DOP-C02 Practice Exam 64 — 20 Questions

Question 1

A Lambda function is unable to write logs to CloudWatch Logs. The IAM policy attached to the function's execution role is shown above. What is the issue?

Accepted Answer

The policy is missing the 'logs:CreateLogGroup' and 'logs:CreateLogStream' actions.. The IAM policy attached to the Lambda execution role is missing the logs:CreateLogGroup and logs:CreateLogStream actions. Without these, Lambda cannot create the log group or log stream, and thus cannot write logs to CloudWatch Logs. The logs:PutLogEvents action alone is insufficient because the log group and stream must exist first.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The region in the ARN does not match the Lambda function's region.

Answer

The action should be 'logs:PutLogEvents' but the resource is too restrictive.

Question 2

A company uses AWS CodeBuild to run security scans. The scans require access to a private Amazon ECR repository. The build project is configured with a service role. What is the correct way to provide access to ECR?

Accepted Answer

Attach an IAM policy to the CodeBuild service role that allows ECR operations.. CodeBuild uses an IAM service role to define the permissions granted to the build environment. By attaching an IAM policy that allows ECR operations (such as ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:GetAuthorizationToken) to the CodeBuild service role, the build project can authenticate and pull images from the private ECR repository without needing to embed or manage static credentials.

Answer

Set environment variables with ECR credentials in the build project.

Answer

Configure the ECR repository policy to allow access from the CodePipeline service role.

Answer

Include the ECR credentials in the buildspec file.

Question 3

A company uses AWS Lambda functions to process events from an Amazon SQS queue. The Lambda function occasionally fails due to a transient downstream service error. The DevOps team wants to ensure that failed messages are not lost and can be retried later. The team also wants to reduce the number of invocations on the downstream service. Which configuration should the team use?

Accepted Answer

Configure a dead-letter queue (DLQ) on the SQS queue and set the Lambda function's reserved concurrency to 1.. Configuring a dead-letter queue (DLQ) on the SQS queue ensures that messages that exhaust their retries (due to Lambda failures) are preserved for later reprocessing, preventing data loss. Setting the Lambda function's reserved concurrency to 1 throttles the function to a single concurrent invocation, which naturally reduces the rate of downstream service calls and allows the SQS queue's visibility timeout and redrive policy to manage retry timing, thereby reducing pressure on the downstream service.

Answer

Configure an Amazon SNS topic as a Lambda destination for failure events and subscribe the SQS queue to it.

Answer

Configure a dead-letter queue (DLQ) on the Lambda function and set the function's maximum retry attempts to 2.

Answer

Configure the Lambda function to write failed messages to an Amazon DynamoDB table and set up a scheduled Lambda to retry.

Question 4

A DevOps engineer attempted to create a CloudFormation stack and it failed. The engineer runs the 'describe-stack-events' command and sees the output above. What is the most likely cause of the failure?

Accepted Answer

The EC2 key pair 'myKeyPair' does not exist in the region where the stack is being created.. The 'describe-stack-events' output shows a 'CREATE_FAILED' event for the EC2 instance resource with the status reason indicating that the key pair 'myKeyPair' was not found. CloudFormation validates the existence of the specified EC2 key pair in the target region at creation time; if the key pair does not exist, the stack creation fails immediately. This is a common validation error when the key pair name is misspelled, belongs to a different region, or has not been created beforehand.

Answer

The AMI ID specified in the template is not available in the region.

Answer

The CloudFormation template has a syntax error in the EC2 instance definition.

Answer

The security group specified for the EC2 instance does not exist.

Question 5

A DevOps engineer is designing a configuration management strategy for a fleet of EC2 instances running Amazon Linux 2. The instances must be bootstrapped with custom software and continuously managed to ensure desired state compliance. Which combination of services should the engineer use?

Accepted Answer

AWS Systems Manager State Manager for desired state configuration and AWS Systems Manager Run Command for initial bootstrapping. AWS Systems Manager State Manager provides a policy-driven mechanism to define and maintain desired state configuration for EC2 instances, while AWS Systems Manager Run Command enables ad-hoc or initial bootstrapping by executing scripts or commands (e.g., installing custom software) without requiring SSH. Together, they cover both the initial setup and ongoing compliance enforcement for Amazon Linux 2 instances, aligning with the requirement for continuous management.

Answer

AWS CloudFormation for bootstrapping and Amazon CloudWatch Events to enforce desired state

Answer

AWS OpsWorks for Chef Automate for configuration management and AWS CodeDeploy for deployments

Answer

AWS Config for configuration management and Amazon CloudWatch Events for remediation

Question 6

A company uses Amazon DynamoDB with global tables for a multi-region active-active application. They notice that occasionally, concurrent updates to the same item in different regions cause data inconsistency. How can they resolve this?

Accepted Answer

Use conditional writes and design the application to handle conflicts. DynamoDB global tables use an eventually consistent model for multi-region replication, meaning concurrent updates to the same item in different regions can lead to conflicts. Conditional writes allow the application to enforce a last-writer-wins (LWW) strategy or custom conflict resolution logic, ensuring data consistency by only applying updates that meet specified conditions (e.g., a version number or timestamp check). This approach aligns with the recommended practice for handling concurrent writes in an active-active global table setup.

Answer

Disable global tables and use a single region

Answer

Use DynamoDB read replicas instead of global tables

Answer

Use DynamoDB Accelerator (DAX) to cache writes

Question 7

A company needs to monitor the CPU utilization of its Amazon RDS for PostgreSQL instance. The metric should be available in Amazon CloudWatch with a granularity of 1 minute. Which action should the team take?

Accepted Answer

No additional configuration is needed; RDS automatically sends metrics to CloudWatch.. Amazon RDS for PostgreSQL automatically publishes metrics, including CPU utilization, to CloudWatch with a default granularity of 1 minute for standard instances. No additional configuration is required to enable this basic monitoring. The metrics are collected by the RDS hypervisor layer and sent to CloudWatch without needing an agent or extra setup.

Answer

Install the CloudWatch agent on the RDS instance.

Answer

Enable Enhanced Monitoring for the RDS instance.

Answer

Enable Performance Insights for the RDS instance.

Question 8

A DevOps engineer needs to ensure that EC2 instances can access an S3 bucket without storing AWS credentials on the instances. Which solution meets this requirement?

Accepted Answer

Attach an IAM role to the EC2 instance with an S3 access policy.. Attaching an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS STS service via the instance metadata service (IMDS). The EC2 instance can then use these credentials to access the S3 bucket without any long-term AWS credentials being stored on the instance. This is the AWS-recommended best practice for granting permissions to AWS services running on EC2.

Answer

Use an S3 bucket policy that grants access to the EC2 instance's public IP.

Answer

Store access keys in the EC2 user data script.

Answer

Create an IAM user and embed credentials in the application code.

Question 9

A company is running a production application on Amazon ECS with AWS Fargate. The application has unpredictable traffic patterns and occasionally experiences increased latency. The DevOps team needs to configure scaling based on a custom metric that tracks the number of active user sessions in real time. Which solution will allow the team to scale the ECS service based on this custom metric?

Accepted Answer

Publish the custom metric to Amazon CloudWatch, then create a target tracking scaling policy in Application Auto Scaling for the ECS service.. Application Auto Scaling is the service that scales ECS services, and it supports target tracking policies based on custom CloudWatch metrics. Publishing the custom session-count metric to CloudWatch and then creating a target tracking scaling policy for the ECS service is the correct, fully managed approach.

Answer

Use AWS Auto Scaling to scale the ECS service based on the custom metric.

Answer

Create a CloudWatch dashboard to visualize the metric and manually adjust the service count.

Answer

Use an AWS Lambda function to directly update the desired count of the ECS service based on the metric.

Question 10

A company uses AWS CodeBuild to run security scans on code. The scan requires access to a private Amazon ECR repository for downloading scanning tools. The CodeBuild project is configured with a VPC and uses an IAM role. However, the build fails with 'Error: unable to pull image from registry.' Which TWO steps should be taken to resolve this?

Accepted Answer

Add 'ecr:GetDownloadUrlForLayer' and 'ecr:BatchGetImage' permissions to the CodeBuild service role.. The CodeBuild service role must have the 'ecr:GetDownloadUrlForLayer' and 'ecr:BatchGetImage' permissions to authorize the retrieval of container image layers from the private ECR repository. Without these permissions, the Docker pull operation fails with 'unable to pull image from registry' even if network connectivity is established.

Answer

Change the ECR repository policy to allow public access.

Answer

Remove the VPC configuration from the CodeBuild project so it can access the public internet.

Answer

Grant 'kms:Decrypt' permissions for the KMS key used by ECR.

Question 11

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template needs to reference the secret value dynamically during stack creation. How should the template retrieve the secret?

Accepted Answer

Use a dynamic reference with '{{resolve:secretsmanager:secret-id:secret-string}}' in the template.. CloudFormation dynamic references using the 'resolve:secretsmanager' syntax allow the template to retrieve secret values from AWS Secrets Manager at stack creation time. Option B correctly uses this dynamic reference to pull the password securely. Option A (mapping) cannot retrieve secrets dynamically; it only stores static values. Option C (hardcoding) is insecure and not dynamic. Option D (parameter with default ARN) does not retrieve the secret value; it only passes the ARN string, not the actual secret.

Answer

Use a CloudFormation mapping to store the secret ARN.

Answer

Hardcode the password in the template as a literal string.

Answer

Use a CloudFormation parameter with a default value referencing the secret ARN.

Question 12

A company is deploying a stateful application on Amazon EKS. The application requires persistent storage that can be reattached to a new pod if the original pod fails. The cluster spans multiple Availability Zones. Which storage solution provides the BEST resilience and meets these requirements?

Accepted Answer

Amazon EFS file system.. Amazon EFS provides a fully managed, regional NFS file system that can be mounted concurrently by multiple pods across different Availability Zones. It is designed for high availability and durability, automatically replicating data across multiple AZs, and supports automatic reattachment to a new pod if the original pod fails, making it the best choice for stateful applications requiring resilient, shared persistent storage on Amazon EKS.

Answer

Amazon S3 bucket with a mountpoint.

Answer

Amazon EBS with gp3 volume type.

Answer

EC2 instance store volumes.

Question 13

A DevOps team is designing a CI/CD pipeline for a microservices application. Each service is stored in a separate repository. The team wants to build and test only the services that changed in a given commit. Which AWS solution is MOST efficient and cost-effective?

Accepted Answer

Use AWS CodeBuild with a webhook that triggers builds only for repositories where files changed, using buildspec filters.. AWS CodeBuild webhooks can be configured with buildspec filter patterns (e.g., using `git diff` or path-based globs) to trigger builds only for repositories where files changed. This avoids unnecessary builds for unchanged services, making it both efficient and cost-effective by minimizing compute time and resource usage.

Answer

Use AWS CodeCommit triggers with Amazon SNS to send notifications and then manually trigger builds.

Answer

Use AWS CodePipeline with a single pipeline that builds all services on every commit.

Answer

Use Amazon EventBridge to detect repository changes and trigger AWS Lambda functions that determine which services changed.

Question 14

A media company runs a video transcoding pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple Lambda functions that transcode video files stored in Amazon S3. The company wants to implement a monitoring solution to track the progress of each workflow execution, including which step is currently running, the duration of each step, and any errors. The solution should provide near real-time visibility and allow the team to troubleshoot failed executions quickly. Which solution meets these requirements?

Accepted Answer

Use Amazon EventBridge to capture Step Functions execution status changes and build a custom dashboard in CloudWatch.. Amazon EventBridge (formerly CloudWatch Events) can capture Step Functions execution state changes (e.g., step started, succeeded, failed). These events can be used to build a custom dashboard in CloudWatch, providing near real-time visibility into workflow progress, step durations, and errors. Option A is incorrect because creating custom metrics from Lambda functions requires additional instrumentation and does not provide workflow-level context easily. Option C is incorrect because CloudWatch Logs Insights queries are not near real-time; they require searching through logs, and the solution needs real-time visibility. Option D is incorrect because AWS X-Ray provides distributed tracing for individual requests, but it does not offer high-level workflow step tracking with durations and errors aggregated across executions in near real-time.

Answer

Create custom CloudWatch metrics from Lambda functions for each step, and build a CloudWatch dashboard.

Answer

Configure each Lambda function to write logs to CloudWatch Logs with the execution ID, and use CloudWatch Logs Insights to query and visualize.

Answer

Enable AWS X-Ray tracing on the Step Functions and Lambda functions to get a service map and trace details.

Question 15

A company has a CI/CD pipeline that builds a Docker image and pushes it to Amazon ECR. The build step uses AWS CodeBuild. The engineer wants to ensure that the ECR repository has a lifecycle policy to expire untagged images after 14 days. Which TWO actions are required? (Choose 2.)

Accepted Answer

Create an ECR lifecycle policy for the repository.. ECR lifecycle policies are configured at the repository level, not in CodeBuild or buildspec files. Option E is correct because the rule must specifically target untagged images and set an expiration of 14 days using the `expire` action with `sinceImagePushed` and `countType` set to `sinceImagePushed` and `countNumber` set to 14. Together, these two actions ensure the lifecycle policy exists and contains the correct rule to expire untagged images after 14 days.

Answer

Use the docker tag command to tag images with a timestamp.

Answer

Add a lifecycle policy rule in the buildspec.yml file.

Answer

Configure the lifecycle policy in the CodeBuild project settings.

Question 16

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is Blue/Green. During a recent deployment, the new instances passed all health checks, but traffic was not routed to them. What is the most likely reason?

Accepted Answer

The target group associated with the Auto Scaling group is not properly configured to route traffic.. In a Blue/Green deployment with CodeDeploy and an Auto Scaling group, traffic routing is handled by a load balancer target group. If the target group is not properly configured to route traffic to the new instances (e.g., missing or incorrect listener rules, deregistration delay, or health check thresholds), the instances may pass health checks but never receive traffic. This is the most likely cause because the deployment succeeded in provisioning and validating the new instances, but the load balancer did not forward requests to them.

Answer

The deployment group is not configured to use a load balancer.

Answer

The Auto Scaling group's lifecycle hook failed to signal readiness.

Answer

The CodeDeploy agent on the new instances is not installed.

Question 17

A company uses AWS Systems Manager to manage a fleet of EC2 instances. During an incident, a DevOps engineer needs to execute a script on a specific instance to collect diagnostic data. The engineer does not have SSH key access. Which approach should the engineer use to execute the script?

Accepted Answer

Use AWS Systems Manager Run Command to execute the script.. AWS Systems Manager Run Command is the correct tool because it lets you execute scripts or commands on managed EC2 instances remotely without SSH, RDP, or any inbound ports open. The instance only needs the SSM Agent and an IAM instance profile with the right permissions, which satisfies the 'no SSH key access' constraint.

Answer

Use AWS OpsWorks to run the script as a Chef recipe.

Answer

Use EC2 Instance Connect to SSH into the instance and run the script.

Answer

Use AWS Systems Manager Session Manager to open a shell and run the script.

Question 18

Which TWO actions can help ensure that an application running on EC2 instances can survive the loss of an entire Availability Zone?

Accepted Answer

Use an Auto Scaling group with multiple Availability Zones. Deploying instances in multiple Availability Zones (AZs) ensures that if one AZ fails, instances in other AZs continue to run. Using an Auto Scaling group with multiple AZs automatically distributes instances across AZs and replaces failed instances, further enhancing resilience. Options B and C are both correct because they achieve multi-AZ deployment. Option A is incorrect because a single AZ is a single point of failure. Option D is incorrect because instance type does not provide AZ resilience. Option E is incorrect because CloudWatch alarms can detect issues but do not distribute instances across AZs.

Answer

Deploy all instances in a single Availability Zone for consistency

Answer

Use a larger instance type to handle more load

Answer

Use CloudWatch alarms to monitor instance health

Question 19

A company is using Amazon RDS for MySQL and needs to monitor the number of slow queries. They have enabled slow query logs. How can they effectively monitor and alert on the number of slow queries per minute?

Accepted Answer

Publish slow query logs to CloudWatch Logs, create a metric filter, and set an alarm.. Slow query logs from RDS MySQL can be published to CloudWatch Logs. Once the logs are in CloudWatch Logs, you can create a metric filter to count the number of slow queries per minute and set a CloudWatch alarm on that metric to alert when the count exceeds a threshold. Option A is incorrect because RDS Events provide notifications about instance events (e.g., failover, maintenance), not slow query metrics. Option B is incorrect because Enhanced Monitoring provides OS-level metrics (e.g., CPU, memory) but not slow query log data. Option C is incorrect because CloudTrail records API calls made to AWS services, not SQL queries executed within RDS.

Answer

Use RDS Events to send slow query metrics to CloudWatch.

Answer

Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.

Answer

Use AWS CloudTrail to monitor SQL queries.

Question 20

A company is using AWS Secrets Manager to store database credentials for a multi-tier application. The application runs on EC2 instances in an Auto Scaling group. The DevOps engineer has configured the instances to retrieve the secret at boot time using a script that calls the AWS CLI. Recently, the security team discovered that the secret was exposed in the instance's user data logs. The engineer needs to implement a more secure method to access the secret without storing it in user data. The application code can be modified. The environment uses IAM roles for EC2. Which solution best meets the security requirements?

Accepted Answer

Modify the application code to use the AWS SDK to retrieve the secret from Secrets Manager using the instance's IAM role.. The most secure and operationally sound approach is to have the application retrieve the secret at runtime using the AWS SDK, authenticating via the EC2 instance profile (IAM role). This eliminates any need to embed the secret in user data, config files, or environment variables, and it leverages Secrets Manager's native rotation, versioning, and audit trail. Because the environment already uses IAM roles for EC2, no additional credential management is required.

Answer

Store the secret in a configuration file on the EC2 instance and encrypt the file system.

Answer

Store the secret in AWS Systems Manager Parameter Store and retrieve it via the AWS CLI at boot time.

Answer

Use a KMS key to encrypt the secret and store the encrypted value in user data.