DOP-C02 Practice Exam 56 — 20 Questions

Question 1

An organization uses AWS CodePipeline to deploy a web application to Amazon EC2 instances behind an Application Load Balancer. The deployment uses a CodeDeploy action with an in-place deployment configuration. After a recent deployment, some instances are running the old version while others are running the new version. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The deployment group was configured with the 'AllAtOnce' deployment configuration, and the deployment failed partway through.. B is correct because the 'AllAtOnce' deployment configuration instructs CodeDeploy to deploy to all instances simultaneously. If the deployment fails partway through, some instances may have received the new version while others remain on the old version, resulting in a mixed state. This is the most likely cause given the symptom of a split between old and new versions across instances.

Answer

The deployment group is associated with an Auto Scaling group that launched new instances during the deployment.

Answer

A lifecycle hook is configured to pause the deployment until manual approval.

Answer

The deployment was configured to use a blue/green strategy, but the target group is misconfigured.

Question 2

An organization uses AWS System Manager Patch Manager to patch EC2 instances. The patches are not being applied to some instances. The instances are running Amazon Linux 2 and have the SSM Agent installed. What is the MOST likely reason for the failure?

Accepted Answer

The instances are missing the required IAM role for Systems Manager.. Instances must have an IAM role that grants Systems Manager permissions to manage patches. Without this role, the SSM Agent cannot communicate with the Systems Manager service, preventing patch application. Option A is incorrect because instances can use VPC endpoints (e.g., AWS PrivateLink) to reach Systems Manager without internet access. Option B is incorrect: although an out-of-date SSM Agent can cause issues, the agent auto-updates by default, and the most common cause for patch failures is missing IAM permissions, not an outdated agent. Option D is incorrect because Amazon Linux 2 is a fully supported operating system for Patch Manager.

Answer

The instances do not have internet access to reach the Systems Manager endpoint.

Answer

The SSM Agent is out of date and needs to be updated.

Answer

The instances are not running a supported operating system.

Question 3

Drag and drop the steps to troubleshoot a failed deployment in AWS CodeDeploy into the correct order.

Accepted Answer

Check CodeDeploy Console → Review Agent Logs → Validate AppSpec File → Verify Instance Configuration → Redeploy. Troubleshooting starts with console, then agent logs, then AppSpec, then instance configuration, then redeploy.

Answer

Review Agent Logs → Check CodeDeploy Console → Validate AppSpec File → Verify Instance Configuration → Redeploy

Answer

Validate AppSpec File → Check CodeDeploy Console → Review Agent Logs → Verify Instance Configuration → Redeploy

Answer

Redeploy → Check CodeDeploy Console → Review Agent Logs → Validate AppSpec File → Verify Instance Configuration

Question 4

A company wants to ensure that its Amazon S3 bucket can withstand the loss of an entire AWS Availability Zone. Which configuration meets this requirement?

Accepted Answer

Use the S3 Standard storage class.. S3 Standard storage class automatically replicates data across at least three Availability Zones within an AWS Region, ensuring resilience against the loss of an entire AZ. Option B is incorrect because cross-Region replication replicates data to a different AWS Region, which provides geographic resilience but not specifically AZ resilience within the same Region. Option C is incorrect because S3 Versioning helps protect against accidental deletion or overwrite by preserving previous versions, but it does not provide data replication across AZs. Option D is incorrect because S3 One Zone-IA stores data in a single AZ, which would not withstand the loss of that AZ.

Answer

Configure cross-Region replication to another bucket.

Answer

Enable S3 Versioning on the bucket.

Answer

Use the S3 One Zone-IA storage class.

Question 5

A company runs a critical application on Amazon EKS. The DevOps team uses Prometheus for monitoring and Grafana for visualization. The team has set up a Prometheus server on an EC2 instance to scrape metrics from the EKS cluster. However, they are experiencing high memory usage on the Prometheus server, and some metrics are being dropped because of the retention period. The team wants to implement a scalable and managed monitoring solution that can store metrics for longer durations without the operational overhead of managing the Prometheus server. The team also wants to retain the ability to use PromQL queries and Grafana dashboards. What should the team do?

Accepted Answer

Migrate to Amazon Managed Service for Prometheus to ingest and store metrics, and use Amazon Managed Grafana for visualization.. Amazon Managed Service for Prometheus is a scalable, fully managed service that ingests and stores Prometheus metrics, supports PromQL queries, and integrates seamlessly with Amazon Managed Grafana. This eliminates the operational overhead of managing a Prometheus server while enabling longer retention and scaling. Option A is incorrect because Amazon Managed Grafana is a visualization tool only; it does not store metrics. Option C is incorrect because increasing the EC2 instance size does not address the operational overhead or scalability issues; it only postpones the problem. Option D is incorrect because Amazon CloudWatch Container Insights does not support PromQL natively, and migrating to CloudWatch would require rewriting queries and dashboards, losing compatibility with existing Prometheus and Grafana setups.

Answer

Use Amazon Managed Grafana to visualize metrics directly from the EKS cluster without a Prometheus server.

Answer

Increase the EC2 instance size for the Prometheus server and extend the retention period.

Answer

Set up Amazon CloudWatch Container Insights to collect metrics from the EKS cluster and store them in CloudWatch Logs.

Question 6

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. To ensure high availability, the instances are deployed across three Availability Zones. Which additional step should the company take to protect against a regional failure?

Accepted Answer

Deploy the application in a second AWS Region and use Route 53 with failover routing.. Deploying the application in a second AWS Region and using Route 53 failover routing provides protection against a regional failure, because the application remains available even if an entire AWS Region becomes unavailable. Route 53 health checks detect the failure and automatically redirect traffic to the standby Region. This is the only option that addresses regional-level disasters.

Answer

Place all instances in a single Availability Zone to simplify management.

Answer

Use EC2 Dedicated Hosts to ensure capacity.

Answer

Increase the minimum size of the Auto Scaling group to 10 instances.

Question 7

A DevOps engineer needs to monitor the memory utilization of an Amazon EC2 instance running a critical application. Which AWS service should be used to collect and track this metric?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the correct service for monitoring memory utilization of EC2 instances. CloudWatch can collect custom metrics like memory utilization via the CloudWatch Agent. AWS CloudTrail (A) records API calls, not memory metrics. AWS X-Ray (B) traces application requests, not system metrics. AWS Config (C) records resource configuration changes, not utilization metrics.

Answer

AWS CloudTrail

Answer

AWS X-Ray

Answer

AWS Config

Question 8

A company has a multi-account AWS environment using AWS Organizations. The security team has implemented a service control policy (SCP) that denies the creation of IAM users and roles with full admin access. The SCP is attached to all accounts. However, a DevOps engineer in a member account reports that they are able to create an IAM role with an administrator access policy attached. The engineer uses the AWS Management Console to create the role. The SCP is confirmed to be in place. What is the most likely reason the SCP is not preventing the role creation?

Accepted Answer

The SCP only denies iam:CreateUser, but the engineer is creating a role (iam:CreateRole).. The SCP in question denies only the iam:CreateUser action, but the engineer is creating an IAM role, which requires the iam:CreateRole action. SCPs provide an explicit deny for actions they list; they do not block actions they do not list. Since the SCP does not deny iam:CreateRole, the engineer's IAM policy (which allows iam:CreateRole) is effective. SCPs are inherited by member accounts and, when correctly attached, cannot be overridden by IAM policies; however, they only apply to the actions they explicitly specify.

Answer

SCPs are not inherited by member accounts from the root.

Answer

The SCP is not attached to the member account's root organizational unit.

Answer

The engineer's IAM policy allows iam:CreateRole and overrides the SCP.

Question 9

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The operations team wants to analyze application access logs and error rates. They need to identify the top IP addresses making requests, as well as the distribution of HTTP status codes over time. Which THREE steps should the team take to achieve this? (Select THREE.)

Accepted Answer

Enable access logs on the Application Load Balancer and store them in an Amazon S3 bucket.. Enabling access logs on the Application Load Balancer and storing them in an S3 bucket captures detailed HTTP request data, including client IPs, request paths, and HTTP status codes. This raw log data is essential for analyzing top IP addresses and status code distributions over time.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Enable VPC Flow Logs to capture IP traffic data.

Question 10

A company runs a critical application on AWS using Amazon EC2 instances in an Auto Scaling group, an Application Load Balancer (ALB), and an Amazon RDS for PostgreSQL Multi-AZ DB cluster. The application must maintain an RTO of 5 minutes and an RPO of 1 second for database transactions. The current setup meets these requirements, but the DevOps team wants to improve the resilience of the application tier to withstand a regional failure. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Replace the RDS Multi-AZ cluster with Amazon Aurora Global Database to replicate data across regions.. Amazon Aurora Global Database is the correct choice because it provides cross-region replication with a typical RPO of 1 second and RTO of 1 minute, meeting the stated requirements. Unlike standard RDS Multi-AZ, which is limited to a single region, Aurora Global Database replicates data asynchronously across multiple regions with minimal lag, ensuring the database tier can survive a regional failure while maintaining the required RPO of 1 second.

Answer

Use Amazon EFS Replication to replicate application data across regions with a recovery point objective (RPO) of 1 second.

Answer

Extend the existing Auto Scaling group to launch instances in two regions by specifying a second region in the launch template.

Question 11

A company uses AWS CloudFormation to manage infrastructure. The team wants to ensure that all stack updates are reviewed and approved before execution. Which mechanism should the team implement?

Accepted Answer

Use AWS CloudFormation change sets to review the proposed changes before executing the update.. AWS CloudFormation change sets allow you to preview how proposed changes to a stack will be applied before you execute them. This includes a summary of additions, modifications, and deletions of resources, enabling you to review and approve the changes in a controlled manner. By generating a change set, the team can ensure that no update is executed without prior review and approval, meeting the requirement for a gated deployment process.

Answer

Create a stack policy that denies all updates unless approved.

Answer

Use AWS CloudFormation drift detection to identify changes before updating.

Answer

Enable termination protection on the stack to prevent accidental updates.

Question 12

A company uses Amazon RDS for PostgreSQL and wants to monitor database performance metrics such as CPU utilization, memory, and disk I/O. Which AWS service should be used to set up custom dashboards and alarms for these metrics?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (Option D) is the correct service for monitoring Amazon RDS performance metrics such as CPU utilization, memory, and disk I/O. CloudWatch provides built-in metrics for RDS, allows creation of custom dashboards to visualize these metrics, and supports setting alarms for proactive notifications. Option A (AWS X-Ray) is used for tracing and analyzing requests through applications, not for infrastructure metrics. Option B (Amazon VPC Flow Logs) captures IP traffic information for network troubleshooting, not database performance. Option C (AWS CloudTrail) logs API calls for auditing, not performance monitoring. Therefore, CloudWatch is the appropriate choice for this use case.

Answer

AWS X-Ray

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail

Question 13

A company wants to monitor the number of messages in an Amazon SQS queue and send an alert if the queue depth exceeds 1000 for more than 5 minutes. Which AWS service should be used to create the alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service because it can monitor SQS queue metrics (such as ApproximateNumberOfMessagesVisible) and trigger an alarm when the metric exceeds a threshold (e.g., 1000) for a specified evaluation period (e.g., 5 minutes). CloudWatch Alarms directly integrate with SQS via the AWS/SQS namespace and support actions like sending notifications through Amazon SNS.

Answer

Amazon EventBridge

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Question 14

A company has an AWS Lambda function that processes sensitive data. The function needs to access an RDS database with credentials stored in Secrets Manager. What is the MOST secure way to grant the Lambda function access to the secret?

Accepted Answer

Attach an IAM role to the Lambda function with permissions to read the secret and retrieve it at runtime.. Attaching an IAM role to the Lambda function and granting it secretsmanager:GetSecretValue for the specific secret is the AWS-native, most secure pattern. The Lambda execution role provides temporary, automatically rotated credentials via STS, and the secret is fetched at runtime so it is never stored in code, environment variables, or configuration. This also enables CloudTrail auditing of every secret access.

Answer

Use AWS KMS to encrypt the credentials and pass them as parameters.

Answer

Store the credentials directly in the Lambda function's environment variables.

Answer

Use Lambda environment variables with encryption enabled.

Question 15

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have encryption enabled. They need a preventive control that applies to all current and future accounts. Which approach should they use?

Accepted Answer

Use a service control policy (SCP) in the Organizations root to deny PutBucketEncryption actions when encryption settings do not include AES256 or aws:kms.. A service control policy (SCP) applied at the Organizations root can deny the creation or modification of S3 buckets that do not have encryption enabled, specifically requiring AES256 or aws:kms. This is a preventive control that applies to all current and future accounts in the organization, as SCPs are inherited by all accounts and cannot be overridden by IAM policies within those accounts.

Answer

Use AWS Config rules to detect unencrypted buckets and automatically apply encryption using a remediation action.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts when non-compliant buckets are created.

Answer

Create an IAM policy in each account that denies PutBucketEncryption unless encryption is enabled.

Question 16

A company uses AWS CloudFormation to deploy infrastructure. They want to enforce mandatory tags on all resources created by CloudFormation. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use CloudFormation stack tags that propagate to all resources in the stack.. CloudFormation stack tags propagate to all resources that support tagging within the stack. When you specify tags at the stack level, CloudFormation automatically applies them to each resource it creates, ensuring mandatory tags are enforced without additional configuration.

Answer

Create an AWS Config rule to automatically tag resources after creation.

Answer

Add an IAM policy that denies cloudformation:CreateStack unless the template includes the required tags.

Answer

Enable AWS CloudTrail to log all API calls and monitor for untagged resources.

Question 17

A DevOps engineer is setting up an incident response system for a critical application. The engineer needs to ensure that notifications are sent to the appropriate team when specific CloudWatch alarms trigger. Which TWO services can be used to trigger notifications based on CloudWatch alarms? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is correct because CloudWatch alarm actions natively support publishing to an SNS topic, which then fans out notifications via email, SMS, or HTTP/S endpoints to the appropriate team. AWS Chatbot is correct because it integrates with SNS topics and CloudWatch alarms to deliver formatted notifications directly into team chat channels such as Slack or Amazon Chime. AWS Systems Manager is not a notification service; it handles operational tasks like patching and automation, not alarm-driven alerts. Amazon SQS is a message queue that can receive alarm actions but does not itself send notifications to people. AWS Lambda can be invoked by an alarm but is a compute service that must be coded to send notifications, so it is not a notification service by itself.

Answer

AWS Systems Manager

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Question 18

A team wants to automatically deploy a new version of a Lambda function when code is pushed to a CodeCommit repository. Which AWS service should orchestrate this workflow?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the entire release process, including source code changes from CodeCommit, building with CodeBuild, and deploying to Lambda. It can automatically trigger a pipeline execution when a new commit is pushed to a CodeCommit repository, enabling automated deployment of the Lambda function.

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Question 19

A company uses AWS Systems Manager Automation to patch EC2 instances. The automation document 'AWS-RunPatchBaseline' runs successfully but some instances are not patched because they are not managed by Systems Manager. What is the most likely reason?

Accepted Answer

The instances do not have the AWS Systems Manager Agent (SSM Agent) installed and the required IAM role attached.. Systems Manager Automation can only patch instances that are managed by Systems Manager. For an instance to be managed, it must have the SSM Agent installed and running, and it must have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) to communicate with the Systems Manager service. Without these prerequisites, the instance is not registered as a managed node, so the automation document cannot target or patch it.

Answer

The instances are running Windows Server 2012 or older.

Answer

The instances are in a VPC without internet access.

Answer

The automation document is not compatible with the instance's operating system.

Question 20

A company uses AWS CodeDeploy for deploying applications to an Auto Scaling group of Amazon EC2 instances. The deployment is failing with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which two actions should the DevOps engineer take to troubleshoot and resolve the issue? (Choose two.)

Accepted Answer

Check the CodeDeploy agent logs on the failed instances to identify script errors or missing dependencies.. The CodeDeploy agent logs on each EC2 instance contain detailed error messages about script failures, missing dependencies, or permission issues that cause the deployment to fail. Checking these logs is the first step in diagnosing why individual instances are failing, as the agent executes the AppSpec lifecycle hooks and reports back to the CodeDeploy service.

Answer

Increase the size of the Auto Scaling group to ensure more instances are available.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce' to bypass the error.

Answer

Redeploy the application using a different revision.