary credentials via the ECS task metadata endpoint, ensuring that the application never uses long-term credentials and that permissions are scoped precisely to that task. The Security team's requirements are fully met by this approach.

Answer

Embed the IAM user credentials in the container image

Answer

Store AWS access keys in AWS Secrets Manager and retrieve them at runtime

Answer

Use an IAM role for the EC2 instance if using EC2 launch type

Question 10

A DevOps engineer is managing infrastructure as code using AWS CloudFormation. The engineer wants to automatically update a stack when changes are pushed to a Git repository. Which THREE services can be used together to achieve this?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the core service that manages the infrastructure as code stack. When combined with AWS CodeCommit as the Git repository and AWS CodePipeline as the CI/CD orchestrator, changes pushed to the repository trigger a pipeline that automatically updates the CloudFormation stack. CodePipeline can directly invoke CloudFormation actions (create, update, delete stacks) using its built-in deployment provider, eliminating the need for intermediate compute services.

Answer

Amazon CloudWatch Events

Answer

AWS CodeBuild

Question 11

A company runs a containerized application on Amazon ECS Fargate. The DevOps team wants to collect custom application metrics (e.g., request count, error rate) and send them to Amazon CloudWatch. The team wants to minimize changes to the application code. Which solution should be used?

Accepted Answer

Run the CloudWatch agent as a sidecar container in the ECS task definition, configured to collect StatsD metrics from the application container.. The CloudWatch agent can run as a sidecar container in the same ECS task definition and listen for StatsD metrics (over UDP port 8125) from the application container. This approach requires zero changes to the application code—the application simply emits StatsD-formatted metrics, and the CloudWatch agent forwards them to CloudWatch via the PutMetricData API. It minimizes operational overhead while enabling custom metric collection from containerized workloads on Fargate.

Answer

Have the application call the CloudWatch PutMetricData API directly.

Answer

Use the ECS agent's built-in metric collection feature.

Answer

Modify the application to send logs using the embedded metric format.

Question 12

A company is using AWS CloudTrail to log API activity in their AWS account. They want to ensure that any modification to CloudTrail configuration itself is logged and that the logs are immutable. Which combination of actions should they take? (Choose TWO.)

Accepted Answer

Enable S3 Object Lock on the destination S3 bucket in governance mode.. Enabling S3 Object Lock in governance mode on the destination S3 bucket prevents any user, including the root user, from overwriting or deleting CloudTrail log objects during the retention period, ensuring immutability. Option B is correct because enabling log file validation creates a digest file that uses SHA-256 hashing to verify that log files have not been modified, deleted, or tampered with after delivery, providing integrity assurance.

Answer

Disable log file validation to reduce overhead.

Answer

Store CloudTrail logs in a CloudWatch Logs log group with a retention policy.

Answer

Enable CloudTrail Insights to detect configuration changes.

Question 13

A DevOps team uses AWS CodePipeline to deploy a web application. They notice that the deployment stage fails intermittently due to a missing configuration file. Which troubleshooting step should they take first?

Accepted Answer

Review the build logs in AWS CodeBuild to identify the error.. The deployment stage fails intermittently due to a missing configuration file. The first troubleshooting step should be to review the build logs in AWS CodeBuild, because CodeBuild generates detailed logs that capture the exact error message, including file paths and missing configuration details. This allows the team to pinpoint the root cause without making unnecessary changes to the pipeline or deployment group settings.

Answer

Switch to AWS CodeBuild for the deployment stage.

Answer

Recreate the pipeline with the same configuration to see if the issue repeats.

Answer

Verify the deployment group settings in AWS CodeDeploy.

Question 14

A company uses AWS CodeBuild to build and test a Node.js application. The buildspec.yml currently runs npm install and npm test. They want to also run a security scan using a third-party tool. Which THREE steps are required to integrate the security scan into the CodeBuild build?

Accepted Answer

Ensure the build fails if the scanner finds vulnerabilities by checking the exit code.. CodeBuild phases (install, pre_build, build, post_build) run shell commands sequentially, and a non-zero exit code from any command causes the build to fail. By checking the exit code of the security scanner (e.g., via `$?` or relying on the tool's default exit behavior), the build will stop and report failure if vulnerabilities are found, enforcing a security gate. This is the standard mechanism to integrate third-party tools without custom scripting.

Answer

Create a new 'security' phase in the buildspec.yml.

Answer

Upload the security scanner configuration to an S3 bucket and reference it in the buildspec.

Question 15

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team needs to monitor application performance and troubleshoot slow API responses. They currently use Amazon CloudWatch Logs for container logs and have enabled Container Insights. However, they are unable to see detailed latency breakdowns per API endpoint. Which solution would provide the most granular visibility into API performance?

Accepted Answer

Use AWS X-Ray to instrument the application and collect trace data.. AWS X-Ray provides end-to-end tracing of requests as they travel through microservices, capturing detailed latency breakdowns per API endpoint, including downstream calls, database queries, and external HTTP requests. This gives the operations team the granular visibility needed to pinpoint exactly where slow responses occur, unlike aggregated metrics or log-based queries.

Answer

Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.

Answer

Enable CloudWatch Logs Insights to query API logs for slow requests.

Answer

Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.

Answer

Set up VPC Flow Logs to analyze network latency between services.