DOP-C02 Practice Exam 57 — 20 Questions

Question 1

A company is using AWS CloudFormation to deploy a multi-tier application. The DevOps team wants to ensure that the database password is not exposed in the template or the console. Which two methods should they use to securely manage the password? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a CloudFormation parameter with the NoEcho property set to true.. Setting the `NoEcho` property to `true` on a CloudFormation parameter masks the password from console outputs and `DescribeStack` calls, preventing exposure in logs or the AWS Management Console. This is a straightforward way to handle sensitive input without external services, though it does not encrypt the value at rest in the template.

Answer

Hardcode the password in the template and use a condition to only apply it in production.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it with {{resolve:ssm:...}}

Answer

Pass the password as user data to the EC2 instance and encrypt the user data.

Question 2

A company is designing a disaster recovery strategy for its application. The application runs on EC2 instances and uses an RDS MySQL database. The RTO is 1 hour, and the RPO is 15 minutes. Which TWO approaches meet these requirements?

Accepted Answer

Use a warm standby strategy: run a scaled-down version of the application in the DR region with RDS Multi-AZ across regions.. Options A and B are correct. A warm standby with RDS Multi-AZ across regions ensures a standby database is ready and can be promoted quickly, meeting the 1-hour RTO. A pilot light with RDS cross-region automated backups provides replication with a 15-minute RPO; a small environment is running, allowing faster failover than a full pilot light. Option C is wrong because RDS read replicas do not support automatic failover; manual promotion can take longer than 1 hour. Option D is wrong because Multi-AZ in the same region does not protect against region failure. Option E is wrong because hourly snapshots meet RPO but restoring from snapshots typically exceeds the 1-hour RTO.

Answer

Use a read replica in the DR region and promote it on failover.

Answer

Use a Multi-Zone deployment with RDS in the same region.

Answer

Use a backup and restore strategy: take snapshots every hour and restore in the DR region on failover.

Question 3

A company runs a microservices architecture on Amazon ECS with Fargate. Each service is deployed in its own ECS service. The company wants to ensure that if one Availability Zone (AZ) fails, the services can continue to operate with minimal impact. What is the MOST resilient task placement strategy?

Accepted Answer

Use a task placement strategy that spreads tasks across Availability Zones.. The 'spread across Availability Zones' strategy explicitly distributes ECS tasks across multiple AZs, ensuring that if one AZ fails, the remaining AZs continue to run the service. This is the most resilient approach for Fargate tasks, as it leverages the AZ isolation provided by AWS to minimize the blast radius of a single-AZ failure.

Answer

Use a task placement constraint to run tasks on distinct instances.

Answer

Use a task placement strategy that uses the random algorithm.

Answer

Use a task placement strategy that uses the binpack algorithm to maximize resource utilization.

Question 4

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a large backlog of messages, and the Lambda function is processing them slowly. The DevOps team wants to increase throughput without making changes to the Lambda code. The team decides to increase the reserved concurrency to 10. However, after the change, the Lambda function starts to experience throttling errors (RateExceeded). The team also notices that other Lambda functions in the same account are also being throttled. What is the MOST likely cause?

Accepted Answer

The account's Lambda concurrency limit has been reached due to the increased reserved concurrency.. Lambda concurrency is governed by an account-level limit (default 1,000) shared across all functions in a region. Reserved concurrency carves out a guaranteed slice for a function and subtracts from the unreserved pool available to other functions. Raising the reserved concurrency from 5 to 10 consumes more of the account pool, and if the account is already near its limit, other functions get throttled with RateExceeded errors.

Answer

The SQS queue's polling interval is too high, causing Lambda to poll infrequently.

Answer

The Lambda function's execution role does not have permission to invoke the function.

Answer

The SQS queue's visibility timeout is too short, causing messages to be processed multiple times.

Question 5

A company has an AWS Lambda function that processes S3 events. The function is invoked multiple times for the same S3 object, causing duplicate processing. The engineer suspects the issue is related to retries from the S3 event notification or Lambda's built-in retry behavior. What is the MOST effective way to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store a record of processed S3 object keys and check for existence before processing.. Storing processed S3 object keys in a DynamoDB table and checking for existence before processing ensures idempotency at the application level. This approach directly handles duplicate invocations caused by S3 event retries or Lambda's built-in retry behavior, as the function can conditionally skip processing if the key already exists in DynamoDB. It provides a durable, consistent, and scalable mechanism to prevent duplicate processing regardless of how many times the function is invoked for the same object.

Answer

Modify the S3 bucket event notification configuration to use a prefix filter that excludes duplicate objects.

Answer

Set the Lambda function's ReservedConcurrency to 1 to prevent concurrent executions.

Answer

Use an Amazon SQS FIFO queue as the event source and enable content-based deduplication.

Question 6

A company is running a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The DevOps team wants to monitor HTTP 5xx errors and receive alerts when the error rate exceeds 5% over a 5-minute period. Which combination of services and configurations should be used to meet these requirements?

Accepted Answer

Use CloudWatch ALB metrics (HTTPCode_ELB_5XX_Count) and create a CloudWatch Alarm on the Sum statistic with a threshold based on total request count.. ALB automatically publishes the `HTTPCode_ELB_5XX_Count` metric to CloudWatch, and you can create a CloudWatch alarm using the `Sum` statistic over a 5-minute period. To detect when the error rate exceeds 5%, you need to combine this metric with the `RequestCount` metric in a math expression (e.g., `m1/m2*100 > 5`) or use a composite alarm, as the alarm threshold must be based on the ratio of 5xx errors to total requests, not just the raw count.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query 5xx logs, then create a metric filter and alarm.

Answer

Configure AWS Config rules to check ALB 5xx error counts and trigger alarms.

Answer

Use AWS X-Ray to trace requests and create a CloudWatch alarm based on X-Ray error rate.

Question 7

A company uses AWS Organizations with multiple accounts. The security team notices that an IAM user in the production account has been making changes to security group rules that are not compliant with the company's policy. The team wants to automatically revoke any non-compliant security group rules and notify the security team. What is the MOST efficient way to achieve this?

Accepted Answer

Use an AWS Config managed rule to detect non-compliant security group rules, and configure an automatic remediation action with AWS Systems Manager Automation.. AWS Config managed rules can continuously evaluate security group rules against a desired policy (e.g., disallowing SSH from 0.0.0.0/0). When a non-compliant change is detected, AWS Config can trigger an automatic remediation action using an AWS Systems Manager Automation document that revokes the offending rule. This provides both detection and automated correction without manual intervention, making it the most efficient solution.

Answer

Create a CloudWatch alarm on the SecurityGroupEvent metric to notify the security team.

Answer

Apply a Service Control Policy (SCP) that denies changes to security groups in the production account.

Answer

Set up a CloudTrail trail that logs security group modifications and use Amazon Detective to analyze the changes.

Question 8

A development team uses AWS CodeCommit as a source control repository. A developer accidentally pushed a commit that contains sensitive information (e.g., AWS access keys) to the main branch. The team wants to remove the sensitive data from the repository history completely. Which action should the engineer take?

Accepted Answer

Use 'git filter-branch' to rewrite the repository history and remove the sensitive file. 'git filter-branch' (or the modern 'git filter-repo') rewrites the repository history by removing or replacing the sensitive file in every commit, effectively purging it from the entire Git history. This is the only native Git method that completely eliminates the sensitive data from all past commits, preventing anyone from retrieving it via 'git log' or by cloning the repository. After rewriting history, a force push to the remote CodeCommit repository is required to overwrite the remote branches.

Answer

Delete the repository and create a new one, then force push the remaining branches

Answer

Use 'git revert' to create a new commit that undoes the changes

Answer

Create a new branch from the commit before the sensitive data was added and merge it to main

Question 9

A company uses Amazon CloudWatch for monitoring. The operations team wants to receive an alert when an EC2 instance's status check fails for 2 consecutive minutes. Which THREE resources should the team configure? (Choose three.)

Accepted Answer

CloudWatch alarm. To alert when an EC2 instance's status check fails for 2 consecutive minutes, you need to create a CloudWatch alarm on the StatusCheckFailed metric (options C and D). The alarm needs to send notifications via an SNS topic (option E). Option A (CloudWatch Events rule) is not used for metric-based alerts; CloudWatch Events triggers on events or schedules, not metric thresholds. Option B (CloudWatch Logs) is for log data, not metrics.

Answer

CloudWatch Events rule

Answer

CloudWatch Logs

Question 10

A DevOps team is using AWS CodeBuild to run integration tests against a test database. The database is an Amazon RDS instance in a private subnet. The CodeBuild project is configured to run in a VPC. Which THREE steps are required to allow CodeBuild to access the RDS instance?

Accepted Answer

Ensure the security group attached to the RDS instance allows inbound traffic from the CodeBuild security group.. The security group attached to the RDS instance must explicitly allow inbound traffic from the security group associated with the CodeBuild project's elastic network interfaces. This is a fundamental network access control in AWS: security groups act as virtual firewalls, and without an inbound rule permitting traffic from the CodeBuild security group on the database port (e.g., 3306 for MySQL), the connection will be blocked regardless of other network configurations.

Answer

Place the RDS instance in a public subnet with a public IP.

Answer

Attach a NAT gateway to the VPC so that CodeBuild can route to RDS.

Question 11

An organization uses AWS CloudFormation to manage infrastructure across multiple accounts using AWS Organizations. They want to enforce that all S3 buckets are encrypted with SSE-S3. A DevOps engineer creates a service control policy (SCP) to deny the creation of any S3 bucket without encryption. However, CloudFormation stack creation fails with an access denied error even when the template includes encryption. What is the most likely cause?

Accepted Answer

The CloudFormation template specifies SSE-KMS encryption, which is not allowed by the SCP.. The SCP denies the creation of S3 buckets without encryption, but it specifically allows only SSE-S3 encryption. If the CloudFormation template specifies SSE-KMS encryption, the SCP will deny the request, causing an access denied error—even though encryption is present. This mismatch between the encryption type required by the SCP (SSE-S3) and what the template requests (SSE-KMS) is the most likely cause of the failure.

Answer

The SCP is denying the s3:PutBucketPublicAccessBlock action, which is required for all bucket creation requests.

Answer

The SCP is incorrectly scoped to the management account instead of the member accounts.

Answer

The CloudFormation service role does not have permissions to create buckets in the target account.

Question 12

A DevOps engineer applies this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All objects uploaded must use server-side encryption with Amazon S3 managed keys (SSE-S3).. The S3 bucket policy in question denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which is the value for SSE-S3 (Amazon S3 managed keys). This ensures that all objects uploaded to the bucket must be encrypted using server-side encryption with S3-managed keys (SSE-S3). Option C correctly identifies this requirement.

Answer

All objects uploaded must be encrypted with SSE-C.

Answer

All uploads to the bucket are blocked.

Answer

All objects uploaded must be encrypted with SSE-KMS.

Question 13

Refer to the exhibit. A DevOps engineer runs the command to get the pipeline definition. The pipeline has a source stage from an S3 bucket and a build stage with CodeBuild. The CodeBuild project is configured to output artifacts to a specific S3 bucket. However, the pipeline fails at the build stage with an error: 'Artifact 'BuildArtifact' is not found'. What is the most likely cause?

Accepted Answer

The CodeBuild project is not configured to output the expected artifact named 'BuildArtifact'.. The error 'Artifact 'BuildArtifact' is not found' indicates that CodePipeline expects an artifact named 'BuildArtifact' from the CodeBuild project, but the project's output artifact configuration does not include that name. In CodePipeline, the build stage must produce an artifact with the exact name specified in the pipeline definition; if the CodeBuild project's artifacts section (in buildspec.yml or console) omits or misnames it, the pipeline fails at that stage.

Answer

The source stage is using CodeCommit instead of S3.

Answer

The source artifact is not being passed to the build stage.

Answer

The IAM role for CodePipeline does not have permissions to read from the S3 bucket.

Question 14

Refer to the exhibit. A DevOps engineer created a CloudFormation stack that includes a Lambda function. The stack creation failed and rolled back. The error message for the Lambda function says 'Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack rollback was triggered due to a failure in another resource, and the Lambda creation was cancelled.. CloudFormation creates resources in a specific order, and if a dependency fails or another resource fails, CloudFormation cancels the creation of subsequent resources and initiates a rollback. The error 'Resource creation cancelled' indicates that the Lambda function was never actually attempted to be created; instead, its creation was aborted due to a failure in a preceding or parallel resource. This is a standard CloudFormation behavior when a stack operation is interrupted by a failure in another resource.

Answer

The Lambda function's IAM role does not have sufficient permissions.

Answer

The Lambda function's code is missing from the S3 bucket.

Answer

The Lambda function creation timed out.

Question 15

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must be resilient to sudden spikes in traffic without manual intervention. Which combination of services should be used?

Accepted Answer

API Gateway with throttling, Lambda with reserved concurrency, and DynamoDB auto scaling.. It combines API Gateway throttling to absorb traffic spikes by queuing or rejecting excess requests, Lambda reserved concurrency to guarantee execution capacity for the function, and DynamoDB auto scaling to adjust read/write capacity based on demand. This triad ensures the application remains available and responsive under sudden load without manual intervention.

Answer

API Gateway with usage plans, Lambda with provisioned concurrency, and DynamoDB on-demand.

Answer

API Gateway with WAF, Lambda with function URLs, and DynamoDB Accelerator (DAX).

Answer

API Gateway with caching, Lambda with no concurrency limits, and DynamoDB global tables.

Question 16

A DevOps engineer is designing a CI/CD pipeline that deploys to production. The security team mandates that all code changes must be reviewed and signed off by two senior developers before deployment. How can this be enforced?

Accepted Answer

Set up a pull request approval rule in CodeCommit requiring two approvals.. CodeCommit's pull request approval rules allow you to require a specific number of approvals before a pull request can be merged. By configuring an approval rule template that requires two approvals from senior developers, you enforce the mandatory code review and sign-off before any change is merged into the production branch, which then triggers the CI/CD pipeline.

Answer

Use CloudWatch Events to trigger a manual approval step in CodePipeline.

Answer

Restrict push access to the production branch to only the two senior developers.

Answer

Use AWS Lambda to send a notification when a change is pushed.

Question 17

A DevOps engineer is troubleshooting a production AWS Lambda function that occasionally times out. The function has a timeout of 30 seconds and uses a synchronous invocation. The engineer wants to capture invocation logs to identify the cause. Which approach will provide the MOST detailed diagnostic information?

Accepted Answer

Enable AWS X-Ray tracing on the Lambda function.. AWS X-Ray provides end-to-end tracing for Lambda functions, capturing detailed timing information for each invocation, including subsegments for downstream calls, function initialization, and execution phases. This allows the engineer to pinpoint exactly where time is being spent, which is essential for diagnosing intermittent timeouts in synchronous invocations.

Answer

Enable AWS CloudTrail data events for Lambda.

Answer

Create a CloudWatch dashboard with function duration metrics.

Answer

Add more logging statements to the function code and check CloudWatch Logs.

Question 18

A DevOps engineer wants to monitor the health of an Auto Scaling group and receive notifications when instances are launched or terminated. Which TWO AWS services can be used together to achieve this?

Accepted Answer

Amazon EventBridge.. Amazon EventBridge (option C) is correct because it can capture Auto Scaling group state-change events such as EC2 Instance Launch Successful and EC2 Instance Terminate Successful, and route them to a target for notification. Amazon SNS (option D) is correct because it serves as the notification target, delivering email, SMS, or HTTP messages to subscribers when EventBridge matches those Auto Scaling events. Together, EventBridge detects the launch/termination events and SNS publishes the alerts, which is exactly the monitoring-and-notification pattern requested. AWS CloudTrail (A) only records API activity for auditing and does not natively push notifications, AWS Config (B) evaluates resource compliance and configuration history rather than real-time launch/terminate alerts, and AWS Lambda (E) is a compute target that could process events but is not itself a notification service.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Lambda.

Question 19

A company's application runs on Amazon EC2 instances in an Auto Scaling group. The application writes logs to local instance storage. The operations team needs to ensure logs are not lost during instance termination or scaling events. What should be done?

Accepted Answer

Install the CloudWatch Logs agent on each instance and stream logs to CloudWatch Logs.. The CloudWatch Logs agent streams log data in near real-time to Amazon CloudWatch Logs, ensuring logs are persisted independently of the EC2 instance lifecycle. This decouples log storage from ephemeral instance store volumes, so logs are not lost during Auto Scaling termination or scaling events. The agent handles log rotation, compression, and encryption in transit, providing a durable and centralized log solution.

Answer

Increase the size of the instance store volumes.

Answer

Use an Amazon EFS file system and mount it to each instance for log storage.

Answer

Configure the Auto Scaling group to terminate instances after logs are copied to S3.

Question 20

A DevOps engineer is investigating a security incident where an EC2 instance was used to launch an outbound DDoS attack. Which AWS service can provide details about the source IP addresses and network traffic from the instance?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata for network interfaces in a VPC, including source and destination IP addresses, ports, protocol, and accept/reject status. For an EC2 instance launching an outbound DDoS attack, flow logs provide the source IPs and traffic patterns needed to identify the attack destinations and volume. This is the service designed for network-level traffic visibility.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config