DOP-C02 Practice Exam 53 — 20 Questions

Question 1

A DevOps engineer needs to allow an AWS Lambda function to write logs to Amazon CloudWatch Logs. What should the engineer do?

Accepted Answer

Attach an IAM policy to the Lambda execution role that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.. Lambda functions assume an IAM execution role, and permissions to write to CloudWatch Logs must be granted via an IAM policy attached to that role. The policy needs logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents to allow the function to create the log group (if absent), create a log stream, and put log events. This is the standard, least-privilege way to grant Lambda logging permissions.

Answer

Attach an IAM role to the Lambda function's instance profile.

Answer

Generate an access key for the Lambda function and configure the function to use it.

Answer

Create a resource-based policy on the CloudWatch Logs log group that allows the Lambda function to write.

Question 2

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the DevOps engineer notices that some users are being logged out and losing session data. The deployment uses a rolling update strategy. What is the MOST likely cause?

Accepted Answer

The session data is stored locally on the EC2 instance, not in a shared external store.. Sticky sessions on the ALB bind a user to a specific EC2 instance via a cookie (AWSALB). If session data is stored locally on that instance, terminating the instance during a rolling update destroys the session data, logging the user out. The correct fix is to externalize session state to a shared store like ElastiCache, DynamoDB, or a database so any instance can serve any user.

Answer

The Auto Scaling group is terminating instances before the new ones are fully ready.

Answer

The health check interval is too long, causing the ALB to route traffic to unhealthy instances.

Answer

The ALB sticky session cookie is not being generated correctly.

Question 3

A DevOps engineer needs to audit changes to IAM policies over the past 90 days. The engineer wants to see who made the change, what the change was, and when it occurred. Which AWS tool should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct choice because it records all API calls made to the AWS environment, including IAM policy changes, and stores them as events with details such as the identity of the caller (IAM user or role), the time of the request, and the request parameters. By querying CloudTrail logs over the past 90 days, the DevOps engineer can audit who made the change, what the change was (e.g., the specific IAM policy document modification), and when it occurred.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

IAM Access Analyzer

Question 4

A company has a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The Lambda function sometimes fails due to transient errors. The company wants to ensure that failed messages are retried and eventually processed or sent to a dead-letter queue after 3 retries. What is the correct configuration?

Accepted Answer

Configure the SQS queue's redrive policy with maxReceiveCount: 3 and a dead-letter queue.. For Lambda functions that poll an SQS queue, the retry behavior and dead-letter queue are configured on the SQS queue itself using a redrive policy. The redrive policy specifies the maxReceiveCount (e.g., 3) and the ARN of the dead-letter queue. After a message is received the specified number of times without being deleted, SQS moves it to the DLQ. This is the correct way to handle retries and DLQ for SQS-triggered Lambda.

Answer

Set the Lambda function's retry policy to Maximum retries: 3 and configure a DLQ on the Lambda function.

Answer

Set the Lambda function's DLQ to an SQS queue and configure the event source mapping to use that DLQ after 3 retries.

Answer

Create an AWS Step Functions workflow that polls the SQS queue, processes messages, and retries failures up to 3 times before moving to a DLQ.

Question 5

During an incident, a DevOps engineer needs to quickly revoke access to a set of IAM users who are suspected to be compromised. The users have programmatic access keys and console passwords. The engineer wants to minimize the impact on non-compromised users. Which action should the engineer take FIRST?

Accepted Answer

Attach an IAM policy that explicitly denies all actions to the compromised users.. Attaching an explicit Deny policy to the compromised users immediately blocks all API and console actions for those principals while leaving other users untouched, and it is reversible once the incident is resolved. This is the fastest containment step that satisfies least-impact on non-compromised users. Deleting keys or users is more destructive and slower to reverse.

Answer

Delete the compromised IAM users.

Answer

Delete the access keys of the compromised users.

Answer

Change the IAM password policy to require strong passwords.

Question 6

A team uses AWS CloudFormation to manage a multi-tier application. They update the stack and receive this error: 'UPDATE_ROLLBACK_FAILED'. The stack is in a state where some resources were updated, then rollback failed. What is the best course of action?

Accepted Answer

Use the 'ContinueUpdateRollback' API or AWS Management Console to resume rollback, and fix any underlying issues.. The 'UPDATE_ROLLBACK_FAILED' state indicates that CloudFormation attempted to roll back a failed stack update but encountered an error during the rollback process. The correct action is to use the 'ContinueUpdateRollback' API (or the AWS Management Console equivalent) to resume the rollback after fixing the underlying issue that caused the rollback to fail, such as a resource dependency or permission problem. This allows CloudFormation to complete the rollback and return the stack to a known stable state, rather than leaving it in an inconsistent or partially updated condition.

Answer

Ignore the error and use the stack as-is.

Answer

Attempt to continue the update again.

Answer

Delete the stack and recreate it.

Question 7

A company wants to securely store database credentials used by an application running on Amazon EC2. The credentials should be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to securely store and manage secrets such as database credentials, and it provides built-in automatic rotation every 90 days (or custom intervals) using Lambda functions. It integrates natively with Amazon RDS, Redshift, and DocumentDB for rotation. IAM and KMS do not store secrets, and Parameter Store does not offer automatic rotation natively.

Answer

AWS IAM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 8

Refer to the exhibit. A DevOps engineer checks the CloudWatch alarm configuration and state. The alarm is in ALARM state for CPUUtilization averaging 90% over 5 minutes, but no notification was received. What is the most likely reason?

Accepted Answer

The SNS topic does not have any confirmed subscriptions.. A CloudWatch alarm in ALARM state triggers its configured actions, typically publishing to an SNS topic. If no notification is received, the most likely cause is that the SNS topic has no confirmed subscriptions—meaning no endpoint (email, SMS, Lambda, etc.) has completed the subscription confirmation handshake. Without a confirmed subscription, SNS accepts the publish but delivers to no one, so the alarm fires silently. This is a common operational oversight.

Answer

The EC2 instance is stopped.

Answer

The alarm period is set to 300 seconds, which is too long.

Answer

The alarm has insufficient data to evaluate.

Question 9

A DevOps engineer observes the CloudWatch alarm output shown in the exhibit. The alarm is in ALARM state for instance i-0abcd1234efgh5678. The engineer checks the EC2 console and sees that the instance's CPU utilization is currently 10%. What is the MOST likely explanation?

Accepted Answer

The alarm has not yet evaluated enough low datapoints to change state. CloudWatch alarms evaluate metrics over a specified number of datapoints and periods. Even if the current CPU utilization is 10%, the alarm may still be in ALARM state because it has not yet evaluated enough consecutive low datapoints to transition to OK. The alarm state changes only after the configured number of evaluation periods and datapoints breach or recover from the threshold.

Answer

The alarm is misconfigured with wrong metric

Answer

The threshold was set too low

Answer

The CPUUtilization metric is not being emitted

Question 10

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The application stores session state in an in-memory cache on each instance. During deployment of a new version, users experience session timeouts and errors. Which design change will MOST effectively improve resilience and avoid session loss during deployments?

Accepted Answer

Migrate session state to ElastiCache for Redis.. Migrating session state from in-memory EC2 instance storage to ElastiCache for Redis decouples session data from individual instances. This ensures that when a new deployment replaces instances, sessions persist independently, preventing timeouts and errors. ElastiCache provides a centralized, highly available session store that survives instance termination and scaling events.

Answer

Enable sticky sessions (session affinity) on the ALB.

Answer

Increase the ALB idle timeout to 600 seconds.

Answer

Increase the EC2 instance size to handle higher memory.

Question 11

A company runs a critical application on AWS Lambda that processes messages from an Amazon SQS queue. The application must be resilient to downstream service failures. The team notices that when the downstream service is unhealthy, messages are repeatedly retried and eventually sent to the dead-letter queue (DLQ) before the service recovers. What design change would improve resilience by allowing automatic retries after the downstream service recovers?

Accepted Answer

Configure the SQS queue with a large visibility timeout (e.g., 6 hours) and use a redrive policy only after a high number of receives. Keep the messages in the queue and retry when the downstream service becomes healthy.. Increasing the visibility timeout to a long duration (e.g., 6 hours) prevents messages from being repeatedly retried and sent to the DLQ while the downstream service is unhealthy. Instead, messages remain in the SQS queue and become visible again only after the visibility timeout expires, allowing automatic retries once the downstream service recovers. This approach avoids premature DLQ delivery and leverages SQS's built-in redrive policy based on maxReceiveCount.

Answer

Reduce the maxReceiveCount to 1 so that messages are sent to DLQ immediately, then reprocess them from DLQ later.

Answer

Increase the message retention period to 14 days and use a DLQ with high retention.

Answer

Use Amazon SNS to fan out messages to multiple SQS queues, each with different retry policies.

Question 12

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an AWS::EC2::Instance with a UserData script. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]. The requested configuration is currently not supported. Please check the documentation for supported configurations.' The engineer suspects the instance type is not supported in the selected Availability Zone. Which action should the engineer take to resolve this issue and ensure successful stack creation?

Accepted Answer

Add an Availability Zone parameter and map it to an AZ that supports the instance type, or use the AWS::EC2::Instance AvailabilityZone property to specify an AZ that supports the instance type.. The error indicates the instance type is not supported in the default Availability Zone (AZ) selected by CloudFormation. By explicitly specifying an AZ that supports the instance type via the `AvailabilityZone` property or by parameterizing the AZ, the engineer can override the default AZ selection and resolve the incompatibility. This approach directly addresses the root cause without changing the instance type or region.

Answer

Use AWS OpsWorks to deploy the instance instead of CloudFormation.

Answer

Change the instance type to a previous generation that is supported in all AZs.

Answer

Modify the template to specify a different region that supports the instance type.

Question 13

A company is deploying a critical microservice on Amazon ECS with Fargate. They need to ensure that the service can tolerate an Availability Zone failure. What is the BEST approach?

Accepted Answer

Define the service to spread tasks across multiple Availability Zones. Amazon ECS with Fargate allows you to define a service with a 'spread across Availability Zones' strategy. By setting the service's placement strategy to spread tasks across multiple Availability Zones, the service automatically distributes tasks evenly across the specified AZs. If one AZ fails, the remaining tasks in other AZs continue to serve traffic, ensuring high availability. This is the most direct and effective method for tolerating an AZ failure in a Fargate-based deployment.

Answer

Use a cluster placement constraint to spread tasks across instances

Answer

Use EC2 launch type and spread tasks across instance types

Answer

Configure service auto scaling to add tasks when CPU is high

Question 14

A DevOps team manages a multi-account AWS environment using AWS Organizations. They need to enforce a mandatory tag (e.g., 'CostCenter') on all resources created across accounts. Which combination of services should be used to automatically remediate non-compliant resources?

Accepted Answer

AWS Config rules with automatic remediation using AWS Systems Manager Automation or Lambda.. AWS Config rules continuously evaluate resource configurations against desired tag policies. When a resource is non-compliant, Config can trigger automatic remediation using AWS Systems Manager Automation documents or Lambda functions to add the required tag or stop/delete the resource. This combination provides detection and automated enforcement across all accounts in AWS Organizations.

Answer

AWS Service Control Policies (SCPs) to deny creation of resources without the tag.

Answer

AWS CloudTrail to detect non-compliant resource creation and send notifications.

Answer

AWS Resource Groups & Tag Editor to manually add tags to non-compliant resources.

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires environment-specific configuration values (database URL, API keys) that must be stored securely and rotated automatically. The team uses AWS Secrets Manager. Which configuration management strategy should the team implement to securely inject secrets into the Elastic Beanstalk environment?

Accepted Answer

Use an Elastic Beanstalk platform hook script that retrieves secrets from Secrets Manager and sets them as environment variables.. Elastic Beanstalk platform hooks allow custom scripts to run during deployment, enabling retrieval of secrets from AWS Secrets Manager and setting them as environment variables before the application starts. This approach keeps secrets out of the environment configuration and supports automatic rotation by having the script fetch the latest secret value on each deployment.

Answer

Store the secrets in the Elastic Beanstalk environment configuration as plain text under 'aws:elasticbeanstalk:application:environment'.

Answer

Configure Secrets Manager to automatically push secrets to Elastic Beanstalk environment properties.

Answer

Use AWS CloudFormation dynamic references to inject secrets into the Elastic Beanstalk environment.

Question 16

Which TWO are valid use cases for using AWS CodeArtifact in a CI/CD pipeline? (Choose two.)

Accepted Answer

Caching dependencies from public repositories to improve build speed and reliability.. CodeArtifact can act as a proxy cache for public repositories like npm, PyPI, Maven, and NuGet. By caching dependencies locally, it reduces reliance on external sources, improves build speed by avoiding repeated downloads, and increases reliability by insulating the pipeline from outages or rate limits of public registries.

Answer

Storing Docker images that are used by ECS tasks.

Answer

Storing source code archives for use in deployment stages.

Answer

Hosting static website assets for deployment to S3.

Question 17

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the deployment fails because the target instances are not passing the health checks. The DevOps engineer notices that the CodeDeploy agent logs show 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which step should the engineer take to diagnose the issue?

Accepted Answer

Review the CodeDeploy deployment logs on a failed instance to identify script errors.. The error message indicates that individual instances failed deployment, and the CodeDeploy agent logs on a failed instance contain detailed script output (e.g., AppSpec hooks like BeforeInstall, AfterInstall, ApplicationStart) that reveal the root cause, such as a missing dependency or incorrect file path. Reviewing these logs directly identifies script errors, which is the most targeted diagnostic step before considering infrastructure changes.

Answer

Increase the size of the Auto Scaling group to ensure more instances are available.

Answer

Create a CloudWatch alarm to monitor the deployment health.

Answer

Check AWS CloudTrail logs for the CodeDeploy API calls to see if permissions are missing.

Question 18

A company has a multi-account AWS environment using AWS Organizations. They want to centrally manage user access to all accounts using single sign-on (SSO) and enforce multi-factor authentication (MFA). Which service should they use?

Accepted Answer

Use AWS IAM Identity Center (AWS SSO) to manage access and enforce MFA.. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user access and permissions across all AWS accounts in an AWS Organization. It natively supports enforcing multi-factor authentication (MFA) through an identity source (e.g., the built-in identity store or an external IdP) and integrates directly with AWS Organizations to grant single sign-on access without needing to create IAM users in each account.

Answer

Use AWS Secrets Manager to store and rotate IAM user credentials.

Answer

Create IAM users in each account and share the credentials securely.

Answer

Use Amazon Cognito user pools with an identity broker.

Question 19

A company is using AWS CloudFormation to deploy infrastructure. They need to ensure that all resources created by CloudFormation are tagged with a 'CostCenter' tag. The tag must be applied automatically to all resources in the stack. What should they do?

Accepted Answer

Specify the tag in the CloudFormation stack's Tags parameter, which applies the tag to all resources in the stack.. CloudFormation allows you to specify stack-level tags in the Tags parameter when creating or updating a stack. These tags are automatically propagated to all resources that support tagging within the stack, ensuring consistent cost allocation without additional custom logic or post-creation remediation.

Answer

Use AWS Service Catalog to enforce tagging on all products.

Answer

Create an AWS Config rule to detect untagged resources and trigger auto-remediation.

Answer

Use a custom Lambda function as a CloudFormation hook to tag resources after creation.

Question 20

A company uses AWS Organizations to manage multiple accounts. The Security team wants to prevent member accounts from disabling AWS CloudTrail or deleting CloudTrail log files. Which TWO actions should the Security team take in the organization's management account? (Choose TWO.)

Accepted Answer

Create an SCP to deny s3:DeleteObject on the CloudTrail log bucket.. An SCP that denies s3:DeleteObject on the CloudTrail log bucket prevents member accounts from deleting log files stored in S3, even if they have full administrative permissions. This is a critical control to ensure log integrity and compliance with security policies.

Answer

Create an SCP to deny cloudtrail:UpdateTrail.

Answer

Create an IAM policy in each member account to deny cloudtrail:StopLogging.

Answer

Enable AWS CloudTrail from the management account with organization trail.