DOP-C02 Practice Exam 63 — 20 Questions

Question 1

A company is using AWS CloudFormation to manage its infrastructure. The DevOps team wants to implement drift detection to identify resources that have been modified outside of CloudFormation. Which TWO of the following are correct statements about CloudFormation drift detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Drift detection can detect changes to resources such as security groups.. Drift detection can detect changes to resources such as security groups because CloudFormation supports drift detection for a wide range of AWS resources, including EC2 security groups. When drift detection is performed, CloudFormation compares the current configuration of each supported resource in the stack with the expected configuration defined in the stack template. If a security group rule is added or removed outside of CloudFormation (e.g., via the AWS Console or CLI), drift detection will report that resource as drifted.

Answer

Drift detection is automatically performed every time the stack is updated.

Answer

Drift detection can be performed on nested stacks independently.

Answer

Drift detection automatically reverts any changes to the original template.

Question 2

A company uses AWS CloudTrail to audit API activity. During an incident investigation, they find that a user with the IAM policy 'AdministratorAccess' deleted an S3 bucket. The security team wants to know the source IP address and user agent used for the delete operation. Which action should the team take to obtain this information?

Accepted Answer

View the CloudTrail event history for the delete-bucket event.. CloudTrail event history captures all management events, including DeleteBucket, and records the source IP address and user agent for each API call. By viewing the event history for the specific delete-bucket event, the security team can directly retrieve the required metadata without needing additional log sources or configurations. Option B is incorrect because S3 server access logs log object-level operations, not management events like bucket deletion. Option C is not the most direct method; CloudWatch Logs can be used if CloudTrail is configured to send events to a log group, but the simplest way is from CloudTrail event history directly. Option D is incorrect because AWS Config tracks resource configuration changes, not API call details like source IP.

Answer

Check the S3 server access logs for the deleted bucket.

Answer

Use CloudWatch Logs to search for the event in the CloudTrail log group.

Answer

Query AWS Config to find the configuration item for the bucket deletion.

Question 3

A company runs a critical e-commerce application on AWS. The architecture includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server, and an Amazon RDS MySQL Multi-AZ database. The DevOps team has implemented CloudWatch dashboards to monitor key metrics. Recently, customers have reported that the website becomes unresponsive for a few minutes during peak traffic hours. The team reviews the CloudWatch metrics and observes that during the incidents, the ALB's 'TargetResponseTime' metric spikes, and the RDS 'ReadLatency' and 'WriteLatency' metrics also spike. However, the EC2 CPU utilization and memory usage remain normal. The ALB health check shows 'Healthy' for all targets. The team needs to identify the root cause. Which course of action should the team take?

Accepted Answer

Enable Performance Insights on the RDS instance to analyze database performance and identify slow queries.. The symptoms — spiking ALB TargetResponseTime alongside spiking RDS ReadLatency and WriteLatency, with normal EC2 CPU/memory and healthy targets — point to a database bottleneck, most likely slow or inefficient queries. Performance Insights is the AWS-native tool for identifying top SQL statements, wait events, and database load contributors, so it directly addresses the root cause. Adding instances or listeners would not help because the bottleneck is downstream at the database, not at the application tier.

Answer

Configure the ALB to add a second listener and distribute traffic across multiple target groups.

Answer

Review the ALB access logs to identify if there are any unusual request patterns causing the latency.

Answer

Increase the desired capacity of the Auto Scaling group to add more EC2 instances to handle the load.

Question 4

A company runs a stateless web application on a fleet of EC2 instances in an Auto Scaling group. The application stores session state in a shared ElastiCache Redis cluster. During traffic spikes, the application becomes slow. Monitoring shows that the Redis cluster has high CPU utilization. Which solution is MOST cost-effective and scalable?

Accepted Answer

Enable cluster mode on the ElastiCache Redis cluster and add more shards. Read replicas offload GET/SMEMBERS-type traffic from the primary, but every write must still be processed by the primary node, so if the workload has a significant write component, the primary's CPU and write path remain unchanged. Note: ElastiCache Redis read replicas do NOT require cluster mode — a cluster-mode-disabled replication group already supports up to 5 read replicas on a single shard. Cluster mode is only needed to add additional shards for horizontal write scaling, which is why option B (enabling cluster mode) is the more complete, scalable fix when the bottleneck may include writes.

Answer

Upgrade the Redis instance to a larger node type to handle more operations

Answer

Add read replicas to offload read traffic from the primary node

Answer

Migrate session state to DynamoDB with DAX for caching

Question 5

A company is using AWS OpsWorks for configuration management of their application stack. The stack includes a PHP application layer and a MySQL database layer. The DevOps team wants to automate the deployment of a new PHP version across all instances in the PHP layer. The team has created a custom Chef recipe that updates PHP. They want to run this recipe on all instances in the PHP layer in a rolling update fashion to avoid downtime. Which OpsWorks feature should they use?

Accepted Answer

Use the OpsWorks 'Run Command' feature to execute the recipe on the PHP layer with rolling update settings.. AWS OpsWorks Stacks provides a 'Run Command' feature that lets you execute a specific Chef recipe on a chosen layer, and it supports rolling updates so instances are updated in batches rather than all at once. This is the designed mechanism for on-demand execution of a recipe across a layer without redeploying the entire stack. Rolling updates minimize downtime by updating instances in configurable batch sizes while keeping the rest of the layer serving traffic.

Answer

Create a custom Chef cookbook and enable automatic updates in OpsWorks.

Answer

Add the recipe to the Setup lifecycle event for the PHP layer.

Answer

Modify the PHP layer's lifecycle configuration to include the recipe in the Configure event.

Question 6

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to block traffic from known malicious IP addresses before it reaches the ALB. What is the MOST effective approach?

Accepted Answer

Use AWS WAF with an IP set rule to block the malicious IP addresses.. AWS WAF is the only service in the list that operates at Layer 7 and integrates natively with ALB, allowing IP set rules to block traffic before it reaches the application. An IP set rule in WAF explicitly matches source IPs and takes a block action, which is exactly what the security team requires. WAF is also managed and scalable, so it can handle large IP lists without impacting ALB performance.

Answer

Configure network ACLs on the ALB's subnet to block the malicious IPs.

Answer

Use AWS Network Firewall to inspect and block traffic at the VPC level.

Answer

Configure security groups to deny inbound traffic from the malicious IP addresses.

Question 7

A company runs a stateful web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data in local instance memory. To improve resiliency, the company wants to make the application stateless and distribute the load across multiple Availability Zones. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Configure the ALB to distribute traffic across EC2 instances in multiple Availability Zones.. Option C is correct because an ALB is a regional load balancer that can register targets in multiple Availability Zones, so configuring it to distribute traffic across EC2 instances in several AZs removes the single-AZ failure point and improves resiliency. Option D is correct because moving session data out of local instance memory into an Amazon ElastiCache cluster (e.g., Redis or Memcached) externalizes session state, allowing any instance in any AZ to serve any request and making the application stateless. Option E is correct because Amazon DynamoDB is a fully managed, multi-AZ, highly durable key-value store that can also hold session state externally, achieving the same stateless design without relying on instance memory. Option A is not appropriate because sticky sessions keep a user bound to a single instance and actually perpetuate statefulness rather than eliminate it. Option B is not appropriate because replacing the ALB with an NLB does not address session state at all and an NLB lacks the HTTP/HTTPS layer-7 routing features typically used by web applications.

Answer

Enable sticky sessions (session affinity) on the ALB.

Answer

Replace the ALB with a Network Load Balancer (NLB) to improve performance.

Question 8

A company uses AWS CodeDeploy for blue/green deployments to an Auto Scaling group. The deployment fails because the new instances do not pass health checks. The DevOps engineer discovers that the health check URL returns a 503 error. What is the MOST likely cause?

Accepted Answer

The target group health check path is '/health' but the application does not serve that endpoint. The health check URL returning a 503 error indicates that the application is not responding to the health check endpoint. Since the target group health check path is configured as '/health' but the application does not serve that endpoint, the ALB considers the instances unhealthy, causing CodeDeploy to fail the deployment. This is the most direct cause because the health check is failing at the application layer, not due to infrastructure issues.

Answer

The CodeDeploy agent on the new instances is not running

Answer

The security group for the ALB does not allow inbound traffic on port 80

Answer

The Auto Scaling group health check type is set to EC2 instead of ELB

Question 9

An organization runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that all traffic be encrypted in transit. The security team mandates the use of TLS 1.2 or higher and specific ciphers. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Configure the ALB with a security policy that enforces TLS 1.2 and the required ciphers.. The Application Load Balancer (ALB) supports predefined security policies that enforce TLS version and cipher requirements at the load balancer level, providing centralized control. Option D is correct because configuring the ALB with a security policy that mandates TLS 1.2 and specific ciphers meets the requirement efficiently without modifying individual instances. Option A is incorrect because a Network Load Balancer (NLB) with TLS listeners does not offer the same granular security policy options as ALB and is less efficient for this requirement. Option B is incorrect because CloudFront is a CDN service; placing it in front of the ALB does not directly enforce TLS settings on the ALB itself and adds unnecessary complexity. Option C is incorrect because installing self-signed certificates on each EC2 instance is inefficient, not centralized, and does not enforce consistent TLS version and cipher requirements across all traffic.

Answer

Use a Network Load Balancer with TLS listeners and target groups.

Answer

Place a CloudFront distribution in front of the ALB and configure the origin protocol policy.

Answer

Install a self-signed certificate on each EC2 instance and configure the web server.

Question 10

A company runs a critical application on an Amazon RDS for MySQL DB instance. The application experiences intermittent connection timeouts. The DevOps team notices that the DB instance's CPU and memory metrics are normal. What should the team check NEXT to diagnose the issue?

Accepted Answer

Check the 'DatabaseConnections' CloudWatch metric to see if the connection count is near the max_connections limit. The most likely cause of intermittent connection timeouts when CPU and memory are normal is that the number of database connections has reached the max_connections limit. The 'DatabaseConnections' CloudWatch metric shows the current number of connections; if it's near the limit, new connections will be refused or time out. Checking this metric is the next logical step to diagnose the issue.

Answer

Enable Enhanced Monitoring to check OS-level metrics

Answer

Examine the slow query log to identify long-running queries

Answer

Verify that the DB instance's storage is not full

Question 11

A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes messages from an Amazon SQS queue. Recently, the processing time has increased, and the SQS queue depth is growing. The CloudWatch metrics show that the ECS service's CPU utilization is consistently around 70%, memory utilization is 80%, and the number of running tasks is at the maximum allowed (10). The service is configured with a target tracking scaling policy based on CPU utilization with a target value of 50%. However, the auto scaling does not seem to be adding tasks. The engineer checks the ECS service events and finds no scaling activity. What is the MOST likely reason the auto scaling is not working, and what action should be taken to resolve the issue?

Accepted Answer

The service has reached the maximum number of tasks defined in the auto scaling configuration; increase the maximum tasks.. The auto scaling is not adding tasks because the ECS service has already reached the maximum number of tasks defined in the auto scaling configuration (10). With CPU utilization at 70% and the target tracking policy set to 50%, the policy would normally trigger scale-out actions, but since the maximum task count is already hit, no scaling activity occurs. The engineer must increase the maximum tasks in the auto scaling configuration to allow further scale-out.

Answer

The scaling policy is not properly configured; recreate it with a lower target value.

Answer

The CloudWatch metric is not being emitted correctly; check the metric namespace.

Answer

The ECS service is using Fargate, which does not support target tracking scaling policies.

Question 12

A company runs a web application on AWS that uses Amazon SQS to decouple the frontend from the backend processing. The application experiences sudden spikes in traffic, causing the SQS queue to accumulate a large number of messages. The backend workers are unable to process messages fast enough, leading to increased latency. What solution can the company implement to improve the resilience and scalability of the backend?

Accepted Answer

Configure an Auto Scaling group for the backend workers with a scaling policy based on the SQS queue depth.. Configuring an Auto Scaling group for the backend workers with a scaling policy based on the SQS queue depth (ApproximateNumberOfMessagesVisible) directly addresses the sudden traffic spikes. This approach dynamically adds more worker instances when the queue depth increases, improving processing throughput and reducing latency. It ensures the backend scales in response to demand, enhancing both resilience and scalability.

Answer

Reduce the receive message wait time (long polling) to poll the queue more frequently.

Answer

Increase the visibility timeout of the SQS queue to allow more time for processing.

Answer

Use an SQS FIFO queue instead of a standard queue to ensure ordered processing.

Question 13

A company has a requirement to store audit logs for 7 years. The logs are currently stored in Amazon S3 and are accessed infrequently. Which storage class provides the lowest cost while meeting the retention requirement?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class designed for long-term retention of data that is accessed rarely, with a minimum storage duration of 180 days. It meets the 7-year audit log retention requirement at the lowest cost among the options. It provides retrieval times of 12 hours, which is acceptable for infrequently accessed audit logs.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 One Zone-Infrequent Access

Question 14

A company uses AWS OpsWorks for configuration management of its EC2 instances. The DevOps team wants to apply a new security patch to all instances in a specific layer. What is the most efficient way to accomplish this?

Accepted Answer

Update the layer's custom Chef recipe to include the patch and trigger a lifecycle event to execute the recipe on all instances.. OpsWorks uses Chef to manage configuration, and updating the layer's custom Chef recipe to include the security patch allows you to trigger a lifecycle event (e.g., 'Setup' or 'Configure') that runs the recipe on all instances in that layer simultaneously. This approach is efficient, automated, and leverages OpsWorks' built-in configuration management without manual intervention or stack migration.

Answer

Create a new OpsWorks stack with the patch and migrate instances to it.

Answer

SSH into each instance and run the patch command manually.

Answer

Use AWS Systems Manager Run Command to run a patch command on each instance individually.

Question 15

A development team is using AWS CodeCommit as a source control repository. They want to automate code builds and run unit tests every time a developer pushes code to the 'develop' branch. Which AWS service should they use to trigger the build automatically?

Accepted Answer

Create an AWS CodePipeline with CodeCommit as source and CodeBuild as build stage, configured to start on source changes.. AWS CodePipeline can be configured with CodeCommit as the source stage and CodeBuild as the build stage, and by enabling the 'Amazon CloudWatch Events' trigger on the pipeline, it automatically starts whenever a change is pushed to the specified branch (e.g., 'develop'). This is the native, fully managed way to achieve continuous integration without custom scripting or additional services.

Answer

Set up AWS CodeDeploy to run builds on code push.

Answer

Configure AWS CodeCommit to invoke AWS CodeBuild directly.

Answer

Use Amazon CloudWatch Events to detect a push to CodeCommit and trigger AWS CodeBuild.

Question 16

A company uses AWS CodePipeline for CI/CD. A recent deployment to an Amazon ECS service failed because the new task definition referenced an ECR image that does not exist. The pipeline uses a source stage (CodeCommit), build stage (CodeBuild), and deploy stage (ECS). The engineer wants to catch such errors earlier. What should the engineer add to the pipeline?

Accepted Answer

Add a test stage that runs a script to verify the image exists in ECR.. Adding a test stage that runs a script to verify the image exists in ECR will catch the error earlier in the pipeline, before the deploy stage. This test stage can use AWS CLI or SDK to check if the image tag exists in the ECR repository, and fail the pipeline if it does not. This prevents the deployment from proceeding with a non-existent image.

Answer

Add an invoke action that calls a Lambda function to check the image.

Answer

Add a manual approval step before the deploy stage.

Answer

Add a second build stage that re-builds the image.

Question 17

A company has a microservices architecture with 50 services running on Amazon ECS. The DevOps team wants to collect and analyze logs from all services centrally. They need to query logs across services and set up alerts for error patterns. Which solution is the most scalable and cost-effective?

Accepted Answer

Use the awslogs driver to send logs to Amazon CloudWatch Logs and use CloudWatch Logs Insights for querying and metric filters for alerts. Using the awslogs driver to ship ECS container logs to Amazon CloudWatch Logs is the most scalable and cost-effective native solution. CloudWatch Logs Insights provides a query language for searching across log groups, and metric filters can trigger CloudWatch alarms on error patterns. This requires no cluster management, scales automatically with log volume, and integrates natively with ECS task definitions via the logConfiguration block.

Answer

Use AWS CloudTrail to capture all log events and store them in an S3 bucket for analysis

Answer

Deploy an Amazon Elasticsearch cluster and configure the ECS Fargate agent to send logs directly to Elasticsearch

Answer

Send logs to Amazon S3 and use Amazon Athena for querying, with scheduled queries for alerts

Question 18

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline must scan container images for vulnerabilities before deploying to Amazon ECS. Which service should the engineer use to perform the vulnerability scan?

Accepted Answer

Amazon ECR image scanning. Amazon ECR image scanning is the correct service to perform vulnerability scans on container images before deployment to Amazon ECS. ECR provides both basic and enhanced scanning (using Amazon Inspector) that can identify vulnerabilities in container images. This integrates seamlessly with CI/CD pipelines to scan images as part of the build process.

Answer

AWS WAF

Answer

AWS Config

Answer

Amazon GuardDuty

Question 19

A company is deploying a multi-tier application on AWS. The web tier must be publicly accessible, but the application tier must only be accessible from the web tier. The database tier should not be accessible from the internet at all. Which combination of security groups and network ACLs should be used?

Accepted Answer

Use security groups: allow 0.0.0.0/0 on port 80/443 to web tier, allow web tier security group to app tier, allow app tier security group to database tier.. The correct approach is to use security groups that enforce least privilege: allow public access to the web tier on ports 80/443, allow the web tier security group to access the app tier, and allow the app tier security group to access the database tier. This creates a chain of trust where each tier only accepts traffic from the previous tier.

Answer

Use security groups: allow 0.0.0.0/0 on all ports to web tier, allow all traffic between all instances.

Answer

Place all instances in the same security group with inbound rules allowing only ports 80/443 from 0.0.0.0/0.

Answer

Use network ACLs: allow 0.0.0.0/0 on port 80/443 to web subnet, allow web subnet to app subnet, allow app subnet to database subnet.

Question 20

A company uses AWS CodeCommit to store its infrastructure as code templates. The DevOps team wants to automatically validate CloudFormation templates before merging changes to the main branch. Which service should be used to implement this validation?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it can be configured as a pre-merge check in a pull request workflow. By integrating CodeBuild with CodeCommit, the DevOps team can automatically run a build project that validates CloudFormation templates (e.g., using `aws cloudformation validate-template` or `cfn-lint`) before the merge is allowed. This provides a serverless, automated validation step without requiring a full pipeline or deployment.

Answer

AWS CodeDeploy

Answer

AWS CodePipeline

Answer

AWS CodeStar