DOP-C02 Practice Questions 1 — 50 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. They want to receive notifications when a stack operation fails, including the specific resource that caused the failure. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack and subscribe to receive stack events.. CloudFormation allows you to specify an SNS topic ARN as a notification option when creating or updating a stack. When a stack operation fails, CloudFormation publishes a notification to that SNS topic, and the notification includes the logical resource ID and the status reason for the failure. This provides real-time, event-driven notifications without requiring polling or additional services.

Answer

Create a CloudWatch alarm on the 'StackFailure' metric.

Answer

Create an AWS Lambda function that polls the CloudFormation DescribeStackEvents API every minute and sends an email on failure.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and configure an SNS notification on the trail.

Question 2

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing intermittent errors. The DevOps engineer needs to identify if the errors are caused by the application or the underlying infrastructure. Which solution provides the MOST detailed visibility into the application's behavior?

Accepted Answer

Instrument the application with AWS X-Ray SDK and analyze traces. AWS X-Ray provides end-to-end tracing of requests as they travel through the application, allowing the engineer to pinpoint where errors occur. Option A is wrong because CloudWatch metrics only show aggregate data, not per-request details. Option B is wrong because VPC Flow Logs capture network traffic metadata, not application-level errors. Option D is wrong because CloudTrail records API calls, not application errors.

Answer

Enable VPC Flow Logs and analyze traffic patterns

Answer

Enable AWS CloudTrail and monitor for API errors

Answer

Enable detailed CloudWatch metrics on the EC2 instances and ALB

Question 3

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

Accepted Answer

The Deny statement's Resource specifies only the objects, not the bucket itself. The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.

Answer

The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'

Answer

The bucket is not versioned, so the policy does not apply to object versions

Answer

The policy uses Deny, but an Allow policy from another statement overrides it

Question 4

A DevOps engineer is troubleshooting a performance issue with an Amazon RDS for MySQL database. The engineer suspects that slow queries are causing high CPU utilization. Which TWO actions can the engineer take to identify the slow queries?

Accepted Answer

Enable the slow query log and publish it to CloudWatch Logs.. Enable the slow query log and publish it to CloudWatch Logs (Option C) allows you to capture and analyze slow SQL queries. Performance Insights (Option D) provides a dashboard to visualize database load and identify the top SQL statements causing performance issues. Option A is incorrect because event subscriptions for low storage notify about storage events, not slow queries. Option B is incorrect because monitoring CPUUtilization only indicates high CPU usage but does not identify specific slow queries. Option E is incorrect because Enhanced Monitoring provides OS-level metrics like CPU and memory, not the actual SQL queries.

Answer

Create an RDS event subscription for 'low storage' events.

Answer

Monitor the 'CPUUtilization' metric in CloudWatch.

Answer

Enable Enhanced Monitoring to view process list and SQL queries.

Question 5

A team uses AWS CodePipeline with a multi-branch strategy. They want to run different build projects based on the branch name: 'main' triggers a production build, 'develop' triggers a staging build, and feature branches trigger a test build. Which CodePipeline feature should they use?

Accepted Answer

Configure the source action with a branch filter using a regular expression.. CodePipeline's source action supports branch filtering via regular expressions, allowing you to define which branch triggers which pipeline execution. By configuring a single pipeline with a branch filter regex (e.g., '^main$', '^develop$', '^feature/.*$'), you can route commits from different branches to different build projects without creating multiple pipelines or using external logic.

Answer

Use AWS Lambda to dynamically change the pipeline definition.

Answer

Create separate pipelines for each branch and use tags.

Answer

Use a manual approval action to select the branch.

Question 6

A company wants to set up centralized logging for its multi-account AWS environment. The logs include CloudTrail, VPC Flow Logs, and Amazon Route 53 resolver query logs. Which TWO services should they use to achieve this with minimal operational overhead? (Select TWO.)

Accepted Answer

Amazon CloudWatch Logs. (CloudWatch Logs) and Option B (S3) are correct. CloudWatch Logs can aggregate logs from multiple AWS accounts using subscription filters or cross-account log grouping. S3 can serve as a central archive for all log types, including CloudTrail, VPC Flow Logs, and Route 53 resolver query logs, with minimal operational overhead. Option C (Kinesis Data Streams) is unnecessary because it adds complexity as an intermediate stream for this use case. Option D (OpenSearch Service) would require additional setup and management for indexing and visualization, increasing overhead. Option E (CloudTrail) only captures API activity and cannot centralize VPC Flow Logs or Route 53 resolver query logs.

Answer

Amazon Kinesis Data Streams

Answer

Amazon OpenSearch Service

Answer

AWS CloudTrail

Question 7

A company's production environment consists of EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The instances run a web application that stores session data in an ElastiCache Redis cluster. The company has enabled detailed CloudWatch metrics and set up a dashboard. The operations team notices that the average CPU utilization across the Auto Scaling group spikes to 95% every 15 minutes, coinciding with a high number of Redis connections. What is the MOST likely cause?

Accepted Answer

The ALB has session stickiness enabled, causing traffic to be routed to the same instances.. ALB session stickiness (sticky sessions) causes the load balancer to route requests from the same client to the same EC2 instance. When a large number of clients connect simultaneously (e.g., due to a periodic batch job), they may all be routed to the same few instances, causing CPU spikes on those instances. The high number of Redis connections corresponds to the sessions being stored in Redis. This explains the 15-minute periodic spikes. Option A is incorrect because Memcached is not used; the question states ElastiCache Redis. Option B is incorrect because the scaling policy is based on CPU utilization, not memory. Option D is incorrect because the cluster size doesn't cause periodic spikes; it would cause consistent high utilization.

Answer

The application is using Memcached instead of Redis, causing increased load.

Answer

The Auto Scaling group's scaling policy is based on memory utilization instead of CPU.

Answer

The ElastiCache cluster is not large enough to handle the number of requests.

Question 8

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using customer-managed KMS keys. Additionally, any attempt to upload an unencrypted object must be denied. Which S3 bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: aws:kms. The condition 's3:x-amz-server-side-encryption':'aws:kms' in a Deny statement ensures that only requests with SSE-KMS encryption are allowed, blocking unencrypted uploads or uploads with other encryption types. Option A is wrong because 'true' is not a valid encryption type; the correct value is 'aws:kms'. Option B is wrong because it allows SSE-S3 (AES256), not KMS encryption. Option C is wrong because it checks a KMS encryption context rather than the encryption header, and it does not deny unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: true

Answer

Allow s3:PutObject with condition s3:x-amz-server-side-encryption: AES256

Answer

Allow s3:PutObject with condition kms:EncryptionContext: department:finance

Question 9

A company uses AWS CodePipeline with a GitHub source action. The pipeline triggers on changes to the master branch. However, the pipeline does not trigger when changes are pushed to the master branch. What is the MOST likely cause?

Accepted Answer

The webhook in GitHub is not properly configured or has been removed.. The most likely cause is that the webhook in GitHub is not properly configured or has been removed. CodePipeline relies on a webhook to automatically detect changes in the GitHub repository. If the webhook is missing or misconfigured, the pipeline will not trigger on pushes. Option A is incorrect because the pipeline uses the master branch as specified. Option B is incorrect because AWS regions are independent of GitHub; the webhook is not region-specific. Option D is incorrect because pipeline permissions are not required for the webhook to function; the webhook itself is the key mechanism for triggering.

Answer

The pipeline uses a different branch name.

Answer

The GitHub repository is not in the same AWS region as the pipeline.

Answer

The pipeline does not have permission to access the GitHub repository.

Question 10

A company wants to centrally manage and audit access to AWS KMS keys across multiple accounts. Which AWS feature should be used?

Accepted Answer

AWS CloudTrail with organization trail. AWS CloudTrail with an organization trail can log all API calls, including KMS key usage, across multiple accounts in an AWS Organization. This provides centralized audit logging for KMS key access. Option A (AWS Config aggregated rules) can evaluate resource compliance but does not audit key usage. Option B (Cross-account IAM roles) allows access but not centralized auditing. Option D (AWS Organizations tag policies) manage tags, not auditing. Therefore, option C is correct.

Answer

AWS Config aggregated rules

Answer

Cross-account IAM roles

Answer

AWS Organizations tag policies

Question 11

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 12

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are tamper-proof and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and digital signing to ensure logs have not been tampered with. S3 object lock prevents deletion but not modification. MFA delete protects deletion but not modification. SSE encrypts data at rest but does not protect integrity.

Answer

Server-side encryption (SSE-S3)

Answer

S3 Object Lock

Answer

MFA delete on the S3 bucket

Question 13

Refer to the exhibit. A DevOps engineer attaches the IAM policy to an IAM user. The user reports being unable to download objects from the S3 bucket. What is the likely cause?

Accepted Answer

The policy does not allow s3:ListBucket, which is required for the AWS CLI to list objects. The policy only allows s3:GetObject, but the user may be trying to list objects or access a bucket that requires additional permissions. Option A is wrong because the policy allows GetObject. Option B is wrong because the policy is not malformed. Option D is wrong because the user is allowed to access the bucket.

Answer

The bucket policy denies access to the user

Answer

The policy is malformed because the Resource element is incorrect

Answer

The user's access key is expired

Question 14

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

Accepted Answer

Define environment variables in the source code using .ebextensions configuration files.. Ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Answer

Update the environment variables manually in the Elastic Beanstalk console after each deployment.

Answer

Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.

Answer

Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Question 15

A DevOps engineer needs to collect and analyze logs from multiple AWS services, including EC2, Lambda, and API Gateway. The logs must be stored in a central location for long-term retention and analyzed using SQL queries. Which TWO services should be combined to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Correct options: B and E. Option B: CloudWatch Logs can collect logs from many AWS services. Option E: Exporting logs to S3 and using Athena allows SQL-based analysis. Option A is wrong because CloudTrail is for API logs, not all service logs. Option C is wrong because Kinesis Data Firehose is for real-time streaming, not for ad-hoc SQL queries. Option D is wrong because SQS is a message queue, not a log store.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Question 16

Which THREE steps are required to set up cross-account access for AWS CodePipeline using a customer-managed KMS key?

Accepted Answer

Grant the pipeline's IAM role permission to use the KMS key via IAM policy.. The pipeline's IAM role must have an IAM policy granting it permission to use the customer-managed KMS key for encrypt and decrypt operations. This is necessary because CodePipeline uses the KMS key to encrypt artifacts stored in the artifact bucket, and the pipeline role needs explicit kms:Encrypt and kms:Decrypt permissions to interact with the key.

Answer

Give the target account's IAM role permission to encrypt with the KMS key.

Answer

Create a KMS key in the target account.

Question 17

A company runs a stateful web application on EC2 instances behind an ALB. The application stores session data in memory. The company wants to make the application stateless to improve resilience. Which TWO changes should the company make?

Accepted Answer

Disable sticky sessions on the ALB. To make the application stateless, the company should disable sticky sessions on the ALB (option B) and store session data in Amazon ElastiCache for Redis (option D). Disabling sticky sessions ensures that requests can be routed to any instance, and storing session data externally removes the dependency on in-memory state on individual instances, improving resilience. Option A is incorrect because increasing instance memory does not solve the statefulness issue. Option C is incorrect because enabling sticky sessions would maintain state on instances. Option E is incorrect because using an NLB does not address session state management.

Answer

Increase the instance memory to store more sessions

Answer

Enable sticky sessions (session affinity) on the ALB

Answer

Use an NLB instead of an ALB

Question 18

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed KMS key. Which TWO steps must be taken to achieve this?

Accepted Answer

Add a statement to the KMS key policy that allows CloudWatch Logs to use the key.. To encrypt CloudWatch Logs at rest with a customer-managed KMS key, you must add a statement to the KMS key policy granting CloudWatch Logs permission to use the key (option B). Then, use the put-log-group-encryption API to associate the KMS key with the log group (option E). Option C is incorrect because CloudWatch Logs uses key policies, not grants. Option D is incorrect because you specify the key ARN at the log group level, not per log stream. Option A is incorrect because you do not need to recreate the log group; you can associate the key with an existing log group.

Answer

Recreate the log group after associating the key.

Answer

Create a KMS grant to allow CloudWatch Logs to use the key.

Answer

Specify the KMS key ARN when creating each log stream.

Question 19

A company uses AWS Lambda with an Amazon DynamoDB table to process high-volume clickstream data. The Lambda function writes the data to DynamoDB. Recently, the function has been experiencing throttling and timeouts during peak traffic. The DevOps team needs to set up monitoring to identify the root cause. Which combination of metrics should they analyze?

Accepted Answer

DynamoDB throttled write events and Lambda concurrent executions.. DynamoDB throttled write events and Lambda concurrent executions are directly related to the throttling and timeout issues. The throttled write events metric shows when DynamoDB is limiting write capacity, and Lambda concurrent executions indicate if the function is hitting its concurrency limit. Option B is wrong because read/write capacity metrics show provisioned vs consumed capacity but not throttling directly, and Lambda error count doesn't distinguish between timeout and other errors. Option C is wrong because Lambda invocations and duration don't reveal throttling causes. Option D is wrong because CloudWatch Logs and memory utilization are not primary indicators for throttling and timeouts.

Answer

DynamoDB read and write capacity metrics and Lambda error count.

Answer

CloudWatch metrics for Lambda invocations and duration.

Answer

CloudWatch Logs for Lambda function logs and Lambda memory utilization.

Question 20

A company runs a critical microservices architecture on Amazon ECS with Fargate. They want to ensure that if a task fails, it is automatically restarted, and the service remains available across multiple Availability Zones. How should they configure the ECS service?

Accepted Answer

Define an ECS service with a task definition, set desired count across multiple Availability Zones, and use Service Auto Scaling. An ECS service configured with a task definition, desired count across multiple Availability Zones, and Service Auto Scaling ensures resilience. The ECS service scheduler automatically restarts failed tasks, and distributing tasks across AZs provides high availability. Option A is wrong because placing all tasks in a single AZ creates a single point of failure. Option B is wrong because a standalone Fargate task does not have automatic restart; a CloudWatch alarm can restart it but lacks the built-in resilience of an ECS service. Option C is wrong because using a single EC2 instance is a single point of failure and does not provide multi-AZ resilience.

Answer

Place all tasks in the same Availability Zone to reduce latency

Answer

Run a standalone Fargate task and use a CloudWatch alarm to restart it

Answer

Use an EC2 launch type with a single instance to reduce complexity