DOP-C02 Practice Exam 66 — 20 Questions

Question 1

A company uses Amazon Route 53 to route traffic to an Application Load Balancer. They want to improve availability by routing traffic to multiple ALBs in different AWS Regions. Which routing policy should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Latency-based routing policy. Latency-based routing policy uses AWS-measured round-trip time data to direct each user to the AWS Region offering the fastest response, and each record can have an associated Route 53 health check; when the primary region's endpoint fails its health check, Route 53 automatically routes to the next lowest-latency healthy region. This combination of performance optimization and health-aware failover, without manual intervention, makes it the best fit for improving availability and performance across multiple regional ALBs. (Note: weighted routing policy also supports per-record health checks and will automatically exclude an unhealthy endpoint from rotation, redistributing traffic among the remaining healthy weighted records -- it is not correct that weighted routing requires manual updates to fail over.)

Answer

Weighted routing policy

Answer

Geolocation routing policy

Answer

Simple routing policy

Question 2

A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own CodeCommit repository and must be built and deployed independently. The team wants to minimize manual configuration and ensure that adding a new microservice automatically creates the corresponding pipeline stages. Which approach should the team use?

Accepted Answer

Define a CloudFormation template that creates a pipeline for a given repository and invoke it automatically when a new repository is created using EventBridge and Lambda.. It uses an event-driven approach: EventBridge detects the creation of a new CodeCommit repository, triggers a Lambda function that invokes a CloudFormation template to create a corresponding CodePipeline. This fully automates pipeline provisioning for new microservices without manual intervention, aligning with the requirement to minimize manual configuration.

Answer

Create a separate AWS CodePipeline for each microservice manually using the AWS Management Console.

Answer

Use the AWS Cloud Development Kit (CDK) to define a pipeline that dynamically discovers repositories.

Answer

Use a single AWS CodePipeline with multiple stages, each triggered by a different branch of the same repository.

Question 3

A company runs a high-traffic e-commerce application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an in-memory cache on the EC2 instances. During a recent deployment, the Auto Scaling group terminated an instance that had active user sessions, causing users to lose their cart data and leading to a poor customer experience. The company wants to prevent this in future deployments. They need a solution that allows existing sessions to complete before instance termination, without manual intervention. Which solution should they use?

Accepted Answer

Implement an Auto Scaling lifecycle hook that puts the instance in a 'terminating:wait' state, and have a script on the instance that signals completion after draining sessions.. An Auto Scaling lifecycle hook puts the instance into a 'terminating:wait' state when the ASG decides to terminate it, pausing the termination process. A script on the instance can then drain active sessions (e.g., finish processing requests, flush cart data to a persistent store) and call CompleteLifecycleAction to signal completion, after which the ASG proceeds with termination. This is the only option that provides a programmable, instance-level mechanism to gracefully complete sessions before termination without manual intervention.

Answer

Increase the Auto Scaling group's cooldown period and health check grace period.

Answer

Enable connection draining on the ALB target group and increase the deregistration delay.

Answer

Change the health check type to ELB and mark instances unhealthy before deployment.

Question 4

A company uses AWS OpsWorks for configuration management. They want to ensure that whenever a new instance is added to a layer, it automatically installs the latest security patches and joins a central logging system. What is the most efficient way to achieve this?

Accepted Answer

Use Chef recipes in a custom OpsWorks layer's Setup lifecycle event.. AWS OpsWorks uses Chef recipes to automate configuration management. The Setup lifecycle event runs on every instance when it is added to a layer, making it the correct place to install security patches and configure the logging agent. This ensures consistency and automation without manual intervention, and it is the native OpsWorks mechanism for bootstrapping instances.

Answer

Schedule a cron job on each instance to check and apply patches daily.

Answer

Configure user data scripts in the launch configuration.

Answer

SSH into each instance and run the commands manually.

Question 5

A company wants to centralize IAM user management across multiple AWS accounts. The company currently uses individual IAM users in each account. What is the BEST practice for centralized access control?

Accepted Answer

Use AWS Organizations and AWS IAM Identity Center (AWS SSO) to manage users centrally.. AWS IAM Identity Center (successor to AWS SSO) combined with AWS Organizations is the AWS-recommended best practice for centralizing workforce identity and access across multiple accounts. It provides a single place to manage users and groups, assign permission sets to accounts/OUs, and federate to external IdPs if desired — eliminating per-account IAM user sprawl. This is the canonical 'centralized access management' answer for multi-account environments.

Answer

Create the same IAM users in each account with identical permissions.

Answer

Create IAM roles in each account and allow cross-account access from a central account.

Answer

Use IAM federation with an external identity provider and assign permissions based on SAML attributes.

Question 6

A DevOps team wants to run unit tests in parallel across multiple build environments using AWS CodeBuild. Which build specification configuration allows this?

Accepted Answer

Define a batch build with multiple builds.. AWS CodeBuild supports batch builds, which allow you to define a build project that runs multiple builds in parallel. By specifying a batch configuration in your buildspec file (using the `batch` section), you can run unit tests across multiple build environments simultaneously, improving test execution speed and resource utilization.

Answer

Use multiple build phases in the buildspec file.

Answer

Configure multiple artifacts in the buildspec.

Answer

Set environment variables to run multiple commands concurrently.

Question 7

A company uses AWS Elastic Beanstalk to manage its web application. The DevOps team wants to customize the Amazon EC2 instances launched by Elastic Beanstalk. Which two methods can they use to achieve this? (Choose TWO.)

Accepted Answer

Use .ebextensions configuration files in the application source bundle to install packages and run commands.. `.ebextensions` configuration files allow you to customize the EC2 instances launched by Elastic Beanstalk by installing packages, running commands, and configuring services during instance provisioning. These YAML or JSON files are placed in the `.ebextensions` folder of your application source bundle and are executed by the Elastic Beanstalk platform as part of the instance initialization process, providing a native and supported customization mechanism.

Answer

Use AWS OpsWorks to manage the instances instead of Elastic Beanstalk.

Answer

Add user data to the Auto Scaling group launch configuration that Elastic Beanstalk creates.

Answer

Modify the CloudFormation template generated by Elastic Beanstalk directly.

Question 8

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create an EC2 instance with a custom AMI. The error message indicates that the AMI ID does not exist. The engineer is using a mapping in the template to select the AMI based on the region. However, the stack is being created in a region not covered by the mapping. What is the most efficient way to resolve this issue?

Accepted Answer

Retrieve the AMI ID dynamically using AWS Systems Manager Parameter Store and a dynamic reference in the template.. The most efficient way is to use AWS Systems Manager Parameter Store with a dynamic reference in the CloudFormation template. This allows the AMI ID to be resolved at deployment time based on the region, without hardcoding or maintaining mappings. Option B (creating a new mapping) is less efficient because it requires manual updates for each region. Option C (Run Command) is not designed for parameter retrieval. Option D (hardcoding) is not scalable and error-prone.

Answer

Create a new mapping entry for the region by updating the template.

Answer

Use AWS Systems Manager Run Command to find the correct AMI ID.

Answer

Hardcode the AMI ID in the template for the missing region.

Question 9

An S3 bucket has the above bucket policy. What is the effect of this policy?

Accepted Answer

It denies access to the bucket if the request is not sent over HTTPS. The bucket policy denies access to the bucket if the request is not sent over HTTPS. This is a common security measure to enforce encryption in transit. The policy likely includes a condition that checks 'aws:SecureTransport' and denies if it is false, meaning any non-HTTPS request is blocked.

Answer

It allows anonymous access to the bucket over HTTPS

Answer

It denies all access to the bucket regardless of protocol

Answer

It allows access only from specific IP addresses

Question 10

An organization uses AWS CodePipeline with multiple stages: Source, Build, Deploy to Test, Deploy to Prod. They want to implement a canary deployment strategy for the production deployment. Which approach should they use?

Accepted Answer

Use CodeDeploy with a canary deployment configuration in the Deploy to Prod stage.. AWS CodePipeline integrates natively with CodeDeploy, which supports canary deployments by shifting a percentage of traffic to the new revision over a specified time interval (e.g., 10% every 5 minutes). Using CodeDeploy with a canary configuration in the Deploy to Prod stage directly implements the desired canary strategy within the pipeline, leveraging CodeDeploy's built-in traffic shifting and health monitoring.

Answer

Use a Lambda function in CodePipeline to manually adjust weights in Route53.

Answer

Use an Elastic Load Balancer to gradually shift traffic using weighted target groups.

Answer

Use CloudFormation with a canary update policy in the Deploy to Prod stage.

Question 11

A company has an Amazon RDS for MySQL database that stores sensitive data. The security team requires encryption at rest and in transit. Which combination of options meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and enforce SSL connections. Enabling encryption at rest on the RDS instance (via KMS) and enforcing SSL/TLS connections satisfies both requirements: encryption at rest protects data on disk, and SSL enforcement encrypts data in transit between the client and the database. RDS supports encryption at rest through KMS keys and SSL enforcement via parameter group settings (e.g., require_secure_transport for MySQL).

Answer

Use AWS Certificate Manager to issue a certificate for the RDS instance

Answer

Place the RDS instance in a private subnet and use VPC peering

Answer

Use AWS KMS to encrypt the database before inserting data and decrypt on read

Question 12

A team uses AWS CodePipeline to deploy a microservices application. The pipeline has a deploy action that uses AWS CloudFormation. The CloudFormation template creates an Amazon ECS service. The deployment fails because the ECS service cannot be updated. What is the most likely cause?

Accepted Answer

The CloudFormation stack already exists and is in a previous failed state.. When a CloudFormation stack update fails, the stack enters a ROLLBACK_COMPLETE or UPDATE_ROLLBACK_COMPLETE state. In this state, the stack is considered to be in a 'failed' state and cannot be updated again until it is either deleted or the stack is manually continued with a rollback. CodePipeline's CloudFormation deploy action will attempt to perform a stack update, but CloudFormation rejects the request because the existing stack is in a non-updatable state, causing the pipeline deployment to fail.

Answer

The ECS service is in a steady state and cannot be modified.

Answer

The CodePipeline deploy action is configured with the wrong action type.

Answer

The IAM role used by CloudFormation does not have permission to update ECS services.

Question 13

A company uses AWS CloudFormation to deploy a multi-tier application. The network team manages the VPC and subnets using a separate CloudFormation stack. The application team needs to reference the VPC ID and subnet IDs from the network stack. Which approach should the application team use to obtain these values?

Accepted Answer

Export the VPC ID and subnet IDs from the network stack using the 'Export' field and import them in the application stack using Fn::ImportValue.. CloudFormation's Export and Fn::ImportValue mechanism allows cross-stack references without hardcoding or duplicating values. The network stack exports the VPC ID and subnet IDs using the Export field, and the application stack imports them via Fn::ImportValue, ensuring that changes in the network stack propagate automatically to dependent stacks.

Answer

Hardcode the VPC and subnet IDs in the application template.

Answer

Create the network stack as a nested stack inside the application stack.

Answer

Store the VPC and subnet IDs in AWS Systems Manager Parameter Store and retrieve them using dynamic references.

Question 14

A DevOps engineer is setting up centralized logging for a multi-account environment using AWS Organizations. The engineer needs to aggregate logs from all accounts into a single Amazon S3 bucket. Which TWO steps are necessary?

Accepted Answer

Create a bucket policy on the central S3 bucket that grants permissions to the source accounts.. A bucket policy on the central S3 bucket can grant cross-account permissions to source accounts to write logs. This allows services like CloudTrail and VPC Flow Logs from member accounts to deliver logs directly to the central bucket without requiring IAM roles in each account for reading logs.

Answer

Create IAM roles in each account to allow the central bucket to read logs.

Answer

Enable CloudTrail organization trail in the management account to deliver logs to the central bucket.

Answer

Set up a cross-account subscription in CloudWatch Logs to forward logs to the central account.

Question 15

A company has a security policy requiring that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. The DevOps engineer needs to enforce this policy. What is the simplest way to achieve this?

Accepted Answer

Create an IAM policy that denies all actions unless MFA is present, and attach it to all IAM users or groups.. The simplest enforcement is an IAM policy that denies all actions unless the request is made with MFA, attached to users or groups. This uses the aws:MultiFactorAuthPresent condition key in a Deny statement, which blocks console and API access for users who have not authenticated with MFA. It is a native IAM mechanism requiring no additional services.

Answer

Use Amazon Cognito to require MFA for console access.

Answer

Enable MFA delete on the root account.

Answer

Enable MFA on the S3 bucket policy.

Question 16

A company runs a containerized web application on Amazon ECS with AWS Fargate. The application is critical and requires high availability. The DevOps team has set up an Amazon CloudWatch alarm that triggers an auto scaling action when the average CPU utilization exceeds 75% for 5 minutes. However, during a recent traffic spike, the application became slow and some requests timed out, even though the CloudWatch alarm did not fire. The team checked the ECS service auto scaling configuration and found that the target tracking scaling policy based on average CPU utilization is set with a target value of 75%. The ECS service is configured with a minimum of 2 tasks and a maximum of 10 tasks. Upon investigation, they noticed that the CPU utilization metric for the service remained below 75% during the spike, but the memory utilization was high (over 90%). The application logs show that the tasks were running out of memory, causing garbage collection pauses and slow responses. Which course of action should the DevOps engineer take to prevent this issue in the future?

Accepted Answer

Add a second target tracking scaling policy based on average memory utilization with a target value of 75%.. The issue is that the application is running out of memory, causing performance degradation, but the scaling policy only monitors CPU. To prevent this, you should add a target tracking scaling policy based on memory utilization. This will trigger scaling when memory exceeds the target, providing additional tasks to handle the load and preventing memory exhaustion.

Answer

Decrease the CPU target value to 50% to trigger scaling earlier.

Answer

Increase the minimum number of tasks from 2 to 5 to provide more capacity upfront.

Answer

Increase the task memory limit in the task definition to 8 GB.

Question 17

A company uses AWS CloudFormation to deploy a multi-tier application. During an update, the stack fails and rolls back. The rollback also fails, leaving the stack in UPDATE_ROLLBACK_FAILED state. The operations team needs to resolve this with minimal disruption. What is the MOST efficient approach?

Accepted Answer

Use the 'ContinueUpdateRollback' API or AWS Management Console to retry the rollback.. When a CloudFormation stack is stuck in UPDATE_ROLLBACK_FAILED, the supported recovery path is to call ContinueUpdateRollback (via API, CLI, or console) to resume the rollback, optionally skipping specific resources that are blocking it. This preserves the stack and its resources with minimal disruption.

Answer

Manually modify the resources to match the previous stack state.

Answer

Delete the stack and recreate it from the original template.

Answer

Execute a change set to update the stack to the desired configuration.

Question 18

Your company runs a multi-tier web application on AWS. The web tier consists of EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group across three Availability Zones. The application tier runs on a separate Auto Scaling group of EC2 instances that process requests from the web tier. The database tier uses an Amazon RDS for PostgreSQL Multi-AZ deployment. All application servers write logs to Amazon CloudWatch Logs. Recently, the operations team reported that during peak hours, the web tier experiences intermittent 503 errors. The ALB access logs show that the errors occur when the target group's healthy host count drops to zero momentarily. The Auto Scaling group's minimum and desired capacity is 6, with a maximum of 12. The scaling policy is based on average CPU utilization, with a target of 60%. The health check grace period is 300 seconds. The application health check endpoint returns a 200 status when healthy. The DevOps engineer suspects that the scaling policy is too slow to react to traffic spikes. The engineer wants to implement a more proactive scaling approach. Which solution should the engineer implement?

Accepted Answer

Implement a predictive scaling policy combined with dynamic scaling to proactively adjust capacity based on forecasted traffic.. Predictive scaling uses machine learning to forecast future traffic based on historical patterns and proactively provisions capacity ahead of predicted demand, which directly addresses the slow reaction of reactive CPU-based scaling. Combining predictive scaling with dynamic scaling provides both proactive baseline capacity and reactive adjustments for unexpected spikes. This is the AWS-recommended approach for cyclical traffic patterns with intermittent 503 errors caused by insufficient capacity during peaks.

Answer

Implement a scheduled scaling policy that increases capacity 30 minutes before the expected peak.

Answer

Increase the health check grace period to 600 seconds to give new instances more time to become healthy.

Answer

Switch to a step scaling policy with a lower cooldown period and a greater scaling adjustment.

Question 19

A company is running a production web application on Auto Scaling EC2 instances behind an ALB. They have enabled detailed CloudWatch metrics on the EC2 instances and enabled CloudTrail. Recently, users reported intermittent 503 errors. The operations team reviews CloudWatch dashboards but sees no spike in CPU or memory. What is the MOST likely cause of the 503 errors?

Accepted Answer

The target group has an insufficient number of healthy instances due to health check failures. ALB returns HTTP 503 when no healthy targets are available in the target group to serve the request. If health checks are failing intermittently — due to application-level issues, misconfigured health check paths, or slow responses — targets are marked unhealthy and removed from rotation, leaving insufficient capacity and producing 503s. Because CPU and memory show no spike, the cause is not resource saturation but target availability.

Answer

Insufficient CloudTrail logging trail configuration

Answer

Detailed monitoring is disabled for the EC2 instances

Answer

The security group for the ALB is misconfigured

Question 20

A security audit reveals that an S3 bucket contains objects that are not encrypted. The bucket is configured with default encryption using SSE-S3. What is the most likely reason that objects are unencrypted?

Accepted Answer

The objects were uploaded before default encryption was enabled. S3 default encryption (SSE-S3) applies only to objects uploaded after the setting is enabled; it does not retroactively encrypt existing objects. Therefore, objects that appear unencrypted were most likely uploaded before default encryption was turned on. This is a common audit finding in buckets with historical data.

Answer

The objects were uploaded with server-side encryption using AWS KMS

Answer

The bucket policy denies SSE-S3 encryption

Answer

The objects were uploaded with SSE-C