DOP-C02 Practice Exam 51 — 20 Questions

Question 1

Which TWO actions can be taken to secure an Amazon S3 bucket that contains confidential data? (Choose TWO.)

Accepted Answer

Enable S3 Default Encryption.. Correct options: A and E. Option A: S3 Default Encryption ensures data is encrypted at rest automatically, a key security measure. Option E: S3 Block Public Access prevents public exposure of the bucket and its objects, a key security measure. Option B (Transfer Acceleration) is for speed, not security. Option C (Cross-Region Replication) is for disaster recovery, not security. Option D (Versioning) helps with recovery from accidental deletions/overwrites, but does not directly secure data from unauthorized access.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Cross-Region Replication.

Answer

Enable S3 Versioning.

Question 2

A company runs a containerized application on Amazon ECS with Fargate. They want to monitor the application logs and metrics. Which THREE steps should they take to collect and visualize this data? (Choose THREE.)

Accepted Answer

Create a CloudWatch Dashboard to display logs and metrics.. CloudWatch Dashboards can display both logs and metrics, allowing visualization of application data collected from ECS tasks. Option C is correct because the awslogs log driver sends container logs to CloudWatch Logs directly from the ECS task definition. Option E is correct because the CloudWatch agent can be deployed as a sidecar container to collect custom metrics and logs from the application. Option B is incorrect because AWS CloudFormation is used for infrastructure provisioning and management, not for monitoring resource metrics. Option D is incorrect because AWS X-Ray is designed for tracing and analyzing requests, not for collecting logs or application metrics.

Answer

Use AWS CloudFormation to monitor resource metrics.

Answer

Use AWS X-Ray to trace requests and collect logs.

Question 3

A DevOps engineer executed the CLI command shown in the exhibit. After creation, the security team requires that the log files be encrypted with a KMS key that is rotated every 90 days. The current key is a customer managed key with automatic rotation enabled set to 365 days. What should the engineer do to meet the requirement?

Accepted Answer

Create a new KMS key with automatic rotation set to 90 days and update the trail with the new key. The requirement is to encrypt log files with a KMS key that rotates every 90 days. The current key rotates every 365 days, and you cannot change the rotation period of an existing customer managed key; you must create a new key with the desired rotation period. Once created, you update the CloudTrail trail to use the new key by specifying the --kms-key-id parameter. Option D correctly describes this process. Option A is wrong because you cannot change the rotation period of an existing key. Option B is wrong because manually rotating a key does not meet the automatic rotation requirement and is not recommended. Option C is wrong because you cannot modify the rotation period of an existing key.

Answer

Use the existing key and change the rotation period in KMS

Answer

Disable automatic rotation and manually rotate the key every 90 days

Answer

Modify the KMS key to set the rotation period to 90 days

Question 4

A company uses Amazon RDS for MySQL and wants to monitor slow queries to optimize performance. Which actions should the DevOps engineer take to capture and analyze slow query logs? (Choose THREE.)

Accepted Answer

Enable the slow query log parameter in the RDS DB parameter group. To capture and analyze slow query logs in Amazon RDS for MySQL, the DevOps engineer should enable the slow query log parameter in the DB parameter group (B), configure RDS to publish logs to Amazon CloudWatch Logs (D), and use CloudWatch Logs Insights to query and analyze the logs (E). Option A (CloudTrail) captures API activity, not SQL queries. Option C (Performance Insights) monitors database performance metrics but does not capture slow query logs.

Answer

Use AWS CloudTrail to capture SQL queries

Answer

Enable RDS Performance Insights

Question 5

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that any changes to IAM roles must be reviewed and approved by a security engineer before deployment. The DevOps engineer needs to implement a gating mechanism. Which approach should the engineer use?

Accepted Answer

Create a CodePipeline that deploys CloudFormation stacks and include a manual approval step for changes that modify IAM resources.. AWS CodePipeline can include a manual approval step before deploying CloudFormation stacks, allowing the security engineer to review and approve any changes to IAM roles. Option A is incorrect because AWS Config only detects changes after they occur; it cannot prevent deployment. Option B is incorrect because a service control policy would deny all IAM role creation across the organization, which is too restrictive and not a gating mechanism. Option C is incorrect because requiring MFA for CloudFormation actions does not specifically gate changes to IAM resources.

Answer

Use AWS Config to detect changes to IAM roles and trigger a Lambda function that reverts the change.

Answer

Apply a service control policy that denies iam:CreateRole and iam:UpdateAssumeRolePolicy across the organization.

Answer

Add a condition to the IAM policy that requires MFA for any CloudFormation action.

Question 6

A company is using AWS Lambda to process sensitive data. The security team requires that the Lambda function only be invoked from within a specific VPC and that the function's environment variables be encrypted at rest. Which TWO actions should the DevOps engineer take to meet these requirements?

Accepted Answer

Enable AWS KMS encryption for the Lambda function's environment variables using a customer-managed key.. Using a customer-managed KMS key to encrypt the Lambda function's environment variables satisfies the encryption at rest requirement. Option C is correct because configuring the Lambda function to be VPC-enabled and setting up a VPC endpoint for Lambda restricts invocation to within the specific VPC. Option B is incorrect because encrypting CloudWatch Logs does not encrypt the Lambda environment variables. Option D is incorrect because assigning an IAM execution role with KMS permissions is necessary but not sufficient; the encryption is enabled by configuring KMS on the function. Option E is incorrect because resource-based policies cannot restrict invocation to VPC origin alone; VPC configuration and endpoints are required.

Answer

Enable encryption for CloudWatch Logs using a KMS key.

Answer

Assign an IAM execution role with permissions to access a KMS key.

Answer

Attach a resource-based policy to the Lambda function that denies invoke unless the request comes from the VPC.

Question 7

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service should be used to implement this rotation?

Accepted Answer

AWS Lambda with custom rotation logic. AWS Lambda with custom rotation logic is the correct service to automate IAM user access key rotation because AWS does not provide a native service that automatically rotates IAM access keys. AWS Secrets Manager can rotate secrets for databases and other services, but it does not support rotating IAM user access keys. Therefore, the recommended approach is to implement a custom Lambda function that generates new keys, updates the user, and manages the rotation lifecycle. Option B (AWS Config) only monitors compliance, not credentials. Option D (Systems Manager Parameter Store) stores secrets but lacks rotation capabilities for IAM keys.

Answer

AWS Config

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 8

A company needs to ensure that an EC2 instance can only be launched using a specific Amazon Machine Image (AMI) that has been approved by the security team. Which TWO actions should be taken?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the AMI ID matches the approved AMI.. An IAM policy with a condition for ec2:ImageId can restrict which AMIs can be used. Option C is correct because an SCP in AWS Organizations can enforce this across accounts. Option A is wrong because tagging does not enforce AMI usage. Option D is wrong because AWS Config rules only detect non-compliance, not prevent. Option E is wrong because CloudTrail is for logging.

Answer

Tag the approved AMI and use resource-based policies to allow only tagged AMIs.

Answer

Create an AWS Config rule to check that EC2 instances are launched from the approved AMI.

Answer

Enable CloudTrail to log all EC2 RunInstances calls and alert on unapproved AMIs.

Question 9

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet but must not be directly accessible from the internet. Which configuration allows this?

Accepted Answer

Deploy a NAT gateway in a public subnet and route the private subnet's traffic through it.. A NAT gateway deployed in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet. This matches the requirement for downloading patches without direct accessibility. Option B is correct. Option A is incorrect because a VPN connection provides access to an on-premises network, not general internet access. Option C is incorrect because a bastion host provides SSH/RDP access to instances, not outbound internet connectivity for patch downloads. Option D is incorrect because attaching an internet gateway and adding a route to the private subnet route table would make the instances directly accessible from the internet, violating the requirement.

Answer

Set up a VPN connection to the company's on-premises network and route traffic through it.

Answer

Deploy a bastion host in the public subnet and configure the instance to use it.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table.

Question 10

A company uses AWS Lambda functions to process incoming events from Amazon S3. The operations team notices that some events are not being processed, and there is no error in the Lambda function logs. What is the most likely cause?

Accepted Answer

The Lambda function has reserved concurrency set to a low value, causing throttling.. When a Lambda function has reserved concurrency set to a low value, it limits the number of concurrent executions allowed for that function. If incoming S3 events exceed this limit, the Lambda service throttles the invocations, causing some events to be silently dropped without generating errors in the function logs because the function never actually runs. This matches the symptom of missing events with no error logs.

Answer

The S3 event notification is configured to send to an SNS topic that is not subscribed to the Lambda function.

Answer

The S3 bucket policy does not allow the Lambda function to be invoked.

Answer

The Lambda function has a timeout that is too short.

Question 11

A company uses AWS Lambda with an Amazon DynamoDB trigger. Recently, the Lambda function started failing with 'ProvisionedThroughputExceededException' errors. The DevOps team needs to mitigate the issue. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Increase the DynamoDB table's write capacity. To mitigate 'ProvisionedThroughputExceededException' errors when a Lambda function is triggered by DynamoDB Streams, two actions are effective. Option D: Increase the DynamoDB table's write capacity to handle the write demand from the stream processing. Option E: Reduce the batch size for the DynamoDB stream event source mapping to lower the number of writes per invocation, reducing the chance of exceeding throughput. Option A is wrong because Lambda reserved concurrency controls how many concurrent executions Lambda can run, but the issue is DynamoDB throttling, not Lambda capacity. Option B is wrong because disabling DynamoDB Streams would stop the trigger entirely, which is not a mitigation. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads, not writes, and does not affect write throughput.

Answer

Increase the Lambda function's reserved concurrency

Answer

Disable DynamoDB Streams on the table

Answer

Enable DynamoDB Accelerator (DAX) for the table

Question 12

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Accepted Answer

Launch the RDS instance in a private subnet.. Option C is correct because launching the RDS instance in a private subnet removes it from the public internet, so only resources inside the VPC (or connected via VPN/Direct Connect or a bastion) can reach the database endpoint, which is a core network-isolation best practice. Option D is correct because enabling encryption at rest with AWS KMS protects stored data, automated backups, read replicas, and snapshots, satisfying compliance and data-protection requirements. Option A is wrong because public accessibility exposes the database to internet-based attacks and is not recommended; management should be done via private networking or a bastion. Option B is wrong because a Single-AZ deployment creates a single point of failure and does not improve security; Multi-AZ is preferred for availability. Option E is wrong because granting direct IAM user access to the database bypasses proper database authentication and least-privilege controls; IAM should be used for AWS API access, not direct DB logins.

Answer

Enable public accessibility for easy management.

Answer

Use a single Availability Zone to reduce complexity.

Answer

Grant direct IAM user access to the database.

Question 13

A DevOps engineer needs to ensure that all API calls made to AWS are recorded for auditing purposes. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This provides a complete audit trail of user activity and API usage, which is essential for auditing, security analysis, and compliance requirements.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 14

A Lambda function processes SQS messages but sometimes times out after 15 seconds. The function performs a database call that occasionally takes longer. What is the best way to handle this without losing messages?

Accepted Answer

Increase the Lambda timeout and increase the SQS visibility timeout, and add a dead-letter queue.. The root cause is that the Lambda timeout (15s) is shorter than the occasional database call, and the SQS visibility timeout is likely too short to cover the retry window. Increasing the Lambda timeout gives the function room to finish, increasing the SQS visibility timeout prevents other consumers from picking up the message while it is still being processed, and a dead-letter queue captures messages that repeatedly fail so they are not lost. This combination preserves at-least-once delivery and prevents message loss.

Answer

Decrease the SQS visibility timeout to retry faster.

Answer

Split the batch into smaller batches using partial batch response.

Answer

Reduce the Lambda reserved concurrency to limit invocations.

Question 15

A company wants to automate patching of EC2 instances running Amazon Linux 2 while ensuring compliance with security policies. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates the patching of EC2 instances, including Amazon Linux 2, by using patch baselines to define approved patches and compliance rules. It integrates with maintenance windows and State Manager to schedule and enforce patching, ensuring instances remain compliant with security policies without manual intervention.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Config

Question 16

Match each AWS compute or container service with its description.

Accepted Answer

EC2: Virtual servers in the cloud. Correct matches: EC2 for virtual servers, ECS for Docker containers, EKS for Kubernetes, Lambda for serverless computing. Common confusions include mistaking EC2 as serverless or mixing up ECS and EKS.

Answer

EC2: Serverless compute service

Answer

ECS: Managed Kubernetes service

Question 17

A company has a multi-account AWS organization. The security team needs to detect and respond to security incidents across all accounts centrally. Which THREE services should the team use together? (Choose three.)

Accepted Answer

AWS Security Hub. AWS Security Hub (A) is correct because it acts as the central aggregation and prioritization layer, ingesting findings from GuardDuty, Inspector, Macie, and other services across all accounts in the organization and normalizing them to the AWS Security Finding Format (ASFF) for a single-pane-of-glass view. Amazon GuardDuty (D) is correct because it provides the continuous threat detection foundation, analyzing CloudTrail management events, VPC Flow Logs, and DNS logs across every account to surface malicious or unauthorized activity. Amazon Detective (E) is correct because it complements detection with investigation, automatically building behavior graphs from GuardDuty, CloudTrail, and VPC Flow Logs so the security team can triage and root-cause incidents centrally. Amazon Inspector (B) is not one of the three because it is a vulnerability management service scoped to EC2, ECR, and Lambda resources rather than a cross-account incident detection and response hub. Amazon Macie (C) is not one of the three because it is a data-security service that discovers and classifies sensitive data in S3, which is useful but not part of the core centralized detect-and-respond trio.

Answer

Amazon Inspector

Answer

Amazon Macie

Question 18

A company uses AWS CodeBuild to build and test code. They need to securely store sensitive parameters, such as database passwords, and inject them into the build process. Which AWS service should they use?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is the correct choice because it provides secure, hierarchical storage for configuration data and secrets, such as database passwords, and integrates natively with AWS CodeBuild via the `parameter-store` environment variable type. This allows you to reference parameters without hardcoding sensitive values, and you can optionally use secure string parameters encrypted with KMS for additional protection.

Answer

Storing them in the CodeBuild project environment variables

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Question 19

A DevOps engineer is designing a deployment pipeline for a serverless application using AWS SAM. The pipeline must include the following stages: source, build, deploy to a development environment, run integration tests, and promote to production after manual approval. Which AWS services and features should be used to implement this pipeline? (Choose two.)

Accepted Answer

AWS CodePipeline to orchestrate the pipeline stages.. AWS CodePipeline is the correct service for orchestrating the pipeline stages because it provides native support for defining source, build, deploy, test, and manual approval stages in a sequential workflow. It integrates directly with AWS SAM and can trigger builds and deployments based on source code changes, making it the ideal orchestrator for this multi-stage pipeline.

Answer

AWS CodeDeploy for deploying the SAM application.

Answer

AWS CodeCommit to build the SAM application.

Question 20

A company uses AWS CodePipeline for CI/CD. A recent pipeline execution failed at the 'Deploy' stage with the error 'Action execution failed: Access Denied'. The pipeline uses an IAM service role. Which THREE checks should the engineer perform to resolve this?

Accepted Answer

Verify that the IAM service role has sufficient permissions to perform the deploy action on the target resource.. The 'Access Denied' error at the Deploy stage indicates a permissions issue. The correct checks are: B) Verify that the IAM service role has sufficient permissions for the deploy action on the target resource, as the role must have the necessary IAM policies to perform deployments. C) Ensure the artifact store S3 bucket has a bucket policy that allows the pipeline role to access it, because the pipeline needs to read artifacts from the bucket. E) Confirm that the service role's trust policy allows CodePipeline to assume the role, since the trust policy must grant the `sts:AssumeRole` permission to the CodePipeline service. Option A is incorrect because CloudWatch Events rules trigger pipeline execution but are not related to the deploy stage's access denied error. Option D is incorrect because S3 event notifications trigger the pipeline on code changes, not resolve deployment failures.

Answer

Check that CloudWatch Events rule is configured to trigger the pipeline.

Answer

Enable S3 event notifications to trigger the pipeline on code changes.