DOP-C02 Practice Test 46 — 15 Questions

Question 1

A company runs a microservices application on Amazon ECS with Fargate launch type. The application experiences intermittent failures when calling an external API. The errors are transient and usually resolve within a few seconds. How should the company improve resilience?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement retry logic with exponential backoff in the application code.. Transient errors from an external API are best handled with retry logic using exponential backoff and jitter. This allows the application to recover from temporary failures without overwhelming the downstream API, improving resilience without architectural changes.

Answer

Increase the timeout of the external API call to 60 seconds.

Answer

Increase the number of tasks in the ECS service to handle failures.

Answer

Use an Amazon SQS queue to decouple the API call from the application.

Question 2

A company is adopting Infrastructure as Code (IaC) using AWS CloudFormation. They want to ensure that stack updates are safe and minimize the risk of resource replacement. Which TWO of the following strategies should they use?

Accepted Answer

Always create a change set before executing a stack update.. Creating a change set before executing a stack update allows you to review the proposed changes, including whether any resources will be replaced or interrupted. This provides a safety net by letting you validate the impact of the update before committing, reducing the risk of unintended resource replacement.

Answer

Perform updates directly from the AWS Management Console to see immediate results.

Answer

Delete the stack and create a new one with the updated template.

Answer

Use the --disable-rollback flag to avoid unnecessary rollbacks.

Question 3

A company uses AWS CodePipeline to deploy a static website to Amazon S3 and CloudFront. The pipeline currently uses CodeBuild to run tests and then deploys to an S3 bucket. The team wants to add a stage that invalidates the CloudFront cache after deployment. Which TWO actions achieve this?

Accepted Answer

Use the AWS CLI command 'aws cloudfront create-invalidation' in a CodeBuild build step.. You can use the AWS CLI command 'aws cloudfront create-invalidation' in a CodeBuild build step to programmatically invalidate the CloudFront cache after deployment. This approach integrates seamlessly into the existing pipeline by adding a build action that runs the CLI command, ensuring the cache is cleared for updated objects in the S3 bucket.

Answer

Configure CodePipeline to directly invalidate CloudFront using a built-in action.

Answer

Create a CodePipeline stage with a deploy action to CloudFront.

Answer

Use CloudFront to automatically invalidate based on S3 events.

Question 4

A company uses AWS CodePipeline with an Amazon S3 source action. The pipeline deploys to an Amazon ECS Fargate service. The engineer notices that the pipeline does not automatically start when a new object is uploaded to the S3 bucket. The S3 bucket versioning is enabled. What is the most likely cause?

Accepted Answer

The S3 bucket does not have event notifications configured for the pipeline. AWS CodePipeline with an S3 source action does not automatically detect new object uploads unless the S3 bucket is configured with event notifications that trigger the pipeline. Without these notifications, the pipeline must be started manually or via a webhook. Since versioning is enabled, the issue is not related to versioning but to the missing event notification configuration.

Answer

The pipeline has manual approval required before the source stage

Answer

S3 versioning is not enabled on the bucket

Answer

The ECS service is not configured for blue/green deployments

Question 5

A company uses AWS CloudFormation to manage infrastructure. They need to implement a CI/CD pipeline that automatically updates CloudFormation stacks when changes are pushed to a CodeCommit repository. The pipeline must use change sets to review changes before execution. Which pipeline configuration meets these requirements?

Accepted Answer

Use a CloudFormation action with action mode 'CHANGE_SET_REPLACEMENT' and then a separate action with mode 'CHANGE_SET_EXECUTE' after an approval step.. CodePipeline's CloudFormation deployment action supports a 'CHANGE_SET_REPLACEMENT' mode that creates or replaces a change set without executing it, followed by a 'CHANGE_SET_EXECUTE' action that applies the change set after an approval step. This two-step approach allows teams to review infrastructure changes before they are applied, meeting the requirement to use change sets for review before execution.

Answer

Use a CloudFormation action in CodePipeline with action mode 'CREATE_UPDATE' and include a manual approval step before the action.

Answer

Use an AWS Lambda function to create a change set and trigger a manual approval via SNS.

Answer

Use a CloudFormation action with action mode 'CREATE_UPDATE' and set the 'Review' flag to true.

Question 6

Which TWO are valid deployment configurations in AWS CodeDeploy? (Choose two.)

Accepted Answer

AllAtOnce. In AWS CodeDeploy, the valid deployment configurations are predefined traffic-shifting strategies. 'AllAtOnce' is a valid configuration that deploys the new application revision to all instances simultaneously, making it one of the two correct options. 'Canary10Percent5Minutes' is also a valid configuration that shifts 10% of traffic to the new version for 5 minutes before deploying the remainder, making it the second correct option.

Answer

Rolling

Answer

Linear

Answer

BlueGreen

Question 7

Which TWO options are valid approaches for managing configuration drift in an AWS environment? (Choose two.)

Accepted Answer

Use AWS Config rules to evaluate resource configurations against desired policies.. AWS Config rules continuously evaluate your resource configurations against desired policies defined in managed or custom rules. When a resource configuration changes and violates a rule, AWS Config can trigger remediation actions or notify you, directly addressing configuration drift by detecting non-compliant resources in near real-time.

Answer

Use AWS CodePipeline to automatically redeploy infrastructure when changes are detected.

Answer

Use AWS Systems Manager Patch Manager to keep instances patched.

Answer

Use AWS CloudTrail to monitor API calls that modify resources.

Question 8

Which TWO AWS services can be used to automate the configuration of EC2 instances at launch? (Choose two.)

Accepted Answer

EC2 user data. EC2 user data allows you to specify scripts or cloud-init directives that run automatically during the first boot cycle of an EC2 instance. This enables automated software installation, configuration, and post-launch tasks without manual intervention, making it a core tool for instance configuration at launch.

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Answer

AWS Config

Question 9

A company uses AWS CloudTrail to log API activity in their AWS account. They need to ensure that any changes to CloudTrail configuration itself are detected and alerted upon in real time. Which service should they use?

Accepted Answer

Use Amazon CloudWatch Events (EventBridge) to create a rule matching the StopLogging or UpdateTrail API calls.. Amazon CloudWatch Events (EventBridge) can monitor CloudTrail API calls in real time by creating a rule that matches specific API calls such as StopLogging or UpdateTrail. When these calls are made, the rule triggers an action (e.g., SNS notification or Lambda function) to alert administrators immediately. This provides the real-time detection required for changes to CloudTrail configuration itself.

Answer

Enable AWS Config rules to monitor CloudTrail configuration changes.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs for changes.

Answer

Enable Amazon GuardDuty to detect changes to CloudTrail.

Question 10

A DevOps engineer is troubleshooting a failed CodePipeline execution. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. The build stage succeeds, but the deploy stage fails with 'No deployments found for the specified deployment group.' Which TWO actions should the engineer take to resolve this?

Accepted Answer

Confirm that the CodeDeploy deployment group exists in the same AWS Region as the pipeline.. CodePipeline and CodeDeploy must operate in the same AWS Region. If the deployment group is in a different Region, CodePipeline cannot find it, resulting in the 'No deployments found' error. This is a common cross-Region misconfiguration that prevents the deploy stage from locating the specified deployment group.

Answer

Update the IAM role for CodePipeline to allow it to list deployment groups.

Answer

Check the CodeBuild build logs for errors.

Answer

Ensure the CodeCommit repository has a valid commit.

Question 11

A company uses AWS CloudTrail to monitor API activity. The DevOps team needs to ensure that any deletion of an S3 bucket is detected in real time and triggers an automated response. Which combination of AWS services should be used to meet these requirements?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a CloudWatch Events rule matching the DeleteBucket event, and target a Lambda function.. CloudTrail logs can be sent to CloudWatch Logs, and a CloudWatch Events rule (now Amazon EventBridge) can be created to match the DeleteBucket event and trigger a Lambda function for automated response in real time. Option A is incorrect because CloudWatch Logs monitors log data, but a metric filter on DeleteBucket events in CloudTrail logs can trigger an alarm, but that is not as direct as EventBridge. More importantly, CloudWatch Logs metric filters have latency and are not the best for real-time response. Option B is incorrect because S3 event notifications are for operations on objects, not for bucket-level operations like deletion. Option C is incorrect because while CloudTrail can deliver logs to S3, S3 event notifications are not triggered by CloudTrail log file delivery; they are for object-level events. Using EventBridge directly with CloudTrail is the correct real-time approach.

Answer

Use CloudWatch Logs to monitor the logs, and create a metric filter to trigger an alarm when the DeleteBucket event appears.

Answer

Configure S3 event notifications to send to an SQS queue, and poll the queue with a Lambda function.

Answer

Configure CloudTrail to deliver logs to an S3 bucket, and use S3 event notifications to invoke a Lambda function.

Question 12

A DevOps engineer wants to receive an alert when the total number of error logs in an application exceeds 100 within a 5-minute period. The application writes logs to CloudWatch Logs. How can this be achieved?

Accepted Answer

Create a metric filter on the log group for 'ERROR', then create a CloudWatch alarm on the resulting metric with a threshold of 100.. A metric filter on the CloudWatch Logs group can count occurrences of the pattern 'ERROR', creating a custom metric. A CloudWatch alarm on that metric with a threshold of 100 and a 5-minute period will trigger when the error count exceeds 100. Option A is incorrect because dashboards are for visualization, not automated alerts. Option B is incorrect because CloudWatch Logs Insights is for ad-hoc queries, not continuous real-time alerting. Option C is incorrect because subscription filters send logs to destinations like Lambda, but the Lambda would need custom logic to count and alert, which is not as direct as a metric filter. The metric filter with alarm is the simplest native solution.

Answer

Create a CloudWatch dashboard with a line chart for error count and manually monitor it.

Answer

Use CloudWatch Logs Insights to run a query every 5 minutes and trigger an alert based on the result.

Answer

Create a CloudWatch Logs subscription filter to send matching logs to a Lambda function, which counts errors and sends an alert.

Question 13

A company uses AWS Organizations with SCPs to enforce security policies. The security team needs to ensure that no IAM user or role can disable AWS CloudTrail or delete CloudTrail logs. Which TWO approaches should be combined to achieve this? (Choose TWO.)

Accepted Answer

Use a service control policy to deny s3:DeleteObject on the CloudTrail S3 bucket.. To prevent IAM users and roles from disabling CloudTrail or deleting logs, a combination of two preventive controls is needed. Option A applies a service control policy (SCP) that denies s3:DeleteObject on the CloudTrail S3 bucket, preventing log deletion at the organizational level. Option C applies an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail, preventing disabling of CloudTrail itself. Both SCPs cannot be overridden by account administrators. Option D (log file validation) is a detective control—it detects tampering or deletion after it occurs, but does not prevent the action. Options B (MFA Delete) and E (IAM policy) are weaker or can be overridden, making them less reliable for this requirement.

Answer

Enable MFA Delete on the CloudTrail S3 bucket.

Answer

Enable CloudTrail log file validation.

Answer

Attach an IAM policy to all users denying cloudtrail:StopLogging.

Question 14

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team has a template that creates an Amazon RDS DB instance and an EC2 instance that runs a web application. The EC2 instance needs to connect to the RDS instance using the database endpoint and password. The team currently passes the endpoint and password as CloudFormation parameters, which are then stored in the EC2 instance's user data. However, security audit has flagged this as a security risk because the password is visible in the user data. The team wants to securely pass the database credentials to the EC2 instance without exposing them in the template or user data. The EC2 instance has an IAM role that allows it to read from AWS Secrets Manager. Which solution should the team implement?

Accepted Answer

Store the password in AWS Secrets Manager, use a dynamic reference to pass it to the EC2 instance's IAM role, and have the application retrieve it from Secrets Manager at runtime.. By storing the password in AWS Secrets Manager and using a dynamic reference in CloudFormation, the password is never exposed in the template or user data. The EC2 instance retrieves the password from Secrets Manager at runtime using its IAM role. Option A is not the best because although Parameter Store can store SecureStrings, Secrets Manager is more secure and supports automatic rotation, and the instance already has permissions to read Secrets Manager. Option B is risky because encrypting user data still exposes the password in the user data itself and adds key management complexity. Option D is wrong because Fn::GetAtt cannot retrieve the RDS master password, and even if it could, the password would still be passed via user data, which is insecure.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString and have the EC2 instance retrieve it using the AWS CLI.

Answer

Encrypt the user data using AWS KMS and decrypt it on the EC2 instance at boot time.

Answer

Use CloudFormation's Fn::GetAtt to retrieve the password from the RDS instance and pass it to the EC2 instance via user data.

Question 15

A company is migrating to AWS and needs to comply with PCI DSS. They must encrypt all data at rest and in transit. Which THREE services or features should they use?

Accepted Answer

Elastic Load Balancing (ELB) with TLS termination.. Elastic Load Balancing (ELB) with TLS termination ensures encryption of data in transit between clients and the load balancer, which is a PCI DSS requirement for protecting cardholder data over public networks. By terminating TLS at the ELB, you can offload the cryptographic overhead while maintaining compliance with the encryption-in-transit mandate.

Answer

AWS CloudTrail to log all API calls.

Answer

AWS WAF to protect web applications.