DOP-C02 Practice Questions 2 — 50 Questions

Question 1

An organization has a AWS CodePipeline that deploys a critical application. The pipeline uses a manual approval step before deploying to production. The team wants to ensure that only authorized users can approve the deployment, and that the approval action is logged for compliance. Which combination of actions should the team take? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the approval action to invoke an AWS Lambda function that validates the approver's IAM role tags.. AWS CodePipeline's manual approval action can be configured to invoke an AWS Lambda function that checks the approver's IAM role tags, ensuring only authorized users (e.g., those with a specific 'approver' tag) can approve. This provides fine-grained, custom authorization beyond basic IAM policies. Option B is correct because enabling AWS CloudTrail captures all approval API calls (e.g., PutApprovalResult) as audit logs, meeting compliance requirements for tracking who approved and when.

Answer

Use Amazon Simple Notification Service (SNS) to send approval notifications and allow any subscriber to approve.

Answer

Use AWS CodeCommit to manage approval permissions via repository policies.

Answer

Store approval logs in Amazon CloudWatch Logs for real-time monitoring.

Question 2

Refer to the exhibit. A DevOps engineer runs the above commands. The build project 'my-project' uses an S3 bucket as source and another S3 bucket for artifacts. The build fails with an 'Access Denied' error when trying to download the source code. What is the most likely cause?

Accepted Answer

The service role does not have s3:GetObject permission on the source bucket. The build project 'my-project' uses an S3 bucket as the source. When CodeBuild downloads source code from S3, the service role must have the s3:GetObject permission on the source bucket. The 'Access Denied' error indicates that the role lacks this permission, making option B the most likely cause.

Answer

The encryption key is a KMS key that the role cannot access

Answer

The source type is S3, but the project expects CodeCommit

Answer

The source location is incorrect

Question 3

A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?

Accepted Answer

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.. An ALB can be configured with an HTTPS listener and a redirect rule that sends HTTP traffic to HTTPS, enforcing encrypted transit at the load balancer level. Option A is incorrect because configuring the web server to only respond to HTTPS does not prevent HTTP traffic from reaching the ALB; the ALB would still accept HTTP. Option C is incorrect because security groups filter traffic based on ports and IP addresses but cannot redirect HTTP to HTTPS; they only allow or deny traffic. Option D is incorrect because while CloudFront can redirect HTTP to HTTPS, the question asks for a configuration on the ALB itself, not an additional service.

Answer

Configure the web server on the EC2 instances to only respond to HTTPS requests.

Answer

Configure the security group of the ALB to only allow inbound HTTPS traffic.

Answer

Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.

Question 4

A company wants to centralize IAM user management across multiple AWS accounts. The company currently uses individual IAM users in each account. What is the BEST practice for centralized access control?

Accepted Answer

Use AWS Organizations and AWS IAM Identity Center (AWS SSO) to manage users centrally.. AWS Organizations with IAM Identity Center (AWS SSO) enables centralized user management and single sign-on across multiple AWS accounts, eliminating the need to manage individual IAM users in each account. Option B is incorrect because creating the same IAM users in each account leads to duplication and inconsistent permissions. Option C is incorrect because cross-account roles still require local IAM users or federated identities to assume those roles, and do not provide centralized user management. Option D is incorrect because IAM federation with an external IdP centralizes authentication but does not inherently manage users across accounts unless combined with AWS Organizations and IAM Identity Center.

Answer

Create the same IAM users in each account with identical permissions.

Answer

Create IAM roles in each account and allow cross-account access from a central account.

Answer

Use IAM federation with an external identity provider and assign permissions based on SAML attributes.

Question 5

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. The upload fails with an Access Denied error because the IAM policy attached to the user includes a condition that requires the request to include the `x-amz-server-side-encryption` header with a value of `AES256`. Since the user attempts to upload without specifying any server-side encryption, the request does not satisfy the condition and is denied. Option A is incorrect because the policy denies unencrypted uploads. Option B is incorrect because the user did not request SSE-S3. Option C is incorrect because automatic encryption does not override the IAM policy condition; the policy explicitly requires the encryption header to be present in the request.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-S3 encryption.

Answer

The upload succeeds and is automatically encrypted with SSE-S3.

Question 6

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Use the CloudWatch Logs console or API to associate the KMS key with the log group. Options A and E are correct. To encrypt CloudWatch Logs with a customer-managed KMS key, you must first create a customer-managed KMS key with a key policy that grants CloudWatch Logs permission to use the key (option E). Then, you associate the key with the log group using the CloudWatch Logs console or API (option A). Option B is wrong because CloudWatch Logs does not support default encryption at the account level. Option C is wrong because you do not update the log group's resource policy; the key policy is set on the KMS key itself. Option D is wrong because encryption is at the log group level, not per log stream.

Answer

Enable default encryption for CloudWatch Logs in the AWS account settings

Answer

Update the log group's resource policy to reference the KMS key

Answer

Associate the KMS key with each log stream individually

Question 7

A company uses Amazon CloudWatch Logs to store application logs. They have a requirement to retain logs for 90 days for operational analysis and then archive them to Amazon S3 for compliance purposes for an additional 5 years. Which of the following steps are necessary to meet this requirement? (Select TWO.)

Accepted Answer

Set the CloudWatch Logs retention policy on the log group to 90 days.. Setting the CloudWatch Logs retention policy on the log group to 90 days ensures logs are retained for operational analysis and then automatically expire (deleted) after 90 days. Option E is correct because to archive logs to Amazon S3 for compliance, you must use a CloudWatch Logs export task to export logs to S3 before the retention period expires. Option B is incorrect because an S3 lifecycle policy applies to objects already in S3, not to logs in CloudWatch. Option C is incorrect because subscription filters can stream logs in real time to destinations like Lambda or Kinesis, but not directly to S3 for archival. Option D is incorrect because CloudWatch Logs does not have a lifecycle policy to transition logs directly to S3; export is required.

Answer

Set an S3 lifecycle policy on the destination bucket to transition objects to Glacier after 90 days.

Answer

Create a CloudWatch Logs subscription filter to stream logs to Amazon S3 in real time.

Answer

Configure a CloudWatch Logs lifecycle policy to transition logs to Amazon S3 after 90 days.

Question 8

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Accepted Answer

Launch the RDS instance in a private subnet.. (launch RDS in a private subnet) and Option D (enable encryption at rest using AWS KMS) are correct best practices for securing an Amazon RDS database. Launching in a private subnet ensures the database is not directly accessible from the internet, enhancing security. Encryption at rest protects data stored on disk. Option A is incorrect because enabling public accessibility increases exposure to attacks. Option B is incorrect because using a single Availability Zone does not enhance security and may reduce availability. Option E is incorrect because direct IAM user access to the database is not a standard practice; RDS uses database authentication, though IAM database authentication can be used, it's not a direct IAM user access and is not a best practice for all scenarios.

Answer

Enable public accessibility for easy management.

Answer

Use a single Availability Zone to reduce complexity.

Answer

Grant direct IAM user access to the database.

Question 9

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Review the canary's CloudWatch Logs for error details.. CloudWatch Synthetics canaries automatically log execution details, including errors, to CloudWatch Logs. Reviewing these logs provides specific error information, such as 'ClientError' details. Option C is correct because each canary runs as an AWS Lambda function, and the Lambda function's CloudWatch Logs contain runtime logs, including any exceptions or errors thrown during execution. Option A is incorrect because while adding logging could be a long-term improvement, the question asks for diagnostic actions; the canary already logs to CloudWatch Logs, so modifying the script is not necessary for diagnosis. Option D is incorrect because CloudWatch metrics provide aggregate statistics (e.g., success/failure rates) but not detailed error codes or messages. Option E is incorrect because CloudTrail records API calls to create, start, or stop canaries, not the execution details of individual canary runs.

Answer

Modify the canary script to add more logging.

Answer

Examine CloudWatch metrics for the canary.

Answer

Check CloudTrail for CanaryRun API calls.

Question 10

Which TWO AWS services can be used to manage and rotate database credentials automatically? (Select TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. Options A and B are correct. AWS Systems Manager Parameter Store can store database credentials as SecureString parameters, and you can implement automatic rotation using a custom AWS Lambda function. AWS Secrets Manager provides built-in automatic rotation for supported databases (e.g., Amazon RDS, Amazon Redshift) without requiring custom code. Option C (AWS CloudFormation) is an infrastructure-as-code service and does not manage or rotate credentials. Option D (AWS KMS) is a key management service that encrypts data but does not handle credential rotation. Option E (AWS IAM) manages access permissions and roles, not database credentials.

Answer

AWS CloudFormation

Answer

AWS KMS

Answer

AWS IAM

Question 11

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. What is the most likely cause?

Accepted Answer

The Lambda function is not configured to access the VPC where the RDS instance resides.. The most likely cause of the timeout error is that the Lambda function is not configured to access the VPC where the RDS instance resides. When Secrets Manager rotates a secret for an RDS database, the rotation Lambda function must connect to the database to update the credentials. If the Lambda function is not attached to the same VPC (or a VPC with proper routing and security group rules), it cannot reach the RDS instance, causing network connection attempts to hang until the function times out.

Answer

The Lambda function's execution role lacks the required IAM permissions.

Answer

The secret rotation schedule is set to less than 24 hours.

Answer

The Lambda function does not have permission to access the S3 bucket.

Question 12

A team uses AWS CodePipeline to deploy a containerized application to Amazon ECS. The pipeline uses a source stage from CodeCommit, a build stage that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that updates an ECS service. The team wants to add a manual approval step before the deploy stage to allow QA to verify the image. What is the BEST way to implement this?

Accepted Answer

Add a manual approval stage in CodePipeline between the build and deploy stages, and configure SNS to notify approvers.. CodePipeline natively supports manual approval actions that pause the pipeline at a specified stage and wait for an approver to manually approve or reject the transition. By adding a manual approval stage between the build and deploy stages, the pipeline will automatically halt after the build completes, and you can configure Amazon SNS to notify the QA team via email or other endpoints when their approval is required. This approach requires no custom infrastructure, integrates directly with the pipeline's state machine, and provides a built-in audit trail of approvals.

Answer

Configure an AWS Lambda function in the pipeline that checks a DynamoDB table for approval status and pauses until approved.

Answer

Use an Amazon SNS topic to send a notification to QA, and have them manually trigger the deploy stage by clicking a link in the email.

Answer

Use Amazon CloudWatch Events to trigger a custom action that waits for an approval signal.

Question 13

A company uses AWS CloudFormation StackSets to deploy a VPC across multiple AWS accounts in AWS Organizations. The StackSet is created with self-managed permissions. The deployment fails in some accounts with the error: 'Insufficient IAM permissions to create resources'. What is the most likely cause of this failure?

Accepted Answer

The execution IAM role is not created in the target accounts. With self-managed permissions in AWS CloudFormation StackSets, the administrator account does not automatically create the necessary IAM roles in target accounts. The execution IAM role must be manually created in each target account to grant StackSets the permissions required to create resources. The error 'Insufficient IAM permissions to create resources' directly indicates that this execution role is missing or lacks the required policies.

Answer

The StackSet does not support deploying to more than one account

Answer

The administrator account does not have a service-linked role for StackSets

Answer

The target accounts have reached their resource service quotas

Question 14

A company uses AWS CloudFormation to manage its infrastructure. The stack creation recently failed because an IAM role resource was created before the AWS Lambda function that depends on it. The template has no DependsOn clauses. What is the most likely reason for this failure and how can it be fixed?

Accepted Answer

Add a DependsOn clause to the Lambda function resource referencing the IAM role. The most likely reason for the failure is that CloudFormation, by default, parallelizes the creation of resources that do not have explicit dependencies. Since the IAM role and Lambda function have no DependsOn clause, CloudFormation may attempt to create the Lambda function before the IAM role is fully created and its permissions are propagated. Adding a DependsOn clause to the Lambda function resource referencing the IAM role ensures that CloudFormation creates the IAM role first, resolving the dependency and preventing the failure.

Answer

Use AWS Systems Manager Automation to create the resources sequentially

Answer

Use a ChangeSet to roll back the stack and modify the template

Answer

Split the template into two separate stacks and use nested stacks

Question 15

A DevOps engineer creates the CloudFormation template shown in the exhibit. When the stack is created, the EC2 instance is launched but the security group is not applied to the instance. What is the likely cause?

Accepted Answer

The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.. The CloudFormation template does not include a `SecurityGroup` or `SecurityGroupIds` property in the EC2 instance's `AWS::EC2::Instance` resource. Without this explicit reference, the instance launches with the default VPC security group, not the custom security group defined in the template. The security group resource is created successfully, but it is not attached to the instance.

Answer

The security group resource is missing a VpcId property, so it is not created in the same VPC as the instance.

Answer

The security group is created after the instance, so the instance cannot reference it.

Answer

The DependsOn clause should be removed because it causes a circular dependency.

Question 16

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database instance fails and AWS automatically fails over to the standby. After the failover, the application cannot connect to the database. The engineer checks the RDS console and sees that the instance status is Available. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The application is using the database's DNS endpoint for the old primary, which is no longer the writer.. After an RDS Multi-AZ failover, the DNS endpoint for the DB instance remains the same but its underlying IP address changes to point to the new primary (formerly the standby). If the application caches the IP address of the old primary or uses a direct connection to the old writer endpoint, it will attempt to connect to a node that is no longer the writer. The correct practice is to always connect using the RDS instance endpoint (CNAME), which automatically resolves to the current writer, and to avoid caching the resolved IP address. Since the instance status is 'Available', the new primary is ready, so the issue is a stale connection target.

Answer

The security group for the RDS instance has changed during failover.

Answer

The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.

Answer

The database instance is still in the process of failover and is not yet accepting connections.

Question 17

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is expected to have unpredictable traffic patterns. The DevOps team needs to ensure that the application can handle sudden spikes in traffic without throttling. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes without requiring capacity planning or throttling. This mode charges per request and can accommodate sudden bursts of traffic up to the table's previous peak, making it ideal for serverless applications with variable workloads.

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.

Answer

Increase the Lambda function timeout to the maximum (15 minutes).

Answer

Set API Gateway throttling limits to a high value to prevent throttling.

Question 18

A Lambda function is unable to write logs to CloudWatch Logs. The IAM policy attached to the function's execution role is shown above. What is the issue?

Accepted Answer

The policy is missing the 'logs:CreateLogGroup' and 'logs:CreateLogStream' actions.. The Lambda function's execution role must include permissions for 'logs:CreateLogGroup' and 'logs:CreateLogStream' in addition to 'logs:PutLogEvents' to write logs to CloudWatch. The provided policy likely only grants 'logs:PutLogEvents', which allows writing to existing log streams but not creating the log group or stream. Option A is incorrect because the resource ARN can be generalized to the log group or stream without specifying the stream name. Option B is incorrect because the region mismatch would cause a different error. Option C is incorrect because the action 'logs:PutLogEvents' is necessary but not sufficient; the missing create actions are the issue.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The region in the ARN does not match the Lambda function's region.

Answer

The action should be 'logs:PutLogEvents' but the resource is too restrictive.

Question 19

A company is using AWS CodePipeline with multiple stages that include source, build, and deploy. The pipeline uses an Amazon S3 bucket as the source action. The team notices that the pipeline is not automatically starting when new files are uploaded to the S3 bucket. The S3 bucket has versioning enabled. What is the most likely reason?

Accepted Answer

The pipeline is configured to detect changes based on object key, but the uploaded file uses the same key as an existing object.. CodePipeline's S3 source action detects changes based on object key and ETag. When a file is uploaded with the same key as an existing object, even with versioning enabled, the ETag may not change if the content is identical, or the pipeline may not trigger if it only monitors for new keys. Versioning creates a new version ID, but CodePipeline's default detection relies on object key changes or ETag changes, not version ID changes, so uploading a file with the same key may not start the pipeline.

Answer

The S3 bucket is the same bucket used for the deploy action.

Answer

The S3 bucket is not configured to send Amazon SQS notifications to CodePipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 20

An IAM policy is attached to a user who needs to manually start a CodePipeline execution. The pipeline uses an S3 bucket named 'my-artifact-bucket' for artifacts. The user reports that they cannot start the pipeline. Which action is missing from the policy?

Accepted Answer

codepipeline:ListPipelines. The user needs to manually start a CodePipeline execution, which requires the `codepipeline:StartPipelineExecution` action. However, the question asks which action is missing from the policy, and the correct answer is `codepipeline:ListPipelines` because the user cannot even see the pipeline to start it. Without `codepipeline:ListPipelines`, the AWS Management Console or CLI will not return the pipeline in the list, preventing the user from selecting it to start execution. The other actions are either not directly required for starting a pipeline or are unrelated to the permission needed to list pipelines.

Answer

iam:PassRole

Answer

codepipeline:GetPipelineExecution

Answer

s3:PutObject