DOP-C02 Practice Exam 65 — 20 Questions

Question 1

Which TWO strategies can be used to improve the resilience of an application running on Amazon ECS with Fargate? (Select TWO.)

Accepted Answer

Configure the ECS service to place tasks in multiple Availability Zones.. Configuring the ECS service to place tasks in multiple Availability Zones distributes the application across physically separate data centers, so if one AZ fails, the tasks in other AZs continue to run. Option D is correct because implementing a circuit breaker pattern for downstream dependencies prevents cascading failures by detecting faults and failing fast, allowing the system to recover gracefully. Option A is incorrect; using a single subnet for all tasks typically places them in a single Availability Zone, reducing fault tolerance. Option C is incorrect; increasing task memory reservation helps handle peak load but does not improve resilience against failures. Option E is incorrect; scheduled scaling adjusts capacity based on historical patterns and does not handle unexpected spikes or failures.

Answer

Use a single subnet for all tasks to simplify networking.

Answer

Increase the task memory reservation to handle peak load.

Answer

Use scheduled scaling to adjust task count based on historical patterns.

Question 2

A company uses AWS CloudTrail to log API calls. An IAM user's credentials are compromised, and the attacker launches multiple EC2 instances in regions that are not typically used. The security team wants to receive near-real-time notifications of any API calls from this user. What is the MOST effective solution?

Accepted Answer

Create a CloudTrail trail that delivers to CloudWatch Logs, then set up a CloudWatch Events rule to invoke a Lambda function that sends an SNS notification. The most effective solution for near-real-time notifications of specific API calls is to deliver CloudTrail logs to CloudWatch Logs and create a CloudWatch Events (now EventBridge) rule that triggers a Lambda function to send an SNS notification. This provides immediate alerting based on specific API calls, such as RunInstances, from a particular user.

Answer

Create an AWS Config rule that checks for EC2 instances in unauthorized regions

Answer

Configure CloudTrail to deliver logs to an S3 bucket and enable S3 event notifications to SQS

Answer

Use CloudWatch Logs Insights to query CloudTrail logs every 5 minutes and send results via email

Question 3

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team requires that log data be encrypted at rest using a customer-managed AWS KMS key. The logs are currently being delivered, but they are not encrypted. What is the most likely reason?

Accepted Answer

The KMS key policy does not allow the CloudWatch Logs service principal. For CloudWatch Logs to encrypt log data at rest with a customer-managed KMS key, the key policy must grant the CloudWatch Logs service principal the necessary permissions (kms:Encrypt, kms:Decrypt, etc.). If the key policy does not include this, CloudWatch Logs can still ingest the logs but cannot encrypt them, resulting in unencrypted logs. Option A is incorrect: the IAM role for the EC2 instance does not need kms:Encrypt permissions for server-side encryption; that is handled by the CloudWatch Logs service using the key policy. Option B is incorrect because encryption is configured at the log group level, not in the agent. Option C would cause delivery failures, not just lack of encryption.

Answer

The IAM role for the EC2 instance does not have kms:Encrypt permission

Answer

The CloudWatch Logs agent is not configured to encrypt logs

Answer

The KMS key is disabled

Question 4

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to be notified whenever a stack is created, updated, or deleted. They also want to track who made the change. Which combination of services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events (now Events) with SNS. CloudTrail captures CloudFormation API calls (CreateStack, UpdateStack, DeleteStack) and CloudWatch Events can trigger SNS notifications based on those API calls. Option A is wrong because Config rules evaluate resource compliance, not API events. Option C is wrong because S3 event notifications are for S3 objects. Option D is wrong because Lambda alone cannot capture who made the change without CloudTrail integration.

Answer

AWS Config rules and Amazon SNS

Answer

Amazon S3 event notifications and AWS Lambda

Answer

AWS Lambda and Amazon DynamoDB

Question 5

A team uses Terraform to manage AWS infrastructure. After a recent update, a state file shows that a security group rule was created, but the rule does not exist in AWS. Running 'terraform plan' shows no changes. What is the most likely cause?

Accepted Answer

The 'terraform refresh' command was not run before the plan.. If a security group rule was deleted manually from AWS (e.g., via console or CLI), the state file still contains the resource. Without running 'terraform refresh', Terraform does not detect the deletion and assumes the state is accurate. Thus, 'terraform plan' shows no changes because it compares the current state (which still includes the rule) with the configuration (which likely does define it, otherwise plan would show a destroy). If 'terraform refresh' had been run, the state would be updated to remove the rule, and then plan would show a creation. Option A is incorrect because if the rule were imported into state but not defined in configuration, plan would show a destroy. Option C is incorrect because workspace conflicts typically cause state isolation issues, not missing resources. Option D is incorrect because adding a rule manually would create it, not cause it to be missing; the scenario states the rule does not exist in AWS.

Answer

The security group rule was imported into state but not defined in configuration.

Answer

There is a conflict between multiple Terraform workspaces.

Answer

The security group rule was added manually via the AWS console and is not managed by Terraform, causing state to be out of sync.

Question 6

A CodeDeploy deployment group is configured as shown in the exhibit. During a deployment, the deployment fails because the instances are not found. What is the MOST likely reason?

Accepted Answer

The EC2 instances do not have the tag 'Environment' with value 'Production'. The exhibit shows the deployment group is configured to match EC2 instances with the tag 'Environment' set to 'Production'. If the instances do not have this exact tag key-value pair, CodeDeploy cannot find them during the deployment, causing the failure. The error 'instances are not found' directly points to a tag mismatch, not to permissions or load balancer issues.

Answer

The deployment configuration 'CodeDeployDefault.AllAtOnce' is not compatible with in-place deployments

Answer

The service role ARN is incorrect and does not have the necessary permissions

Answer

The load balancer 'my-alb' is not registered with the instances

Question 7

A company runs a production database on Amazon RDS for MySQL. The database experiences a sudden spike in connections, causing the application to time out. The DevOps team needs to diagnose the issue quickly. Which combination of actions should be taken? (Choose two.)

Accepted Answer

Check CloudWatch metrics for DatabaseConnections and CPUUtilization.. Option A is correct because Amazon CloudWatch publishes RDS metrics such as DatabaseConnections (the current number of client sessions) and CPUUtilization, which directly reveal whether the timeout is caused by connection saturation or CPU exhaustion on the instance. Option E is correct because Performance Insights, once enabled, provides a database load view broken down by wait events and top SQL statements, letting the team pinpoint which queries or sessions are consuming resources during the spike. Option B is not appropriate as a diagnostic step because scaling up is a remediation action taken after the root cause is identified, and it may not resolve connection-limit or query-level problems. Option C is wrong because VPC Flow Logs capture IP-level network traffic metadata, not database session counts or query behavior, so they cannot explain an RDS connection spike. Option D is wrong because the RDS console does not provide a per-user active connection breakdown; that level of session detail requires querying performance_schema or using Performance Insights.

Answer

Immediately scale up the RDS instance to handle the load.

Answer

Analyze VPC Flow Logs to identify the source IPs of connections.

Answer

Use the RDS console to view the number of active connections per user.

Question 8

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline includes a source stage (S3), a build stage (CodeBuild) that minifies assets, and a deploy stage that copies files to the production S3 bucket. The deploy stage uses 's3 sync' command. After a recent deployment, some users report seeing old content. What is the MOST likely cause?

Accepted Answer

The website is served through Amazon CloudFront, and the CloudFront distribution cache was not invalidated after the deployment.. The most likely cause is that the static website is served through Amazon CloudFront, and the CloudFront distribution cache was not invalidated after the deployment. Even though the S3 bucket contents are updated via 's3 sync', CloudFront caches objects at edge locations based on TTL settings. Without a cache invalidation request, users continue to receive the old cached content until the TTL expires or the cache is manually cleared.

Answer

The S3 bucket policy blocks public read access, so users get a 403 error.

Answer

The IAM role for CodeBuild does not have permissions to write to the S3 bucket.

Answer

The deploy stage uses 's3 cp' instead of 's3 sync', so new files are not uploaded.

Question 9

A company uses AWS CloudFormation to manage a stack that includes an Auto Scaling group with a LaunchTemplate. The DevOps team wants to update the LaunchTemplate with a new AMI. The stack update fails with the error 'Launch template version does not exist'. What is the most likely cause?

Accepted Answer

The LaunchTemplate version specified in the template was deleted. The error 'Launch template version does not exist' occurs when the CloudFormation template references a specific launch template version number that has been deleted. Launch template versions are immutable but can be deleted, and if the stack template or parameter references a deleted version, the stack update fails.

Answer

The LaunchTemplate was recently modified and the new version is not yet available

Answer

The target group attachment is incorrect

Answer

The Auto Scaling group is using a different launch template

Question 10

A DevOps engineer is designing a CI/CD pipeline for a microservices application using AWS CodePipeline. Each microservice has its own CodeCommit repository. The engineer wants to run unit tests in parallel for all services when any repository receives a push, then run integration tests only after all unit tests pass. Which pipeline structure should the engineer use?

Accepted Answer

Create a single pipeline with a parallel action for unit tests, then a serial stage for integration tests. AWS CodePipeline supports parallel actions within a stage, allowing unit tests for all microservices to run concurrently. After all unit tests succeed, the pipeline transitions to a serial stage for integration tests, ensuring the correct dependency order. This structure minimizes build time while enforcing the required sequential gate.

Answer

Create a single pipeline with a serial stage for unit tests, then integration tests

Answer

Create one pipeline per microservice, each triggering integration tests via SNS

Answer

Use AWS CodeBuild batch builds with a fan-out/fan-in pattern

Question 11

A DevOps engineer needs to manage the configuration of a large number of EC2 instances that are part of a cluster. The instances should have consistent software packages, services, and settings. The engineer wants to use a configuration management tool that integrates with AWS and supports a push-based model. Which service should be used?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct choice because it provides a push-based configuration management model that allows you to remotely and securely execute commands or scripts across a large fleet of EC2 instances without needing SSH access. It integrates natively with AWS, supports consistent software package installation and service management via SSM documents, and is ideal for maintaining configuration consistency in a cluster.

Answer

AWS OpsWorks Stacks

Answer

AWS CodeCommit

Answer

AWS CloudFormation

Question 12

A company uses AWS CodeCommit for source control and wants to enforce that all commits to the main branch are signed. The DevOps team has configured Git commit signing using GPG keys. However, some developers are able to push unsigned commits to main. What should the engineer do to enforce signed commits?

Accepted Answer

Use an AWS CodeCommit trigger with an AWS Lambda function that validates commit signatures and rejects unsigned commits.. AWS CodeCommit does not natively support a 'require signed commits' setting like GitHub or GitLab. To enforce signed commits, you must use a CodeCommit trigger that invokes an AWS Lambda function to validate the GPG signature of each commit pushed to the main branch. The Lambda function can parse the commit object, verify the signature using the developer's public key, and reject the push by returning an error if the commit is unsigned or the signature is invalid.

Answer

Set the 'requireSignedCommits' parameter in the repository configuration to 'true'.

Answer

Configure branch protection rules in IAM to deny push access to main unless the commit is signed.

Answer

Create a repository policy that denies git push actions unless the condition 'codecommit:References' and 'codecommit:SourceIp' match.

Question 13

A company wants to enforce that S3 buckets are not publicly accessible. Which AWS service can continuously monitor and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config continuously records resource configuration changes and evaluates them against Config rules, including the managed rule `s3-bucket-public-read-prohibited` and `s3-bucket-public-write-prohibited`. When a bucket becomes non-compliant, Config can trigger an SSM Automation document (via a remediation action) to automatically block public access, making it the service that both monitors and remediates.

Answer

Amazon Macie

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 14

A DevOps engineer needs to set up a monitoring solution that can detect and alert on unusual patterns in application metrics. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Anomaly Detection [CORRECT] is correct because it applies machine-learning algorithms to a metric's historical baseline and creates an expected-value band, so it can flag unusual patterns in application metrics without requiring manually tuned static thresholds. Amazon CloudWatch Alarms [CORRECT] is correct because it evaluates a metric or an anomaly-detection band against a defined condition and triggers actions such as Amazon SNS notifications, making it the alerting mechanism that works together with anomaly detection. Used together, Anomaly Detection identifies the deviation and CloudWatch Alarms fires the alert, which directly satisfies the requirement to detect and alert on unusual metric patterns. Amazon GuardDuty is a threat-detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity, not application metric patterns. AWS CloudTrail records API activity for auditing and governance, and AWS Config evaluates resource configuration compliance, so neither detects anomalies in application metrics or sends metric-based alerts.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

A developer is using AWS CodeBuild to compile code. The build takes a long time because dependencies are downloaded each time. What can the developer do to reduce build time?

Accepted Answer

Enable caching in the build project to store dependencies in Amazon S3.. Enabling caching in AWS CodeBuild allows the build project to store frequently downloaded dependencies (e.g., Maven, npm, pip packages) in an Amazon S3 bucket. On subsequent builds, CodeBuild retrieves the cached dependencies from S3 instead of re-downloading them from the internet, which significantly reduces build time. This is the most direct and efficient solution for the described problem of repeated dependency downloads.

Answer

Split the build into multiple parallel build actions.

Answer

Use multiple build environments to distribute the work.

Answer

Use a larger compute type for the build project.

Question 16

A company uses AWS Secrets Manager to store database credentials. The security team needs to automatically rotate the secrets every 30 days. Which action should be taken?

Accepted Answer

Enable automatic rotation on the secret and configure the rotation interval to 30 days. AWS Secrets Manager supports automatic rotation of secrets using a Lambda rotation function. By enabling automatic rotation and setting the rotation interval to 30 days, the secret is rotated automatically without manual intervention. This meets the security team's requirement for automatic rotation every 30 days.

Answer

Manually rotate the secret every 30 days using the AWS Management Console

Answer

Store the secret in AWS Systems Manager Parameter Store and use a scheduled Lambda to update it

Answer

Use AWS KMS to rotate the secret by re-encrypting with a new key

Question 17

A DevOps engineer notices that an EC2 instance running a critical application is unresponsive. CloudWatch alarms for CPU utilization and memory usage did not trigger. The engineer checks the system logs and finds an 'Out of memory: Kill process' error. What is the MOST likely cause of the missed alarms?

Accepted Answer

The CloudWatch agent is not installed or configured to collect memory metrics.. The 'Out of memory: Kill process' error indicates the OS OOM killer terminated a process due to memory exhaustion, but the CloudWatch memory alarm did not fire because the default CloudWatch metrics for EC2 do not include memory utilization. Memory metrics are only available if the CloudWatch agent is installed and configured to collect them via the mem_used_percent metric. Therefore, the most likely cause is that the agent was not installed or not configured for memory metrics.

Answer

The instance is using instance store volumes instead of EBS, which prevents metric collection.

Answer

The CloudWatch metrics retention period is set to 1 day, so old alarms were deleted.

Answer

The EC2 instance's root EBS volume is encrypted, blocking CloudWatch agent logs.

Question 18

An e-commerce platform uses Amazon DynamoDB as its primary database. During a flash sale, the application experiences throttling errors. The operations team needs to implement a solution to handle sudden traffic spikes while keeping costs under control. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache read-intensive data.. DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from milliseconds to microseconds, offloading read requests from the main DynamoDB table. During a flash sale, caching read-intensive data (e.g., product details) with DAX reduces the number of read capacity units consumed, helping to avoid throttling while keeping costs under control by not requiring a permanent increase in provisioned capacity.

Answer

Increase the read and write capacity units manually before the sale.

Answer

Switch from on-demand to provisioned capacity with auto scaling.

Answer

Enable DynamoDB Streams and replicate data to a read replica.

Question 19

A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline deploys a critical application. Which security practice should the engineer implement to prevent unauthorized changes to the pipeline?

Accepted Answer

Attach an IAM policy that uses a condition to allow only specific users or roles to modify the pipeline. The most direct preventive control is an IAM policy with a condition that restricts who can call CodePipeline mutation APIs (UpdatePipeline, DeletePipeline, PutApprovalResult, etc.). By scoping permissions to specific users or roles via IAM conditions (e.g., aws:PrincipalArn, aws:SourceVpce), the engineer enforces least privilege and blocks unauthorized modifications at the API layer.

Answer

Encrypt the pipeline artifacts using AWS KMS

Answer

Use SNS to send notifications when the pipeline is updated

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to notify on pipeline changes

Question 20

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

Accepted Answer

The Deny statement's Resource specifies only the objects, not the bucket itself. The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.

Answer

The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'

Answer

The bucket is not versioned, so the policy does not apply to object versions

Answer

The policy uses Deny, but an Allow policy from another statement overrides it