DOP-C02 Practice Test 50 — 15 Questions

Question 1

A company runs a critical web application on EC2 instances behind an Application Load Balancer. To improve resilience, they want to automatically replace failed instances. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto Scaling group with health checks. Auto Scaling groups with health checks automatically replace unhealthy instances based on ELB health check integration. Option D is correct. Option A (EC2 Instance Recovery) recovers instances on the same host but does not replace them if the host fails. Option B (Systems Manager Automation) requires manual or scheduled automation, not automatic health-based replacement. Option C (CloudFormation Stack update) does not provide auto-replacement; it manages infrastructure updates.

Answer

EC2 Instance Recovery

Answer

AWS Systems Manager Automation

Answer

CloudFormation Stack update

Question 2

A company uses an NLB to distribute traffic to a fleet of EC2 instances in a single Availability Zone. During a recent AWS outage in that zone, the application became completely unavailable. The company wants to achieve high availability without rearchitecting the application. Which change is MOST appropriate?

Accepted Answer

Launch EC2 instances in a second Availability Zone and register them with the NLB target group. Registering EC2 instances in a second Availability Zone with the NLB target group allows NLB to route traffic to healthy instances across zones, providing high availability during a zone outage. Option A is incorrect because using a larger instance type and enabling detailed CloudWatch monitoring does not add redundancy across zones. Option B is incorrect because replacing NLB with an ALB still requires multi-AZ configuration to achieve high availability; cross-zone load balancing is already available on NLB. Option C is incorrect because scheduled scaling does not protect against zone failures; it only adjusts capacity predictably.

Answer

Use a larger instance type and enable detailed CloudWatch monitoring

Answer

Replace the NLB with an Application Load Balancer and enable cross-zone load balancing

Answer

Create an Auto Scaling group with a scheduled scaling policy to add instances during peak hours

Question 3

A company uses Ansible for configuration management on EC2 instances. They want to ensure that only instances with a specific tag (Environment: Production) are targeted by their playbooks. What is the best way to achieve this?

Accepted Answer

Use the AWS EC2 dynamic inventory plugin to filter instances based on tags.. The best approach because the AWS EC2 dynamic inventory plugin allows filtering instances by tags (e.g., 'Environment: Production') at runtime, ensuring only tagged instances are targeted. Option A (adding a 'when' condition) is less efficient as it connects to all instances first. Option B (static inventory) requires manual updates and is not dynamic. Option D (ec2_tag module) is for assigning tags, not selecting instances.

Answer

Add a 'when' condition in the playbook to check the instance tag at runtime.

Answer

Maintain a static inventory file listing only Production instances.

Answer

Use the ec2_tag module to assign the tag to instances.

Question 4

A company uses Amazon CloudWatch to monitor its production environment. The DevOps team wants to receive an email notification whenever the average CPU utilization of any EC2 instance exceeds 90% for 5 consecutive minutes. Which steps should be taken to set up this notification?

Accepted Answer

Create a CloudWatch alarm on CPUUtilization with a threshold of 90% for 5 consecutive periods, and configure an SNS topic to send email. Create a CloudWatch alarm on the CPUUtilization metric with a threshold of 90% for 5 consecutive periods (5 minutes assuming 1-minute periods), and configure an SNS topic to send email notifications. Option A is incorrect because the CloudWatch Logs agent collects log data, not metrics, and metric filters are for log analysis, not setting alarms on CPU utilization. Option C is incorrect because AWS CloudTrail logs API calls, not CPU utilization metrics. Option D is incorrect because AWS Config is for resource configuration auditing and compliance, not for monitoring CPU utilization metrics.

Answer

Install the CloudWatch Logs agent on each EC2 instance and configure a metric filter to trigger an SNS notification

Answer

Use AWS CloudTrail to monitor CPU utilization and send notifications via SNS

Answer

Use AWS Config to create a rule that triggers an SNS notification when CPU utilization exceeds 90%

Question 5

A company runs a microservices application on Amazon EKS. The DevOps team wants to collect and visualize metrics such as pod CPU and memory usage, and set up alerts. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Container Insights and CloudWatch Alarms. Amazon CloudWatch Container Insights and CloudWatch Alarms. Container Insights collects, aggregates, and summarizes metrics and logs from containerized applications and microservices running on Amazon EKS. It provides pre-built dashboards for pod CPU, memory, network, and disk metrics. CloudWatch Alarms can be set on these metrics to trigger notifications or automated actions. Option A (Prometheus and Grafana on EC2) is possible but not an AWS service combination; it requires manual setup and maintenance. Option B (AWS X-Ray and Amazon CloudWatch ServiceLens) is for distributed tracing and service maps, not for collecting CPU/memory metrics. Option C (AWS CloudTrail and Amazon CloudWatch Logs) is for auditing API calls and storing log data, not for metrics visualization and alerting.

Answer

Prometheus and Grafana on EC2

Answer

AWS X-Ray and Amazon CloudWatch ServiceLens

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 6

A DevOps engineer needs to monitor the number of messages in an Amazon SQS queue and trigger an Auto Scaling policy to add more EC2 instances when the queue depth exceeds a threshold. Which CloudWatch metric should the alarm use?

Accepted Answer

ApproximateNumberOfMessagesVisible. (ApproximateNumberOfMessagesVisible) is the correct metric because it represents the number of messages available to be retrieved from the queue. When this number exceeds a threshold, it indicates that consumer EC2 instances are not keeping up, so an Auto Scaling policy can add more instances to handle the load. Option A (NumberOfMessagesSent) is a count of messages sent, not the current queue depth. Option B (ApproximateNumberOfMessagesNotVisible) represents messages that are in flight (being processed) and not available for retrieval. Option D (SentMessageSize) is the size of messages sent, not the count. Therefore, C is correct.

Answer

NumberOfMessagesSent

Answer

ApproximateNumberOfMessagesNotVisible

Answer

SentMessageSize

Question 7

A company has a critical application running on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing intermittent latency spikes. The DevOps team has enabled detailed monitoring on the EC2 instances and is using CloudWatch metrics. They notice that CPU utilization and network traffic are normal during the spikes. Which additional diagnostic step should the team take to identify the root cause?

Accepted Answer

Instrument the application with AWS X-Ray to trace requests and identify bottlenecks.. AWS X-Ray provides end-to-end tracing of requests as they travel through the application. Since CPU and network metrics appear normal, the intermittent latency is likely caused by application-level bottlenecks such as slow database queries, external API calls, or inefficient code paths. X-Ray can trace each request end-to-end and identify the specific service or component introducing delay. Container Insights (B) is designed for monitoring containerized workloads (Amazon ECS/EKS), not EC2 instances directly. CloudWatch Synthetics (C) creates canaries that monitor external endpoint availability and response times, but it does not trace internal request paths. AWS Trusted Advisor (D) offers general best-practice recommendations but is not a diagnostic tool for real-time latency issues.

Answer

Use CloudWatch Container Insights to monitor the performance of the EC2 instances.

Answer

Enable CloudWatch Synthetics to create canaries that monitor the application endpoints.

Answer

Run an AWS Trusted Advisor check to identify performance-related recommendations.

Question 8

Refer to the exhibit. A DevOps engineer runs the AWS CLI command to get the average TargetResponseTime for an ALB over a 1-hour period. The output shows only three datapoints. What is the most likely reason?

Accepted Answer

The ALB did not receive any requests during most of the 5-minute periods.. The command uses a period of 300 seconds (5 minutes), so over a 1-hour period we expect 12 data points if the metric is consistently reported. However, TargetResponseTime is only emitted when the ALB receives at least one request in that interval. The output shows only three data points, indicating that for the majority of the 5-minute periods, the ALB received no requests, so no metric data was published. Option A correctly identifies this. Option B is incorrect because TargetResponseTime is a valid metric for Application Load Balancers. Option C is incorrect because the command appears to include the necessary parameters to retrieve the average. Option D is incorrect because a 300-second period is standard; using a smaller period would not produce more data points if there are no requests.

Answer

The metric TargetResponseTime is not available for Application Load Balancers.

Answer

The command is missing the 'Statistics' parameter with 'Average'.

Answer

The period of 300 seconds is too large; a smaller period should be used.

Question 9

A company is using Amazon CloudWatch to monitor a production environment. The DevOps team wants to receive notifications when the CPU utilization of an EC2 instance exceeds 90% for 5 consecutive minutes. Which TWO steps should the team take to achieve this? (Choose TWO.)

Accepted Answer

Configure an Amazon SNS topic and subscribe the team's email address to it, then set the alarm to send notifications to the SNS topic.. Option B is correct because CloudWatch alarms cannot send email directly; they must publish to an Amazon SNS topic, and the team's email address must be subscribed to that topic so the notification is delivered. Option C is correct because the alarm must be defined on the EC2 CPUUtilization metric with a threshold of 90% and an evaluation period of 5 consecutive 1-minute datapoints (5 minutes) to match the requirement. Option A is not required because basic monitoring already provides CPUUtilization at 5-minute intervals, which is sufficient for a 5-minute evaluation period; detailed monitoring only changes the granularity to 1 minute. Option D is incorrect because CloudWatch Logs metric filters operate on log events, not on the CPUUtilization metric. Option E is incorrect because a dashboard only visualizes metrics and does not generate notifications.

Answer

Enable detailed monitoring on the EC2 instance to get 1-minute metrics.

Answer

Create a CloudWatch Logs metric filter to count CPU utilization errors.

Answer

Create a CloudWatch dashboard to visualize CPU utilization.

Question 10

A company wants to design a highly available and fault-tolerant architecture for a stateless web application on AWS. Which TWO actions should they take? (Choose two.)

Accepted Answer

Launch EC2 instances in at least two Availability Zones. To achieve high availability and fault tolerance for a stateless web application, you should deploy EC2 instances in at least two Availability Zones (C) to eliminate a single point of failure, and use an Auto Scaling group (E) to automatically replace failed instances and maintain desired capacity. Option A is incorrect because a single large instance is a single point of failure and does not provide fault tolerance. Option B is incorrect because multiple Application Load Balancers per AZ are unnecessary; a single ALB can route traffic across multiple AZs. Option D is incorrect because RDS Multi-AZ is a database feature, not for the web server fleet.

Answer

Use a single large EC2 instance to simplify management

Answer

Deploy multiple Application Load Balancers in each AZ

Answer

Use an RDS Multi-AZ deployment for the web server fleet

Question 11

Refer to the exhibit. A DevOps engineer runs the describe-target-health command and receives the output shown. The ALB target group has two instances. One instance is healthy, and the other is unhealthy with a 502 error. What is the most likely cause of the 502 error?

Accepted Answer

The application running on the instance is not responding correctly or has crashed.. A 502 Bad Gateway error from an ALB indicates that the target (EC2 instance) is not responding correctly or has closed the connection prematurely. This is commonly caused by the application or web server on the instance crashing or being unable to handle the request. Option A is incorrect because security group issues typically lead to connection timeouts (504) or refused connections, not 502. Option C is incorrect because a missing route to the internet gateway would cause network unreachability, resulting in a different error. Option D is incorrect because the health check path returning a 404 would cause the target to fail health checks, not return a 502 during actual traffic.

Answer

The security group for the instance does not allow inbound traffic on port 80 from the ALB.

Answer

The instance's route table does not have a route to the internet gateway.

Answer

The health check path is configured to return a 404 status code.

Question 12

A company runs a microservices architecture on Amazon ECS with Fargate. Services communicate via an internal Application Load Balancer. Recently, one service became unavailable due to a memory leak, causing cascading failures in downstream services. What design change would MOST effectively improve resilience and limit the blast radius?

Accepted Answer

Implement circuit breaker patterns in the service discovery and client libraries to stop calling unhealthy services.. Implementing a circuit breaker pattern in service discovery and client libraries stops requests to unhealthy services, preventing cascading failures and limiting blast radius. Option A is wrong because increasing memory limits only delays the inevitable failure and does not prevent downstream services from being affected. Option C (connection draining) only affects in-flight requests during deregistration, not active health issues. Option D (auto scaling) helps but does not stop requests from being sent to a failing service; scaling cannot fix a memory leak.

Answer

Increase the memory limit for each ECS task to accommodate memory leaks.

Answer

Enable connection draining on the ALB to allow in-flight requests to complete.

Answer

Implement automatic scaling policies for ECS services based on memory utilization.

Question 13

A DevOps engineer needs to monitor the number of 4xx and 5xx HTTP errors returned by an Application Load Balancer (ALB). They want to set up a dashboard that shows the error count over the last 24 hours. Which CloudWatch metrics should they use?

Accepted Answer

Use the 'HTTPCode_Target_4XX_Count' and 'HTTPCode_Target_5XX_Count' metrics.. The correct metrics are 'HTTPCode_Target_4XX_Count' and 'HTTPCode_Target_5XX_Count', which track HTTP errors returned by the targets behind the Application Load Balancer. Option B is incorrect because 'RequestCount' does not have an 'ErrorCount' statistic. Option C is incorrect because 'HTTPCode_ELB_4XX_Count' and 'HTTPCode_ELB_5XX_Count' are load balancer-level metrics that track errors generated by the ALB itself (e.g., due to misconfiguration), not the errors returned by targets. Option D is incorrect because 'TargetResponseTime' measures latency, not error counts.

Answer

Use the 'RequestCount' metric with a statistic of 'ErrorCount'.

Answer

Use the 'HTTPCode_ELB_4XX_Count' and 'HTTPCode_ELB_5XX_Count' metrics.

Answer

Use the 'TargetResponseTime' metric and count the number of responses above 4 seconds.

Question 14

Which TWO actions should a DevOps engineer take to implement a CI/CD pipeline that automatically deploys a containerized application to Amazon ECS using AWS CodePipeline and AWS CodeBuild? (Choose TWO.)

Accepted Answer

Use CodeBuild to build the Docker image and push it to Amazon ECR. AWS CodeBuild can be configured to build the Docker image from source code and then push it to Amazon ECR using the `post_build` phase with commands like `docker push`. This is a standard pattern for containerized CI/CD pipelines, as ECR serves as the private registry for storing and versioning container images. Option E is correct because CodePipeline can use Amazon ECR as a source action, which triggers the pipeline automatically when a new image is pushed to the specified repository, enabling continuous deployment to ECS.

Answer

Use AWS CloudFormation to deploy the ECS service

Answer

Use AWS CodeDeploy to deploy the container to ECS with a blue/green deployment

Answer

Store the Docker image in AWS CodeCommit

Question 15

A company is using AWS CloudFormation to manage infrastructure. The DevOps team wants to receive notifications when CloudFormation stack creation fails. Which AWS service should be used to capture the stack failure event and send a notification?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture CloudFormation stack events (such as CREATE_FAILED) using event rules and route them to targets like Amazon SNS for notifications. Option A is wrong because Amazon SQS is a message queue service and does not directly send notifications; it requires a consumer. Option B is wrong because Amazon CloudWatch Logs stores log data but does not capture CloudFormation events or send notifications. Option C is wrong because AWS CloudTrail records API calls but is not designed for real-time event-driven notifications; it is better suited for auditing.

Answer

Amazon SQS

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail