DOP-C02 Practice Exam 55 — 20 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack fails to create or update. What is the MOST efficient way to achieve this?

Accepted Answer

Configure an SNS topic in the stack's notification options.. AWS CloudFormation natively supports specifying Amazon SNS topic ARNs in the stack's notification options. When a stack operation (create, update, or delete) fails, CloudFormation automatically publishes a notification to the configured SNS topic without requiring any custom code, additional resources, or external event processing. This is the most efficient approach as it leverages built-in functionality with zero maintenance overhead.

Answer

Create a custom resource in the stack that publishes to Amazon SNS.

Answer

Create a CloudWatch alarm on the StackStatus metric.

Answer

Use Amazon EventBridge to capture CloudFormation events and publish to SNS.

Question 2

A DevOps engineer needs to restrict access to an S3 bucket so that only users from a specific AWS account can read objects. Which TWO methods can achieve this?

Accepted Answer

Create an IAM role in the source account with read access to the bucket, and allow users in that account to assume the role.. An IAM role in the source account can be granted read access to the S3 bucket via a bucket policy that allows the role's ARN. Users in the source account assume this role, which temporarily provides them with the necessary permissions to read objects. This cross-account access pattern is secure and follows AWS best practices for delegating access across accounts.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Generate pre-signed URLs for each object and distribute them only to users in the target account.

Answer

Set a bucket ACL that grants read access to the target account's canonical ID.

Question 3

A DevOps team is designing a CI/CD pipeline that deploys a web application on Amazon ECS. The application must be compliant with PCI DSS, which requires encryption of data at rest and in transit, and logging of all access. Which THREE actions should the team implement to meet these requirements? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail and Amazon ECS logs to capture all API calls and container logs.. AWS CloudTrail captures all API calls to the AWS environment, providing an audit trail of who accessed what and when, which is required for PCI DSS logging. Amazon ECS logs (via CloudWatch Logs or FireLens) capture container-level access and application logs, ensuring comprehensive logging of all access to the application and underlying infrastructure.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Answer

Use VPC endpoints to access ECS and ECR APIs.

Question 4

A company is using AWS Systems Manager to manage configuration drift on EC2 instances. They want to automatically apply a baseline configuration to instances that have drifted from the desired state. Which Systems Manager capability should they use?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct capability because it is specifically designed to define and maintain consistent configuration states for EC2 instances and other AWS resources. It uses associations to automatically apply a baseline configuration and remediate drift on a schedule or when triggered, ensuring instances remain in the desired state without manual intervention.

Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager Parameter Store

Answer

AWS Systems Manager Run Command

Question 5

A company is using AWS Lambda functions for data processing. The operations team needs to monitor the number of invocations, duration, and error counts for each function. They also want to set alarms when the error rate exceeds 5% in a 5-minute period. Which combination of AWS services should the team use to achieve this with minimal effort?

Accepted Answer

Use CloudWatch metrics published by Lambda and create a CloudWatch alarm on the ErrorCount metric with a math expression to calculate error rate.. Lambda automatically publishes metrics to CloudWatch, including Invocations, Duration, and Errors. To monitor error rate, you can create a CloudWatch alarm using a math expression that calculates the error rate from the ErrorCount and Invocations metrics. This approach requires minimal effort because it leverages built-in metrics and CloudWatch's native alarm capabilities.

Answer

Use AWS CloudTrail to log Lambda invocations and configure CloudWatch alarms on the log events.

Answer

Enable Lambda Insights to collect detailed metrics and use CloudWatch dashboards to monitor error rates.

Answer

Stream Lambda logs to CloudWatch Logs and use CloudWatch Logs Insights to query error rates, then create alarms.

Question 6

A company runs a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is used by thousands of users. Recently, the operations team noticed an increase in 5xx errors from API Gateway. The team has enabled CloudWatch Logs for the Lambda functions and API Gateway. They see the errors are sporadic and not correlated with high traffic. The Lambda function's error count in CloudWatch is also increasing. The team wants to identify the specific requests that are failing and understand the error details. Which solution should the team implement?

Accepted Answer

Enable AWS X-Ray active tracing on the Lambda functions and API Gateway to capture detailed request traces and error details. AWS X-Ray active tracing on Lambda and API Gateway captures end-to-end request traces, including downstream calls to DynamoDB, latency breakdowns, and exception details for each failing invocation. Because the errors are sporadic and not traffic-correlated, X-Ray's per-request trace view is the fastest way to pinpoint which specific requests fail and why. CloudWatch Logs alone would require manual correlation across services and lacks the trace context X-Ray provides.

Answer

Use CloudWatch Logs Insights to query the Lambda logs for ERROR messages and correlate with API Gateway logs

Answer

Enable VPC Flow Logs for the Lambda function's VPC to capture network traffic

Answer

Enable AWS CloudTrail to log API Gateway API calls and analyze the logs

Question 7

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences periodic spikes in response times. The CloudWatch metrics show high CPU and memory usage for the tasks during these spikes. What is the MOST effective approach to handle these spikes?

Accepted Answer

Configure target tracking scaling policies for the ECS service using CPU or memory utilization. Target tracking scaling policies for Amazon ECS services using CPU or memory utilization are the most effective approach because they dynamically adjust the number of tasks in response to real-time demand, automatically adding capacity during spikes and removing it when load subsides. This aligns with the AWS Well-Architected Framework's principle of elasticity, ensuring the application scales out precisely when high CPU/memory usage is detected, without manual intervention or over-provisioning.

Answer

Use a larger Fargate task size to handle the spikes

Answer

Increase the CPU and memory limits for the ECS task definition

Answer

Set up a scheduled scaling action to add tasks during peak hours

Question 8

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences periodic slowdowns. The team wants to monitor the number of active connections and the query execution time. Which approach is most cost-effective?

Accepted Answer

Enable Performance Insights and set up CloudWatch alarms on the 'DBLoad' metric.. Performance Insights provides detailed query execution time metrics, enabling monitoring of query performance. It also includes the 'DBLoad' metric which reflects database load from active connections and queries. Combined with CloudWatch alarms, this approach is cost-effective as Performance Insights is included with RDS at no additional cost for up to 7 days of retention (longer retention has a fee). Options A and B are invalid because the CloudWatch agent cannot be installed on RDS instances, and 'QueryExecutionTime' is not a standard CloudWatch metric for RDS. Option D is less suitable for the specific requirement of query execution time; Enhanced Monitoring provides OS-level metrics like processes and memory but does not track query-level execution time.

Answer

Install the CloudWatch agent on the RDS instance to collect custom metrics.

Answer

Use the RDS console to view the 'DatabaseConnections' and 'QueryExecutionTime' metrics.

Answer

Enable Enhanced Monitoring and publish metrics to CloudWatch, then create alarms on relevant metrics.

Question 9

A company runs a production web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent high latency. The operations team needs to identify the root cause without affecting live traffic. Which approach is the MOST efficient?

Accepted Answer

Enable detailed CloudWatch metrics on the ALB and analyze ALB access logs. Enabling detailed CloudWatch metrics on the ALB and analyzing ALB access logs provides visibility into request latency patterns without affecting live traffic. Option A is wrong because setting up a separate test environment does not directly help diagnose the current intermittent issue. Option B is wrong because SSHing into instances and running commands can impact production performance and does not provide historical latency data. Option D is wrong because tcpdump generates large packet captures that can degrade performance and requires significant analysis effort.

Answer

Deploy a separate test environment with identical configuration and run load tests

Answer

Enable EC2 detailed monitoring and SSH into each instance to run top and iostat

Answer

Run tcpdump on all EC2 instances and analyze packet captures

Question 10

A company runs a critical application on a fleet of EC2 instances managed by an Auto Scaling group. The application generates logs that are sent to CloudWatch Logs using the CloudWatch agent. Recently, the operations team noticed that some instances are missing logs for certain periods. The CloudWatch agent is configured to batch log events and send them every 5 seconds. The instances have high CPU utilization (90%+) during the missing periods. The DevOps engineer suspects that the agent is being throttled or failing. Which of the following is the MOST likely cause and the BEST course of action?

Accepted Answer

The CloudWatch agent is being starved of CPU resources, causing it to drop logs. Increase the CPU credits or instance size.. When CPU utilization is sustained at 90%+, the CloudWatch agent competes for CPU and can be starved, causing it to drop or delay log batches. The agent buffers events in memory and on disk; under CPU starvation, the buffer may overflow or the agent may fail to flush within the 5-second interval. Increasing CPU credits (for burstable instances) or moving to a larger instance size gives the agent the resources it needs.

Answer

The network bandwidth is saturated, causing log delivery to fail. Increase instance network performance.

Answer

The CloudWatch Logs retention policy is set to 1 day, so older logs are deleted. Increase retention.

Answer

The instances are running out of disk space, preventing log buffering. Add more EBS volume space.

Question 11

A company uses AWS OpsWorks for configuration management. They need to automate the installation of a custom package on all instances in a layer. Which OpsWorks feature should they use?

Accepted Answer

Custom Chef recipes associated with lifecycle events. Custom Chef recipes associated with lifecycle events in AWS OpsWorks allow running Chef recipes automatically on instance lifecycle events such as Setup, Configure, Deploy, Undeploy, and Shutdown. This is the correct feature for automating package installation on all instances in a layer. Option A is incorrect because AWS CodeDeploy AppSpec file is used for CodeDeploy deployments, not OpsWorks. Option B is incorrect because AWS CloudFormation custom resources are used to extend CloudFormation templates, not for OpsWorks automation. Option D is incorrect because AWS Systems Manager Run Command is a separate service for managing instances, not OpsWorks.

Answer

AWS CodeDeploy AppSpec file

Answer

AWS CloudFormation custom resources

Answer

AWS Systems Manager Run Command

Question 12

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda and Amazon API Gateway. The team wants to automate deployment across multiple environments (dev, test, prod) with environment-specific configuration. Which approach should the engineer use?

Accepted Answer

Use the AWS Serverless Application Model (SAM) with CodePipeline, and pass environment parameters as CloudFormation parameter overrides.. AWS SAM is purpose-built for serverless applications and integrates natively with CodePipeline and CodeBuild. SAM templates are transformed into CloudFormation, so environment-specific values (memory, env vars, API stages) can be injected via CloudFormation parameter overrides at deploy time. This gives one template, many environments, with no custom scripting.

Answer

Use CodeBuild to package the Lambda code and then use CloudFormation with parameters for each environment.

Answer

Use CodeDeploy with a deployment configuration that deploys to all environments sequentially.

Answer

Use CodePipeline with separate CodeBuild projects for each environment.

Question 13

A company is using Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, the application experienced a brief downtime because the DNS cache on the application servers still pointed to the old primary. How can a DevOps engineer minimize this downtime?

Accepted Answer

Use an RDS Proxy to manage connections and reduce DNS dependency.. RDS Proxy acts as a connection broker that maintains persistent connections to the database and abstracts the underlying DNS changes during failover. When a failover occurs, RDS Proxy automatically reconnects to the new primary without requiring the application to resolve a new DNS record, thereby eliminating the downtime caused by stale DNS caches. This reduces the application's dependency on DNS resolution and provides faster failover recovery.

Answer

Configure the application to use the Multi-AZ endpoint instead of the primary endpoint.

Answer

Configure application servers to use a hardcoded IP address instead of the RDS endpoint.

Answer

Increase the TTL on the RDS DNS record.

Question 14

A company uses AWS CodePipeline to automate the deployment of a static website hosted on Amazon S3. The pipeline includes a source stage that pulls from a CodeCommit repository and a deploy stage that uses CodeBuild to sync the files to an S3 bucket. The team noticed that the website is not updating after a successful pipeline run. The CodeBuild logs show that the 'aws s3 sync' command completed successfully. However, the website still shows the old content. What is the MOST likely cause?

Accepted Answer

The website is fronted by Amazon CloudFront, which is caching the old content.. The most likely cause is that Amazon CloudFront is caching the old content at edge locations. Even though CodeBuild successfully synced new files to S3, CloudFront continues to serve cached objects until the TTL expires or an invalidation is created. The pipeline must include a CloudFront invalidation step (or use versioned object keys) to force edge locations to fetch the updated content.

Answer

The CodeBuild project does not have permission to write to the S3 bucket.

Answer

The S3 bucket is not configured for static website hosting.

Answer

The S3 bucket policy is blocking public access to the updated objects.

Question 15

A development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?

Accepted Answer

Configure CodeBuild to cache dependencies in an Amazon S3 bucket.. Caching dependencies in an Amazon S3 bucket allows CodeBuild to reuse previously downloaded Maven/Gradle dependencies across builds, eliminating the need to re-download them each time. Since the codebase and dependencies are stable, this directly reduces the build time by avoiding repeated network transfers of large artifact repositories.

Answer

Move the build process to a local developer machine to avoid CodeBuild overhead.

Answer

Reduce the number of unit tests executed in the build phase.

Answer

Increase the compute type of the build environment to a larger instance.

Question 16

A team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment.' The instances are healthy and can connect to the CodeDeploy service. What is the most likely cause?

Accepted Answer

The appspec.yml file or lifecycle event scripts have errors.. The error 'too many individual instances failed deployment' indicates that the deployment failed on the instances themselves, not at the infrastructure level. Since the instances are healthy and can connect to CodeDeploy, the most likely cause is that the appspec.yml file or the lifecycle event scripts (e.g., hooks like BeforeInstall, AfterInstall) contain errors that cause the deployment to fail on each instance. This is a common issue when scripts have syntax errors, missing dependencies, or incorrect paths.

Answer

The Auto Scaling group launch configuration is incorrect.

Answer

The deployment group is not configured with the correct service role.

Answer

The target revision is not accessible from the instances.

Question 17

A company uses AWS Secrets Manager to store database credentials for a legacy application running on an on-premises server. The application retrieves the secret via the AWS SDK. Recently, the database password was rotated in Secrets Manager, but the application continued to use the old password and failed to connect. The application code is correct and uses the latest SDK. The IAM role attached to the server has the secretsmanager:GetSecretValue permission. What is the MOST likely cause?

Accepted Answer

The application is caching the secret and not refreshing it after rotation. The AWS SDK does not automatically re-fetch a secret on every call unless the application explicitly calls GetSecretValue again. Many applications cache the secret in memory (or in a local config) at startup for performance, so after Secrets Manager rotates the credential, the app keeps using the stale value. Since the IAM permission and SDK are correct, the most likely cause is client-side caching without a refresh mechanism.

Answer

The IAM role does not have permission to list secrets

Answer

The application is using the wrong secret ID

Answer

The secret rotation Lambda function is failing

Question 18

A company is using AWS CloudTrail to track API calls. They want to be notified immediately when an IAM user creates a new access key. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic.. To be notified immediately when an IAM user creates a new access key, the most efficient approach is to use Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic. CloudTrail records the 'CreateAccessKey' API call as an event. An EventBridge rule can be configured to match this specific event pattern and send the event to an SNS topic, which can then send notifications via email, SMS, etc. This provides real-time notification without additional services. Option A (CloudWatch Logs with metric filter and alarm) requires sending CloudTrail logs to CloudWatch Logs, which adds latency and complexity; it is not as direct as EventBridge. Option B (AWS Config with Lambda) is not designed for real-time event notification. Option C (EventBridge with Lambda and SES) adds unnecessary Lambda processing since SNS can directly send email when subscribed to the topic.

Answer

Amazon CloudWatch Logs with a metric filter and alarm.

Answer

AWS Config with an AWS Lambda function.

Answer

Amazon CloudWatch Events (Amazon EventBridge) with an AWS Lambda function that sends an email via Amazon SES.

Question 19

A company hosts a static website on Amazon S3 with CloudFront as the CDN. Users report that they see an old version of the website even after the DevOps team updated the S3 objects. The team verified that the new objects are in the S3 bucket and are publicly accessible. The CloudFront distribution has a default TTL of 24 hours. To immediately serve the new content to users, the team needs to invalidate the CloudFront cache. Which of the following is the CORRECT approach to achieve this with minimal impact?

Accepted Answer

Create a CloudFront invalidation request for the path '/*'.. A CloudFront invalidation for the path '/*' tells all edge locations to stop serving cached objects matching that pattern and fetch fresh copies from the S3 origin on the next request. This is the standard, immediate way to purge stale content without changing the distribution configuration or object keys. It has minimal impact because it only affects cached objects and does not require re-uploading or renaming anything.

Answer

Change the CloudFront origin path to point to a new S3 bucket.

Answer

Update the CloudFront distribution's default TTL to 0 and wait for the changes to propagate.

Answer

Delete the S3 objects and re-upload them with different names.

Question 20

A company uses AWS Config to track resource changes. They want to automatically remediate non-compliant security group rules that allow public SSH access. What is the MOST effective approach?

Accepted Answer

Create an AWS Config rule with an automatic remediation action using AWS Systems Manager Automation.. AWS Config can directly associate an AWS Systems Manager Automation document as a remediation action for a non-compliant rule. This approach provides a fully managed, idempotent, and auditable remediation workflow without requiring custom Lambda code or external event orchestration. The automation document can be configured to automatically remove the SSH ingress rule (port 22) from the security group when the Config rule detects non-compliance.

Answer

Set up an AWS Config rule that triggers a Lambda function to remove the SSH rule.

Answer

Use Amazon CloudWatch Events to detect the change and invoke a Lambda function.

Answer

Use AWS Service Catalog to enforce security group templates.