DOP-C02 Practice Exam 59 — 20 Questions

Question 1

A DevOps engineer is responsible for managing infrastructure as code for multiple microservices. The team uses AWS CloudFormation and wants to reuse common resource definitions across multiple stacks. Which approach should the engineer use to promote reusability and reduce code duplication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Develop CloudFormation modules that encapsulate common resource configurations and publish them in a registry.. AWS CloudFormation modules allow you to encapsulate common resource configurations into reusable, versioned components that can be published in the CloudFormation registry. This promotes reusability and reduces code duplication across multiple stacks without the overhead of managing nested stack templates or manual copying.

Answer

Create nested stacks that include the common resources and pass parameters as needed.

Answer

Store the common resource definitions in an AWS CodeCommit repository and copy them into each template.

Answer

Use cross-stack references by exporting outputs from a central stack and importing them in other stacks.

Question 2

A company is designing a multi-Region disaster recovery strategy for a stateless web application. The application runs on EC2 instances in an Auto Scaling group behind an ALB in us-east-1. The recovery point objective (RPO) is 15 minutes and recovery time objective (RTO) is 30 minutes. The application data is stored in Amazon RDS for PostgreSQL. Which combination of actions should the company take to meet the RPO and RTO?

Accepted Answer

Use RDS cross-Region replication to a standby DB instance in another Region. Maintain a warm standby environment (Auto Scaling group, ALB) in the disaster Region. Configure Route 53 health checks to fail over automatically.. It meets both the 15-minute RPO and 30-minute RTO. RDS cross-Region replication provides continuous asynchronous replication with minimal lag, typically well under 15 minutes, ensuring data is nearly up-to-date. The warm standby environment (pre-provisioned Auto Scaling group and ALB) in the disaster Region allows automatic failover via Route 53 health checks, enabling recovery within the 30-minute RTO without manual intervention.

Answer

Use RDS cross-Region snapshot copy every 15 minutes. In the disaster Region, manually launch a new environment and restore the latest snapshot.

Answer

Use RDS Multi-AZ in us-east-1. In the disaster Region, keep a standby Auto Scaling group and ALB. On failure, promote the Multi-AZ standby to primary and update DNS.

Answer

Use RDS read replicas in another Region. On failure, promote the read replica to a standalone instance and update the application.

Question 3

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to download an object from the S3 bucket 'example-bucket' from an IP address of 10.1.2.3. What will happen?

Accepted Answer

The request is allowed because the condition matches the IP address.. The IAM policy includes a condition that allows s3:GetObject only if the request originates from an IP address within the 10.0.0.0/8 range. The user's IP 10.1.2.3 falls within this range, so the condition is satisfied and the action is allowed. Option A is wrong because a Deny statement is not required; an explicit Allow with a condition is sufficient. Option B is wrong because the policy does explicitly allow the action when the condition is met. Option C is wrong because the bucket policy is not specified and the IAM policy already grants permission; the result does not depend on the bucket policy unless it explicitly denies, but no such policy is shown.

Answer

The request is denied because the policy does not include a Deny statement.

Answer

The request is denied because the policy does not explicitly allow the action.

Answer

The result depends on the bucket policy.

Question 4

Refer to the exhibit. An IAM policy is attached to a CodeBuild service role. The CodeBuild project is used to build code from a CodeCommit repository and output artifacts to an S3 bucket. However, the build fails with an error: 'Unable to download source from CodeCommit'. What is the missing permission?

Accepted Answer

Permissions to read from the CodeCommit repository.. The error 'Unable to download source from CodeCommit' indicates that the CodeBuild service role lacks the necessary permissions to read the source code from the CodeCommit repository. CodeBuild uses the service role to interact with CodeCommit via Git, which requires the `codecommit:GitPull` action (or broader read permissions like `codecommit:Get*` and `codecommit:List*`). Without these permissions, the build process cannot clone or fetch the source code, causing the failure.

Answer

Permissions to create CloudWatch Logs for build output.

Answer

Permissions to decrypt the KMS key used to encrypt artifacts.

Answer

Permissions to write to the S3 artifact bucket.

Question 5

Refer to the exhibit. A CodePipeline deployment fails at the CloudFormation stage. The Lambda function creation is cancelled. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role lacks permissions to create ENIs.. When a Lambda function is configured in a VPC, the Lambda service must create an Elastic Network Interface (ENI) in the VPC on behalf of the function. The function's execution role must have permissions for ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface. Without these permissions, the Lambda service cannot create the ENI, and the Lambda function creation fails. A missing NAT gateway or VPC endpoints only affects internet access for the running function, not the creation process. Therefore, Option C is the correct answer.

Answer

The buildspec.yml file contains an invalid command.

Answer

The Lambda function is configured in a VPC without a NAT gateway or VPC endpoints, causing deployment timeout.

Answer

The CodeCommit branch is not configured correctly in the pipeline.

Question 6

A DevOps engineer creates a CloudFormation stack with the above template. After creation, they want to update the Lambda function code by uploading a new zip file to the S3 bucket and updating the S3Key property. However, the stack update fails because the Lambda function is published as a version and the alias points to that version. What is the most likely reason for the update failure?

Accepted Answer

The AWS::Lambda::Version resource is immutable and cannot be updated.. The AWS::Lambda::Version resource is immutable by design; once created, it cannot be updated or replaced. When a CloudFormation stack includes a Lambda version and an alias pointing to that version, any attempt to update the function code (e.g., by changing the S3Key property) triggers an update to the AWS::Lambda::Version resource, which CloudFormation cannot perform because versions are immutable. This causes the stack update to fail.

Answer

The alias must be deleted before updating the function code.

Answer

The IAM role does not have permission to update the function.

Answer

The function code cannot be updated because the S3 bucket is in a different region.

Question 7

A DevOps engineer is troubleshooting a CloudFormation stack that is in UPDATE_ROLLBACK_FAILED state. The stack attempted to update an Auto Scaling group but failed due to insufficient capacity in the Availability Zone. What is the recommended next step?

Accepted Answer

Use the ContinueUpdateRollback operation to skip the resources that failed. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended next step is to use the ContinueUpdateRollback operation with the 'ResourcesToSkip' parameter to skip the resources that failed during rollback. This allows CloudFormation to complete the rollback of the remaining resources and move the stack to a stable state, after which you can investigate and fix the underlying issue (e.g., insufficient capacity in the AZ) before attempting the update again. Option C directly aligns with AWS documentation for handling this specific stack state.

Answer

Execute a new stack update with the same template

Answer

Manually increase the Auto Scaling group capacity in the affected AZ

Answer

Delete the Auto Scaling group and recreate it

Question 8

Which THREE AWS services can be used to centrally manage and enforce security policies across multiple accounts in AWS Organizations? (Select THREE.)

Accepted Answer

AWS Config Conformance Packs. AWS Config Conformance Packs enable you to deploy and enforce a collection of AWS Config rules and remediation actions across multiple accounts and Regions in an AWS Organization. They provide a centralized way to ensure that resources comply with internal policies by using a YAML template that defines the rules and parameters, which are then applied to all member accounts via AWS Config aggregators and StackSets.

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 9

Refer to the exhibit. A DevOps engineer created this IAM policy for a CodeDeploy service role. The deployment fails with an 'AccessDenied' error when attempting to register instances with an Auto Scaling group. What is the likely cause?

Accepted Answer

The policy is missing autoscaling:UpdateAutoScalingGroup and autoscaling:SetDesiredCapacity.. The CodeDeploy service role must include permissions for autoscaling:UpdateAutoScalingGroup and autoscaling:SetDesiredCapacity to allow CodeDeploy to register instances with an Auto Scaling group during a deployment. Without these actions, the deployment fails with an 'AccessDenied' error when CodeDeploy attempts to attach instances to the Auto Scaling group or adjust its capacity.

Answer

The policy does not allow autoscaling:CompleteLifecycleAction.

Answer

The role is not trusted by the EC2 service.

Answer

The iam:PassRole action is not scoped to the correct resource.

Question 10

A company runs a production application on Amazon ECS with Fargate, fronted by an Application Load Balancer (ALB). The application experiences periodic latency spikes and occasional 502 errors. The ECS service is configured with a desired count of 2 tasks, and the ALB health check is set to /health with a 30-second interval and 2 consecutive failures threshold. The team uses CloudWatch Container Insights and has noticed that CPU and memory utilization of tasks remain below 50%. However, the ALB TargetGroup's HealthyHostCount metric occasionally drops to 0 for a few minutes before recovering. The deployment strategy is rolling update with a minimum healthy percent of 50% and maximum percent of 200%. The team recently updated the task definition to increase memory and CPU, but the issue persists. What is the MOST likely cause of the problem?

Accepted Answer

The ALB health check is too aggressive, causing tasks to be marked unhealthy during brief initialization or deployment.. The health check interval (30 seconds) and failure threshold (2) mean it takes up to 60 seconds to mark a task unhealthy. During deployments, the rolling update may temporarily have only 1 healthy task (minimum 50% of 2 = 1), and if that task becomes unhealthy, HealthyHostCount drops to 0. Option A is wrong because CPU and memory are below 50%, so resource limits are not the issue. Option C is wrong because a target group with 2 tasks and 2 AZs is fine; the problem is not AZ-specific. Option D is wrong because ECS service-linked role does not affect health checks.

Answer

The ECS service role lacks permissions to register targets with the ALB.

Answer

The ALB target group is configured with only one Availability Zone, causing loss of all targets when that AZ fails.

Answer

The task's CPU or memory limits are set too low, causing the container to be throttled.

Question 11

A DevOps engineer is troubleshooting an application running on an EC2 instance. The application needs to access an Amazon RDS database using IAM database authentication. The EC2 instance is associated with an IAM role 'EC2-AppRole', and the RDS instance has a resource-based policy that allows 'DatabaseAccessRole' to connect. The engineer sees the error in the exhibit. What is the most likely cause?

Accepted Answer

The trust policy of the IAM role 'DatabaseAccessRole' does not allow the EC2 instance role 'EC2-AppRole' to assume it.. The error indicates that the EC2 instance's IAM role 'EC2-AppRole' cannot authenticate to the RDS instance. IAM database authentication requires the EC2 instance to assume a database authentication token, which is generated by calling the RDS API with the 'EC2-AppRole' credentials. However, the RDS instance's resource-based policy only allows 'DatabaseAccessRole' to connect. For 'EC2-AppRole' to successfully authenticate, it must first assume 'DatabaseAccessRole' via a trust policy that permits the EC2 instance role to assume it. Without this trust relationship, the authentication token request fails, causing the error.

Answer

The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.

Answer

The security group for the EC2 instance does not allow outbound traffic to the RDS instance.

Answer

The EC2 instance does not have the correct IAM instance profile attached.

Question 12

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple accounts? (Choose 2.)

Accepted Answer

AWS Organizations. AWS Organizations allows you to centrally manage and enforce security policies across multiple accounts by using Service Control Policies (SCPs). SCPs define the maximum permissions for accounts in an organization, enabling you to restrict access to services or actions without requiring per-account configuration. AWS Control Tower provides a managed service that automates the setup of a multi-account environment with pre-built guardrails, which are implemented using SCPs and AWS Config rules to enforce security and compliance policies consistently.

Answer

Amazon S3

Answer

Amazon CloudWatch

Answer

AWS Lambda

Question 13

A company is designing a disaster recovery strategy for its on-premises database to AWS using AWS Elastic Disaster Recovery (AWS DRS). The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 minute. Which configuration should they use?

Accepted Answer

Configure AWS DRS to continuously replicate data to a staging area in AWS, and launch instances in the target region on failover.. AWS DRS (formerly CloudEndure) provides continuous block-level replication with sub-second RPO, which meets the 1-minute RPO requirement. By replicating to a staging area and launching instances in the target region on failover, it can achieve an RTO of 15 minutes or less, as the instances are pre-configured and ready for rapid launch.

Answer

Use AWS CloudEndure Disaster Recovery (now AWS DRS) with periodic replication every hour.

Answer

Use AWS Backup to take snapshots every 5 minutes and restore in the target region.

Answer

Use RDS cross-region automated backups with a 5-minute backup window.

Question 14

A company uses AWS CloudTrail to log all API calls across multiple accounts. The logs are stored in an S3 bucket in the management account. The security team wants to ensure that the logs are not tampered with and that any unauthorized modification is detected. The DevOps engineer has enabled CloudTrail log file integrity validation. The engineer also sets up an S3 lifecycle policy to transition logs to Glacier after 90 days. Additionally, the engineer enables S3 server access logging and sends the logs to a different bucket. A few months later, the security team suspects that some logs have been deleted. The engineer checks the CloudTrail digest files and finds that the latest digest file is missing. What is the most likely cause?

Accepted Answer

The S3 lifecycle policy transitions objects to Glacier after 90 days, causing the digest file to appear missing when listing the bucket without filtering by storage class.. CloudTrail log file integrity validation stores digest files in the same S3 bucket as the logs. The lifecycle policy transitions all objects, including digest files, to Glacier after 90 days. When objects are transitioned to Glacier, they remain in the bucket but are not readily accessible via standard S3 list operations unless you specifically request the Glacier storage class. As a result, the latest digest file may appear missing, leading to the assumption that logs were deleted.

Answer

The S3 bucket has default encryption enabled, causing the digest files to be unreadable.

Answer

The server access logging is writing access logs to the same bucket, causing overwrites.

Answer

The S3 bucket has Object Lock enabled, which prevents deletion of any objects.

Question 15

A company uses AWS CloudFormation to manage infrastructure. The DevOps team wants to implement a change management process where all stack updates must be reviewed before execution. Which AWS feature should be used?

Accepted Answer

Change Sets. Change Sets allow you to preview how proposed changes to a CloudFormation stack will impact your running resources before you execute them. This enables a review-and-approval workflow, making it the correct choice for implementing a change management process where all stack updates must be reviewed before execution.

Answer

Drift detection

Answer

StackSets

Answer

Stack policies

Question 16

A company uses AWS CodeBuild to build and test code. The build process needs to access a private Amazon RDS database to run integration tests. What is the most secure way to provide database credentials to the build project?

Accepted Answer

Store the credentials in AWS Secrets Manager and grant the CodeBuild service role permission to retrieve them.. AWS Secrets Manager is designed specifically for storing and rotating secrets such as database credentials, and it integrates natively with IAM so you can grant the CodeBuild service role fine-grained permission to retrieve the secret at build time. This avoids hardcoding credentials in the build project and supports automatic rotation, which is the most secure option. The CodeBuild service role can call secretsmanager:GetSecretValue, and the buildspec retrieves the secret dynamically.

Answer

Store the credentials as environment variables in the build project configuration.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter.

Answer

Store the credentials in an encrypted S3 bucket and download them during the build phase.

Question 17

A DevOps engineer is designing a monitoring solution for an application that runs on Amazon EC2 instances in an Auto Scaling group. The engineer needs to collect memory utilization metrics and visualize them in a dashboard. What should the engineer do?

Accepted Answer

Install the Amazon CloudWatch agent on the EC2 instances to collect memory metrics and publish them to CloudWatch.. The Amazon CloudWatch agent is required to collect memory utilization metrics from EC2 instances because memory usage is not a default metric provided by CloudWatch. By installing the CloudWatch agent on the instances, it can gather memory metrics (and other custom metrics) and publish them to CloudWatch, where they can be visualized in dashboards. This is the standard AWS-recommended approach.

Answer

Create a custom CloudWatch metric namespace and publish memory data using the AWS CLI.

Answer

Enable detailed monitoring on the EC2 instances to collect memory metrics.

Answer

Use AWS CloudTrail to capture memory utilization events from the EC2 instances.

Question 18

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application generates logs that are sent to Amazon CloudWatch Logs. The DevOps team needs to configure a metric filter to monitor for error patterns and trigger an alarm when the error rate exceeds 5% of total requests over a 5-minute period. Which TWO steps should the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group to count occurrences of the error pattern.. Option B is correct because a CloudWatch Logs metric filter is the mechanism that scans log events in a log group for a specified pattern (for example, "ERROR") and increments a custom metric each time the pattern matches, which is exactly how the error count is derived from the application logs. Option E is correct because the requirement is an error rate (a percentage), not a raw count, so the alarm must use a CloudWatch metric math expression that divides the error-count metric by the total-request-count metric and compares the result against the 5% threshold over the 5-minute evaluation period. Option A is not needed because metric filters are applied to an existing log group that already receives the application logs; you do not create a separate log group for the metric. Option C is wrong because subscription filters stream log data to destinations such as Lambda or Kinesis for real-time processing, which is unnecessary when CloudWatch metric filters and metric math can compute the rate natively. Option D is wrong because the metric is created automatically by the metric filter defined in Option B, so a separate manual metric creation step is redundant.

Answer

Create a CloudWatch Logs log group for the error metric.

Answer

Create a CloudWatch Logs subscription filter to stream errors to a Lambda function that calculates the error rate.

Answer

Create a CloudWatch metric for the error count.

Question 19

A team uses AWS CodeBuild to build Docker images and push them to Amazon ECR. The buildspec.yml includes a post_build step that runs a security scan. The team wants to ensure that only images that pass the security scan are tagged as 'latest'. Which approach should be used?

Accepted Answer

In the post_build phase, run the security scan, and if it passes, tag the image with 'latest' and push.. It ensures that only images passing the security scan receive the 'latest' tag. By running the scan in the post_build phase and conditionally tagging only on success, the team avoids ever pushing a vulnerable image with the 'latest' tag. This approach follows the principle of atomic tagging, where the tag is applied only after all validation steps pass.

Answer

Build the image with the 'latest' tag first, then run the security scan. If it fails, delete the 'latest' tag.

Answer

Use ECR lifecycle policies to remove images that do not pass the security scan.

Answer

Tag the image with 'latest' only after the build phase, regardless of scan results.

Question 20

A company is designing a disaster recovery plan for an Amazon S3 data lake. The data lake stores sensitive data that must be replicated to a secondary Region with an RPO of 15 minutes. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Enable S3 Versioning on both the source and destination buckets.. Enabling S3 Versioning on both the source and destination buckets is a prerequisite for S3 Replication. Without versioning, replication cannot track object versions, which is essential for meeting the 15-minute RPO with consistency guarantees.

Answer

Configure S3 Event Notifications to trigger a Lambda function that copies objects to the secondary Region.

Answer

Enable S3 Transfer Acceleration on the source bucket.