DOP-C02 Practice Test 6 — 10 Questions

Question 1

A company stores sensitive data in Amazon S3. A security audit reveals that several S3 buckets are publicly accessible. The DevOps engineer needs to implement a solution that automatically detects and alerts on any S3 bucket that becomes public. Which AWS service should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover, classify, and protect sensitive data, and it can automatically detect and alert on S3 buckets that become publicly accessible. Option B is incorrect because S3 Block Public Access is a preventive control, not detective. Option C is incorrect because AWS Trusted Advisor can check for public buckets but does not provide real-time alerts. Option D is incorrect because AWS Config can track bucket policies but does not automatically alert on public access.

Answer

S3 Block Public Access

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 2

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline has a source stage from CodeCommit, a build stage that runs 'sam build', and a deploy stage that runs 'sam deploy --no-confirm-changeset'. The deploy stage fails with the error 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used by CodeBuild has expired credentials or insufficient permissions to call AWS CloudFormation.. The error 'The security token included in the request is invalid' indicates that the AWS credentials used by CodeBuild to call the CloudFormation API are either expired or lack the necessary permissions. In a CodePipeline with a CodeBuild action, the build project assumes an IAM role to perform actions such as 'sam deploy', which internally calls CloudFormation. If that IAM role's temporary credentials have expired (e.g., due to a long-running build) or the role does not have the required CloudFormation permissions (e.g., cloudformation:CreateChangeSet, cloudformation:ExecuteChangeSet), the API call will fail with this exact error.

Answer

The CloudFormation stack is in a 'ROLLBACK_COMPLETE' state and cannot be updated.

Answer

The CodeBuild project does not have access to the CodeCommit repository.

Answer

The SAM template is invalid and contains syntax errors.

Question 3

A DevOps engineer is troubleshooting a slow web application. The application runs on EC2 instances behind an ALB. The engineer notices that the ALB's TargetResponseTime metric shows high p99 values, but the CPU and memory on the EC2 instances are well below thresholds. What is the most likely cause?

Accepted Answer

The application is waiting on a slow database query or external API call. High p99 TargetResponseTime on the ALB with low CPU and memory on the EC2 instances indicates that the bottleneck is not compute capacity but rather a dependency external to the application server. The application is likely waiting on a slow database query or external API call, which increases response time without consuming significant local CPU or memory. This is a classic symptom of an I/O-bound or network-bound dependency.

Answer

The Auto Scaling group has too many instances, causing increased network overhead

Answer

The ALB is routing requests to instances in different Availability Zones, increasing latency

Answer

The ALB idle timeout is set too low, causing connections to be dropped

Question 4

A company runs a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The function scales up to handle high traffic but sometimes experiences throttling errors (HTTP 429) from Lambda. The company wants to improve the resilience of the application by reducing throttling. The SQS queue is configured as a Lambda event source with a batch size of 10. The Lambda function has a reserved concurrency of 100. Which combination of actions will best reduce throttling? (Choose the single best answer.)

Accepted Answer

Increase the Lambda function's reserved concurrency to 500.. Throttling errors (HTTP 429) occur when Lambda function invocations exceed the account-level concurrency limit or the function's reserved concurrency. By increasing the reserved concurrency from 100 to 500, the function can handle more concurrent invocations, reducing the likelihood of throttling when traffic spikes. This directly addresses the scaling bottleneck without changing the event source or message processing pattern.

Answer

Change the SQS queue to use a FIFO queue to guarantee exactly-once processing.

Answer

Increase the SQS batch size to 50 to process more messages per invocation.

Answer

Use a dead-letter queue (DLQ) for unprocessed messages and set up a CloudWatch alarm to trigger a second Lambda function to reprocess them.

Question 5

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails due to a resource limit exceeded error. Which approach should be used?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack, and subscribe an email endpoint.. CloudFormation natively supports sending stack events (including creation failures) to an SNS topic. By configuring an SNS topic as a notification option in the stack creation request, the DevOps team can subscribe an email endpoint to receive real-time notifications when a resource limit exceeded error occurs, without needing additional services or custom logic.

Answer

Create an Amazon EventBridge rule that matches CloudFormation resource limit exceeded events and sends to SQS.

Answer

Use AWS Config to detect when a stack is in a failed state.

Answer

Enable CloudTrail and create a CloudWatch alarm on the CreateStack API call.

Question 6

A company is running a batch processing job on Amazon EMR that writes results to an Amazon S3 bucket. The job runs daily and takes about 2 hours. The DevOps team wants to be alerted if the job fails or takes longer than 3 hours. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function when the EMR cluster changes to 'TERMINATED' state, then check the job duration and send an alert if it exceeded 3 hours.. It uses CloudWatch Events to detect the EMR cluster's 'TERMINATED' state, which triggers a Lambda function that can check the job duration against the 3-hour threshold and send an alert via SNS if needed. This approach is cost-effective (no polling, event-driven) and operationally efficient, as it decouples monitoring from the job itself and handles both failure and timeout scenarios without modifying the EMR job code.

Answer

Configure Amazon Simple Notification Service (SNS) directly from the EMR job to send notifications on completion.

Answer

Create a CloudWatch alarm on the EMR cluster's EC2 instance CPUUtilization metric to detect abnormal runtime.

Answer

Use Amazon CloudWatch Logs to monitor the job's log stream and create a metric filter for 'FAILED' messages.

Question 7

Which TWO approaches can be used to manage configuration files (e.g., application.properties) across multiple AWS accounts and regions using AWS Systems Manager? (Select TWO.)

Accepted Answer

Use AWS AppConfig to create, manage, and deploy application configurations across accounts and regions.. AWS AppConfig is a feature of AWS Systems Manager that allows you to create, manage, and deploy application configurations across accounts and regions. It supports staged rollouts, validation, and monitoring, making it suitable for managing configuration files like application.properties in multi-account, multi-region environments.

Answer

Use AWS OpsWorks for Chef Automate to store configuration data in Chef data bags.

Answer

Store configuration files in AWS Secrets Manager and retrieve them using the Secrets Manager API.

Answer

Use AWS Systems Manager Run Command to push configuration files to EC2 instances on demand.

Question 8

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 9

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are tamper-proof and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and digital signing to ensure logs have not been tampered with. S3 object lock prevents deletion but not modification. MFA delete protects deletion but not modification. SSE encrypts data at rest but does not protect integrity.

Answer

Server-side encryption (SSE-S3)

Answer

S3 Object Lock

Answer

MFA delete on the S3 bucket

Question 10

A CloudFormation template snippet is shown. An engineer attempts to create a stack with this template and receives an error: 'Bucket my-unique-bucket-name already exists'. What is the most likely cause?

Accepted Answer

The S3 bucket name 'my-unique-bucket-name' is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts and regions. The error 'Bucket my-unique-bucket-name already exists' indicates that the name is already taken by another AWS account, not that the bucket already exists in the current account. CloudFormation cannot create the bucket because the name is not available in the global S3 namespace.

Answer

The bucket policy has a syntax error that prevents the bucket from being created.

Answer

The versioning configuration is incompatible with the bucket policy.

Answer

The bucket policy references the bucket name incorrectly, causing a circular dependency.