DOP-C02 Practice Exam 67 — 20 Questions

Question 1

A DevOps team is deploying a new web application on AWS Elastic Beanstalk. They want to monitor the application's health and receive notifications when the environment's health status changes to 'Degraded' or 'Severe'. What is the simplest way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch alarm on the 'EnvironmentHealth' metric published by the Elastic Beanstalk environment.. Elastic Beanstalk automatically publishes environment health metrics to Amazon CloudWatch, including the 'EnvironmentHealth' metric which reports values like 0 (Ok), 1 (Info), 5 (Unknown), 10 (NoData), 15 (Warning), 20 (Degraded), and 25 (Severe). Creating a CloudWatch alarm on this metric with a threshold of >= 20 (or specifically for Degraded/Severe) and configuring an SNS notification is the simplest, most direct, and fully managed solution. This requires no custom code, no polling infrastructure, and leverages native AWS integration.

Answer

Use the Elastic Beanstalk management console to manually check the health status twice a day.

Answer

Write a custom script that polls the Elastic Beanstalk DescribeEnvironmentHealth API and sends an email using Amazon SES.

Answer

Configure an AWS CloudTrail trail to monitor Elastic Beanstalk API calls and create a CloudWatch alarm on the trail.

Question 2

A company runs a web application on EC2 instances behind an ALB. To improve resilience, they want to automatically replace failed instances and maintain a minimum number of instances. Which AWS service should be used?

Accepted Answer

Amazon EC2 Auto Scaling. Amazon EC2 Auto Scaling is purpose-built to maintain a desired/minimum number of instances and automatically replace unhealthy ones via health checks integrated with ELB. It continuously monitors instance health and launches replacements when instances fail, ensuring the minimum capacity is preserved. This directly satisfies the resilience requirement without manual intervention.

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Answer

AWS Systems Manager

Question 3

A company wants to centralize audit logs from multiple AWS accounts into a single S3 bucket. The logs must be encrypted at rest using a KMS key. Which solution is the MOST secure and scalable?

Accepted Answer

Configure each account's CloudTrail to send logs to a central S3 bucket with a bucket policy that grants cross-account permissions. Configuring each account's CloudTrail to deliver logs directly to a central S3 bucket with a bucket policy granting cross-account permissions is the most secure and scalable solution. It uses native AWS service integration, avoids custom code, and supports KMS encryption at rest. The bucket policy enforces least privilege and can require SSE-KMS with a specific key.

Answer

Create an IAM role in each account and manually copy logs to a central bucket

Answer

Use Amazon Kinesis Data Firehose to stream logs to S3

Answer

Use AWS Config rules to aggregate logs into a central bucket

Question 4

Refer to the exhibit. An IAM policy is attached to a user. The user requests an object from the 'example-bucket' bucket, specifically from the 'confidential' folder, over HTTP (not HTTPS). The source IP is within the 10.0.0.0/24 range. What will be the result of this request?

Accepted Answer

Denied, because the request uses HTTP and the Deny statement blocks it.. The IAM policy includes a Deny statement that blocks s3:GetObject when the request is not over HTTPS (aws:SecureTransport is false). Since the request uses HTTP, the condition evaluates to true and the explicit Deny overrides any Allow. Therefore the request is denied regardless of the source IP being in the allowed range.

Answer

Denied, because the user does not have s3:GetObject permission on the confidential folder.

Answer

Allowed, because the Deny statement only applies to HTTPS.

Answer

Allowed, because the source IP is within the allowed range.

Question 5

A company wants to visualize the performance of their application running on EC2. They need to create a dashboard that shows CPU utilization, memory usage, and disk I/O. Which AWS service should they use?

Accepted Answer

Amazon CloudWatch Dashboards.. Amazon CloudWatch Dashboards is the correct choice because it is the native AWS service for visualizing operational metrics such as CPU utilization, memory usage, and disk I/O. CloudWatch collects these metrics from EC2 instances (with the CloudWatch agent required for memory and disk metrics at the OS level) and allows you to create customizable, shareable dashboards. It supports cross-account, cross-region views and integrates with alarms and logs, making it the standard tool for performance monitoring. The other services do not provide metric visualization for EC2 performance.

Answer

AWS CloudTrail.

Answer

AWS Systems Manager.

Answer

Amazon QuickSight.

Question 6

An application on EC2 instances in an Auto Scaling group uses an ALB. The ALB health checks are failing for some instances, but the instances are healthy from the OS perspective. What is the most likely cause?

Accepted Answer

The security group for the instances does not allow traffic from the ALB. ALB health checks originate from the ALB's nodes and require the instance's security group to permit inbound traffic on the health check port and protocol from the ALB's security group. If the security group does not allow this traffic, the health check fails even though the OS and application are healthy. This is the most common cause of ALB health check failures when instances are otherwise reachable.

Answer

The ALB idle timeout is too low

Answer

The Auto Scaling group cooldown period is too short

Answer

The ALB cross-zone load balancing is disabled

Question 7

A company has a serverless application using AWS Lambda functions and Amazon API Gateway. The application has been running fine, but recently users report that some requests are timing out with a 504 error. The Lambda function's timeout is set to 30 seconds, and API Gateway's integration timeout is 29 seconds. The CloudWatch logs for the Lambda function show that the function executes in under 5 seconds on average. What is the MOST likely cause of the 504 errors?

Accepted Answer

The Lambda function is experiencing concurrency limits and requests are being throttled.. Even though the Lambda function runs in under 5 seconds, if it is throttled due to concurrency limits, the function may not be invoked until after API Gateway's 29-second integration timeout has passed. This causes API Gateway to return a 504 error. Option A is incorrect because excessive logging does not cause 504 errors; it may affect performance but not directly cause timeouts. Option B is incorrect because the Lambda timeout (30s) is actually higher than API Gateway's integration timeout (29s), so the function could complete before API Gateway times out. Option D is incorrect because cold starts typically add only a second or two, not enough to exceed the 29-second integration timeout when average execution is under 5 seconds.

Answer

The Lambda function is logging too much data, causing delays in log delivery.

Answer

API Gateway's timeout is set to less than the Lambda function's timeout.

Answer

The Lambda function's memory is too low, causing cold starts to take longer than the timeout.

Question 8

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project can access a private Amazon S3 bucket to download build artifacts? (Choose two.)

Accepted Answer

Add a bucket policy that explicitly allows access from the CodeBuild project's IAM role ARN. A bucket policy can explicitly grant access to the CodeBuild project's IAM role ARN, allowing the CodeBuild service to download objects from the private S3 bucket. This is a common method to cross-account or service-specific access without making the bucket public.

Answer

Generate an access key and secret key for the CodeBuild project to use in the buildspec

Answer

Configure the CodeBuild project to run in a VPC with an S3 VPC endpoint

Answer

Make the S3 bucket publicly readable

Question 9

A DevOps engineer is troubleshooting an AWS Lambda function that is intermittently timing out. The function is configured with a 3-second timeout and 128 MB memory. The function processes messages from an SQS queue. What is the most cost-effective change to reduce timeouts?

Accepted Answer

Increase the function memory to 256 MB. Increasing the memory to 256 MB is the most cost-effective change because Lambda allocates CPU proportionally to memory, so doubling the memory from 128 MB to 256 MB also doubles the CPU performance. This reduces execution time, which can resolve timeouts without increasing the timeout duration, and since Lambda billing is based on compute time (GB-seconds), the total cost may stay the same or even decrease if the function finishes faster.

Answer

Increase the SQS batch size to 20

Answer

Increase the function timeout to 10 seconds

Answer

Set reserved concurrency to 10

Question 10

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to ensure that infrastructure changes are reviewed and approved before deployment. The code is stored in AWS CodeCommit, and the pipeline uses AWS CodePipeline and AWS CloudFormation. What is the BEST way to implement an approval process for infrastructure changes?

Accepted Answer

Add a manual approval step in CodePipeline between the build and deploy stages.. A manual approval step in CodePipeline is the native, purpose-built mechanism for gating a pipeline stage on human review. CodePipeline pauses execution and sends an SNS notification to designated approvers; the pipeline resumes only after an approver acts in the console or via the API. This directly satisfies the requirement that infrastructure changes be reviewed and approved before CloudFormation deploys them, and it integrates cleanly with the existing CodeCommit/CodePipeline/CloudFormation toolchain.

Answer

Use CodeCommit approval rules to require a pull request before any change is merged.

Answer

Configure IAM policies to require MFA before any CloudFormation stack update.

Answer

Use CodeBuild to run a script that sends an approval request via Amazon SNS and waits for a response.

Question 11

A company has a microservices architecture running on Amazon ECS with Fargate launch type. Each service is deployed in multiple Availability Zones. The services communicate via REST APIs. Recently, a downstream service experienced a partial outage, causing upstream services to time out and leading to cascading failures. The team wants to improve resilience against such failures. Which combination of actions should the DevOps engineer take? (Choose TWO.)

Accepted Answer

Implement circuit breaker patterns in the service clients.. Option B is correct because a circuit breaker in the service clients detects repeated failures from a downstream dependency and trips open, failing fast instead of letting upstream threads block on slow REST calls, which directly prevents the timeout propagation and cascading failures described. Option D is correct because moving to asynchronous communication with Amazon SQS or Amazon EventBridge decouples services: upstream services enqueue or publish events and return immediately, so a partial outage in a downstream consumer no longer blocks callers, and messages can be retried or buffered until the consumer recovers. Option A is not appropriate because increasing HTTP timeouts makes callers wait longer, consuming threads and connections and worsening cascading failures rather than containing them. Option C is wrong because removing retry logic eliminates a useful resilience mechanism for transient errors; retries should be bounded and combined with circuit breakers and backoff, not deleted. Option E is not the right fix because scaling on request count does not address a downstream dependency that is failing or slow, and could even amplify load against the impaired service.

Answer

Increase the HTTP timeout values for all service-to-service calls.

Answer

Remove all retry logic from service calls.

Answer

Configure Auto Scaling for all services based on request count.

Question 12

A company is implementing a CI/CD pipeline for a microservices architecture on Amazon ECS. The pipeline must deploy to multiple environments (dev, test, prod) in sequence with manual approval gates between environments. Which two AWS services should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS CodePipeline. AWS CodePipeline (A) is correct because it provides the orchestration framework to model the CI/CD pipeline with sequential stages for dev, test, and prod environments, including built-in support for manual approval gates between stages. AWS CodeDeploy (D) is correct because it integrates directly with CodePipeline to handle the actual deployment of containerized applications to Amazon ECS, supporting blue/green deployments and traffic shifting for microservices.

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Question 13

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The target group health checks are failing. The DevOps engineer checks the instance logs and finds that the application is running but taking longer than 30 seconds to respond. What is the MOST likely cause?

Accepted Answer

The health check timeout is set too low, causing the ALB to mark instances unhealthy.. The most likely cause of intermittent 503 errors and failing health checks is that the health check timeout is set too low. The application takes longer than 30 seconds to respond, but if the health check timeout is set to a value less than the application response time, the ALB will mark the instance as unhealthy, leading to 503 errors. Adjusting the health check timeout to accommodate the application's response time would resolve the issue.

Answer

The Auto Scaling group's scaling policy is too aggressive, causing frequent instance replacements.

Answer

The security group for the ALB does not allow inbound traffic from the internet.

Answer

The EC2 instances are running out of memory and the application is crashing.

Question 14

A DevOps engineer is tasked with centralizing logs from multiple AWS accounts into a single Amazon OpenSearch Service domain. The engineer sets up Amazon Kinesis Data Firehose to deliver logs from each account to the OpenSearch domain. However, some accounts show failed deliveries in the Firehose console. Which configuration is MOST likely causing the failures?

Accepted Answer

The IAM role assumed by Firehose in each account does not have permissions to write to the cross-account OpenSearch domain. The most likely cause of failed deliveries is that the IAM role assumed by Kinesis Data Firehose in each source account lacks the necessary permissions to write to the cross-account Amazon OpenSearch Service domain. Firehose uses a service-linked or custom IAM role to perform actions such as `es:ESHttpPut` and `es:ESHttpPost` against the OpenSearch domain endpoint. Without explicit cross-account trust and resource-based policy allowing the Firehose role's ARN, the delivery will fail with an authorization error.

Answer

The source accounts do not have a CloudWatch Logs subscription filter to send logs to Firehose

Answer

The Kinesis Data Streams used as the Firehose source is not encrypted

Answer

The OpenSearch domain's access policy does not allow access from the S3 bucket used by Firehose

Question 15

A company manages a fleet of EC2 instances using AWS Systems Manager State Manager. They have a State Manager association that ensures a specific software package is installed on all instances. Recently, they noticed that some instances are reporting the association as 'Success' even though the software is not installed. The association uses a custom document that runs a script to install the package. The engineer checks the association execution history and sees that the script exited with code 0 on those instances. What is the most likely cause?

Accepted Answer

The script does not check the exit code of the installation command and always returns 0.. The script likely does not check the exit code of the installation command and always returns 0, so State Manager reports success even when installation fails. Option A is incorrect because the association is running on those instances, as shown by execution history. Option B is incorrect because compliance data is being sent (the 'Success' status is reported). Option C is incorrect because the association runs, indicating SSM Agent is installed.

Answer

The association is not targeting those instances.

Answer

The instances are not configured to send compliance data to Systems Manager.

Answer

The instances do not have the SSM Agent installed.

Question 16

A DevOps team is deploying a web application on EC2 instances behind an ALB. The application must authenticate users using an external identity provider (IdP) that supports SAML 2.0. Which solution provides the simplest integration with the ALB?

Accepted Answer

Configure the ALB to use an SAML identity provider for authentication. The Application Load Balancer (ALB) natively supports SAML 2.0 identity provider (IdP) authentication. This allows the ALB to offload user authentication at the edge, validating SAML assertions directly and forwarding authenticated requests to the target EC2 instances without any application-level changes. This is the simplest integration as it requires no additional infrastructure or code on the EC2 instances.

Answer

Use Amazon Cognito user pools with SAML federation and integrate with ALB

Answer

Use AWS CloudFront with Lambda@Edge to validate SAML tokens

Answer

Install a SAML service provider library on each EC2 instance

Question 17

A developer is using AWS CodeCommit as a source repository for a CodePipeline. They want to automatically start the pipeline when changes are pushed to the main branch. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that triggers the pipeline on CodeCommit 'push to main' events.. Amazon EventBridge can natively capture CodeCommit repository events, such as 'push to main', and directly trigger a CodePipeline execution without any custom code or polling. This is the simplest and most serverless approach, as it requires no additional infrastructure or manual configuration of webhooks.

Answer

Add a Lambda function that is invoked by CodeCommit triggers, which then starts the pipeline.

Answer

Configure the pipeline to poll the CodeCommit repository every 5 minutes.

Answer

Use a webhook from CodeCommit to the pipeline.

Question 18

A company is using Amazon CloudWatch Logs to store application logs. The DevOps engineer needs to ensure that log data is encrypted at rest using a customer-managed KMS key. What step must be taken?

Accepted Answer

Create a new KMS customer-managed key and associate it with the CloudWatch Logs log group.. CloudWatch Logs supports encryption at rest using a customer-managed KMS key, which must be explicitly associated with the log group. When you create or update a log group, you can specify a KMS key ID (via the AWS CLI, SDK, or console) to encrypt all log data stored in that group. This ensures that the log data is encrypted using a key you control, not the default AWS-managed key.

Answer

Use AWS CloudTrail to encrypt the log data before it is sent to CloudWatch Logs.

Answer

Create a KMS key and apply it to the IAM role used by the application.

Answer

Enable server-side encryption on the log group using the default CloudWatch Logs key.

Question 19

A company uses Amazon S3 to store sensitive data. The security team wants to be notified when an S3 bucket policy is modified. Which approach is most efficient?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'PutBucketPolicy' API call and sends a notification to an SNS topic.. Amazon EventBridge can match AWS API calls such as PutBucketPolicy via CloudTrail management events and route them to an SNS topic for notification. This is the most efficient, near-real-time, event-driven approach for alerting on bucket policy changes.

Answer

Set up an AWS Config rule to detect changes to the bucket policy.

Answer

Configure S3 event notifications for 's3:PutBucketPolicy' on the bucket.

Answer

Enable S3 server access logs and use CloudWatch Logs Insights to run queries periodically.

Question 20

A company is designing a CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy. They need to ensure that the pipeline can deploy to multiple environments (dev, test, prod) with manual approval gates. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create separate stages in the pipeline for dev, test, and prod. AWS CodePipeline allows you to define separate stages for each environment (dev, test, prod) within a single pipeline. This enables sequential or parallel deployments with clear separation of concerns, and each stage can have its own actions, such as deployment to a specific CodeDeploy application or environment. Option D is correct because you can add a manual approval action as a stage gate before each environment deployment, ensuring that a human reviewer must explicitly approve the promotion before the pipeline proceeds to the next environment.

Answer

Configure a single pipeline with multiple branches in the source stage

Answer

Use CodeDeploy deployment groups to represent each environment

Answer

Use CodeBuild batch builds to manage environment promotion