DOP-C02 Practice Exam 62 — 20 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user who needs to start a CodePipeline pipeline and view its details. The user reports that they cannot see the pipeline in the AWS Management Console. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not include the codepipeline:ListPipelines action, which is needed to view pipelines in the console.. The AWS Management Console requires the `codepipeline:ListPipelines` action to populate the pipeline list view. Without this permission, the console cannot display any pipelines, even if the user has permissions for specific pipeline actions like `StartPipelineExecution` or `GetPipeline`. The attached policy grants `codepipeline:StartPipelineExecution` and `codepipeline:GetPipeline`, but omits `ListPipelines`, which is why the user sees an empty pipeline list.

Answer

There is an explicit deny statement elsewhere that is overriding the allow.

Answer

The user does not have permission to start the pipeline execution.

Answer

The pipeline ARN is incorrect.

Question 2

A DevOps engineer needs to centralize logs from multiple AWS accounts into a single CloudWatch Logs account. Which feature should be used?

Accepted Answer

CloudWatch Logs cross-account subscription. CloudWatch Logs cross-account subscription (Option D) allows you to stream log data from multiple source AWS accounts to a single destination account's CloudWatch Logs log group. This is the native, managed feature designed specifically for centralizing logs across accounts without needing additional infrastructure or data transformation.

Answer

CloudWatch Logs Insights

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 3

A company uses Amazon CloudWatch to monitor its EC2 instances. A DevOps engineer notices that some metrics (e.g., memory utilization) are not available in the CloudWatch console. The engineer wants to collect these metrics. What should the engineer do?

Accepted Answer

Install and configure the CloudWatch Agent on the EC2 instances.. Memory utilization and disk space metrics are not available by default in CloudWatch because they are OS-level metrics, not hypervisor-level. The CloudWatch Agent must be installed on EC2 instances to collect these custom metrics and publish them to CloudWatch.

Answer

Enable VPC Flow Logs for the instance's subnet.

Answer

Send the metrics to CloudWatch Logs and create a metric filter.

Answer

Enable detailed monitoring on the EC2 instances.

Question 4

A company is using Amazon CloudWatch Logs to collect application logs. They need to search and analyze the logs in near real-time. Which TWO AWS services can be used to achieve this?

Accepted Answer

Amazon CloudWatch Logs Insights. Amazon CloudWatch Logs Insights (option A) is correct because it is a purpose-built, interactive query engine within CloudWatch Logs that lets you search, filter, and analyze log data in near real-time using a specialized query syntax, with results returned in seconds. Amazon OpenSearch Service (option E) is also correct because it can ingest CloudWatch Logs (typically via a subscription filter to Lambda or Kinesis) and provides near real-time search, dashboards, and analytics on that log data. Option B, Amazon CloudWatch Synthetics, is wrong because it creates canaries to monitor endpoints and availability, not to search or analyze log content. Option C, Amazon Kinesis Data Analytics, is wrong because it is for running SQL/Flink stream processing over streaming data, not for ad-hoc log search and analysis. Option D, Amazon Athena, is wrong because it queries data in S3 with SQL on a batch/interactive basis and does not natively search CloudWatch Logs in near real-time.

Answer

Amazon CloudWatch Synthetics

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Athena

Question 5

A DevOps engineer is designing a CI/CD pipeline that deploys code to an EC2 instance. The engineer needs to securely store and retrieve database credentials used by the application. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to securely store, retrieve, and rotate secrets such as database credentials. It provides fine-grained access control, encryption at rest, and automatic rotation, making it ideal for CI/CD pipelines that need to access database credentials securely.

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Question 6

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. Which configuration change is MOST likely to resolve the issue?

Accepted Answer

Increase the Lambda function timeout.. The Lambda function is timing out during the secret rotation process, which involves connecting to the RDS database, generating a new password, and updating the secret. Increasing the Lambda function timeout directly addresses the symptom by allowing more time for the rotation to complete, especially if the database response is slow or the network latency is high. This is the most direct fix for a timeout error, as the default Lambda timeout (3 seconds) is often insufficient for database operations.

Answer

Increase the Lambda function memory.

Answer

Place the Lambda function in the same VPC as the RDS instance.

Answer

Configure the Lambda function to retry on failure.

Question 7

A company uses AWS CodeBuild for CI/CD. The build project needs to access a private S3 bucket to download artifacts. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role with read access to the bucket and attach it to the CodeBuild project.. Attaching an IAM role to the CodeBuild project allows CodeBuild to assume temporary credentials via the AWS STS service, eliminating the need to store any long-lived secrets. The role's policy can be scoped to only the specific S3 bucket and actions required, following least privilege. This is the AWS-recommended pattern for service-to-service authentication.

Answer

Embed the access keys in the buildspec.yml file.

Answer

Use an S3 bucket policy that grants public read access.

Answer

Store AWS access keys in CodeBuild environment variables.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. The stack creation fails with the error: 'Resource handler returned message: 'The security group does not exist in VPC'.' The template references a security group by name. What is the MOST likely cause?

Accepted Answer

The security group name is misspelled or uses incorrect case. The error 'Resource handler returned message: The security group does not exist in VPC' occurs when CloudFormation cannot find a security group with the specified name in the target VPC. The most likely cause is a misspelling or case sensitivity issue (Option A), as CloudFormation matches security group names exactly. While region scoping (Option C) can also cause a similar error, the combination of a name-based reference and the specific error wording points to a name mismatch as the most common issue. IAM permission errors (Option B) would typically return an authorization error, not a 'does not exist' error. Option D is incorrect because a default VPC security group exists and would not cause this error unless it is missing, which is unlikely.

Answer

The IAM role used for CloudFormation does not have permissions to describe security groups

Answer

The stack is being created in a Region where the security group does not exist

Answer

The template uses a parameter that resolves to the default VPC security group

Question 9

A company is using Amazon CloudWatch Logs Insights to analyze application logs. The DevOps team needs to create a metric filter that counts occurrences of the word 'ERROR' in the log events. Which CloudWatch Logs Insights query should be used to test the metric filter?

Accepted Answer

fields @timestamp, @message | filter @message like /ERROR/. To test a metric filter that counts occurrences of the word 'ERROR' in log events, you need a CloudWatch Logs Insights query that filters log events containing 'ERROR'. The query `fields @timestamp, @message | filter @message like /ERROR/` does exactly that: it selects the timestamp and message fields and filters for messages that match the regular expression /ERROR/. This allows you to verify that the filter pattern will correctly identify the relevant log events.

Answer

fields @timestamp, @message | stats count() by bin(5m)

Answer

fields @timestamp, @message | parse @message '[*] *' as @severity, @log

Answer

fields @timestamp, @message | sort @timestamp desc

Question 10

A company is using AWS Elastic Beanstalk with a custom platform. They need to install a third-party agent on all instances. The agent requires a configuration file that contains sensitive credentials. How should the DevOps engineer provide the configuration file to the agent?

Accepted Answer

Use .ebextensions configuration files to download the configuration from a secure S3 bucket using an IAM instance role.. Ebextensions configuration files allow you to run custom commands and scripts during instance provisioning, and by combining this with an IAM instance role that grants read access to a secure S3 bucket, you can securely download the sensitive configuration file without embedding credentials in the source code or user data. This approach follows AWS best practices for handling secrets by avoiding hard-coded credentials and leveraging IAM roles for temporary, scoped access.

Answer

Use instance user data to write the configuration file during instance launch.

Answer

Embed the configuration file in the application source code and deploy it with the application.

Answer

Use AWS Systems Manager Run Command to distribute the configuration file after instances are launched.

Question 11

A company uses Amazon Route 53 for DNS and wants to ensure high availability for a web application hosted on two EC2 instances in different Availability Zones. The application uses an Application Load Balancer. What is the simplest way to achieve resilience if one Availability Zone becomes unavailable?

Accepted Answer

Place the instances in different Availability Zones behind the ALB.. Placing EC2 instances in different Availability Zones behind an Application Load Balancer (ALB) is the simplest and most effective way to achieve high availability. The ALB automatically distributes traffic across healthy targets in multiple AZs, and if one AZ becomes unavailable, the ALB stops routing requests to instances in that AZ, ensuring continued service from the remaining AZ.

Answer

Launch both instances in the same Availability Zone.

Answer

Configure Route 53 latency-based routing to each instance.

Answer

Configure Route 53 failover routing with health checks pointing to each instance.

Question 12

Refer to the exhibit. A CodePipeline service role has this IAM policy attached. The pipeline's deploy stage uses CodeDeploy to perform an ECS blue/green deployment. The deployment fails with an access denied error. What is the MOST likely missing permission?

Accepted Answer

ecs:UpdateService. In an ECS blue/green deployment via CodeDeploy, the CodePipeline service role must have permission to call ecs:UpdateService on the ECS service to trigger the deployment of the new task definition. Without this permission, CodeDeploy cannot update the ECS service to use the new task set, resulting in an access denied error. The other permissions are either already present or not directly required for the deployment action.

Answer

ecs:RegisterTaskDefinition

Answer

codedeploy:CreateDeployment

Answer

ecs:CreateService

Question 13

A company is designing a multi-region disaster recovery strategy for a stateless web application. They want to minimize RTO and RPO. Which TWO of the following should they implement? (Choose TWO.)

Accepted Answer

Use cross-region replication for data stores.. Cross-region replication for data stores ensures that data is continuously synchronized to a secondary AWS region, minimizing Recovery Point Objective (RPO) to near-zero and reducing Recovery Time Objective (RTO) as the data is already available in the DR region. This approach avoids the need to restore from backups, which would increase RTO and potentially lose recent transactions.

Answer

Use a passive standby in a single Availability Zone.

Answer

Perform periodic backups and restore in the DR region.

Answer

Configure cross-region read replicas for the database.

Question 14

An application running on Amazon ECS experiences intermittent failures. The DevOps engineer wants to capture the application's standard output and error logs and send them to CloudWatch Logs. What is the simplest way to achieve this?

Accepted Answer

Use the awslogs log driver in the task definition.. The awslogs log driver is the simplest native integration between Amazon ECS and CloudWatch Logs. By specifying the log driver in the task definition, the ECS container agent automatically captures stdout and stderr from the container and streams them to CloudWatch Logs without any additional agents or custom code.

Answer

Install the CloudWatch Agent in each container.

Answer

Configure AWS CloudTrail to capture logs.

Answer

Write logs to a file and use an S3 bucket with event notifications.

Question 15

A DevOps team is using AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The team wants to add a manual approval step before the deploy stage to ensure that only authorized personnel can approve production deployments. Which action should be taken to implement this requirement?

Accepted Answer

Add a manual approval action to the pipeline between the build and deploy stages, and configure the SNS topic to notify the approvers.. AWS CodePipeline natively supports a manual approval action that can be inserted as a stage between build and deploy. This action pauses the pipeline and sends a notification via an SNS topic to the configured approvers. The pipeline only resumes when an authorized user clicks the 'Approve' button in the CodePipeline console or API, ensuring that only authorized personnel can approve production deployments.

Answer

Add an AWS Lambda function as a transition action between the build and deploy stages that sends an email to the approver and waits for a response.

Answer

Create a CodeDeploy deployment group with a manual approval step in the deployment configuration.

Answer

Configure an Amazon SNS topic to send an approval request email to the approver, and use a Lambda function to resume the pipeline upon approval.

Question 16

A company uses AWS Secrets Manager to store database credentials. The security team requires that secrets be automatically rotated every 30 days. Which rotation strategy should the engineer configure to meet this requirement with minimal operational overhead?

Accepted Answer

Enable automatic rotation using the pre-built Lambda rotation function for the database type.. AWS Secrets Manager supports automatic rotation using pre-built Lambda rotation functions tailored to specific database types (e.g., Amazon RDS MySQL, PostgreSQL, Aurora). Enabling this built-in rotation with a 30-day schedule meets the requirement with minimal operational overhead because AWS manages the Lambda function, rotation logic, and secret update. This is the standard, lowest-effort approach for database credential rotation.

Answer

Manually rotate the secret every 30 days using the AWS CLI.

Answer

Store the secret in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Enable automatic rotation with a custom Lambda function.

Question 17

A company uses AWS Lambda functions to process sensitive data from an SQS queue. The Lambda function writes results to an S3 bucket. The security team requires that all data at rest in S3 be encrypted with a customer managed KMS key, and that the Lambda function only have access to decrypt the queue messages and encrypt the S3 objects. An IAM role is attached to the Lambda function. The engineer has configured the KMS key policy to allow the Lambda role to use the key. However, the Lambda function fails to write to S3 with a 'KMS access denied' error. The engineer verified that the S3 bucket has default encryption enabled with the same KMS key. Which additional step is most likely required?

Accepted Answer

Add an inline policy to the Lambda role that allows kms:GenerateDataKey and kms:Encrypt actions for the KMS key.. The KMS key policy alone is not sufficient — IAM policies must also grant the caller permission to use the key. When Lambda writes to an S3 bucket with SSE-KMS default encryption, S3 calls kms:GenerateDataKey on behalf of the Lambda execution role to obtain a data key for envelope encryption. Without kms:GenerateDataKey (and typically kms:Encrypt) in the Lambda role's identity-based policy, the request fails with 'KMS access denied' even though the key policy allows the role.

Answer

Disable default encryption on the S3 bucket and configure the Lambda to use SSE-S3.

Answer

Grant the Lambda role s3:PutObject permission on the bucket.

Answer

Modify the KMS key policy to allow the Lambda role to use the key without any conditions.

Question 18

A company runs a microservices application on Amazon ECS with Fargate. The operations team notices that some services are experiencing intermittent high latency, but CPU and memory metrics appear normal. They need to identify the root cause. Which approach should they use?

Accepted Answer

Instrument the application with the AWS X-Ray SDK and use the X-Ray console to analyze traces.. Intermittent latency with normal CPU and memory metrics points to a distributed tracing problem — the bottleneck is likely in a downstream call, a network hop, or a specific service in the request chain. AWS X-Ray traces requests end-to-end across ECS tasks, Lambda functions, and downstream services, showing exactly where time is spent. This makes it the right tool to pinpoint the root cause of intermittent latency in a microservices architecture.

Answer

Enable detailed CloudWatch Logs and use CloudWatch Logs Insights to query logs for slow requests.

Answer

Use Amazon Managed Service for Prometheus to collect custom metrics and set up dashboards.

Answer

Set up CloudWatch Synthetics canaries to monitor the endpoints and measure response times.

Question 19

A company uses AWS CloudTrail to log API events. During an incident investigation, they need to identify who deleted an S3 bucket. Which CloudTrail feature should be used to retrieve the event details quickly?

Accepted Answer

CloudTrail Event history. CloudTrail Event history provides a view of the last 90 days of management events for each AWS region, allowing you to quickly search and filter by resource name (e.g., the S3 bucket name) and event name (e.g., DeleteBucket). This feature is designed for rapid retrieval of recent API activity without needing to query S3 or set up additional infrastructure, making it the fastest option for identifying who deleted an S3 bucket during an incident investigation.

Answer

CloudTrail log file integrity validation

Answer

CloudTrail Lake

Answer

CloudTrail Insights

Question 20

Refer to the exhibit. This S3 bucket policy allows the root user of account 111122223333 to perform which actions?

Accepted Answer

Read and write objects in the bucket. The S3 bucket policy grants the root user of account 111122223333 permissions for s3:GetObject and s3:PutObject on the bucket's objects, which correspond to reading and writing objects. The policy does not include s3:DeleteObject, s3:ListBucket, or s3:PutBucketPolicy, so those actions are not allowed. Therefore, the root user can read and write objects in the bucket.

Answer

Change the bucket policy

Answer

Delete objects from the bucket

Answer

List objects in the bucket