DOP-C02 Practice Exam 67 — 20 Questions

Question 1

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent connection timeouts when calling an external API. The engineer needs to capture network traffic to diagnose the issue. Which solution is most appropriate?

Accepted Answer

Enable VPC Flow Logs on the ECS task's elastic network interface.. Option D is correct because VPC Flow Logs capture network traffic metadata at the ENI level, which can be analyzed to identify dropped packets or timeouts. Option A is wrong because AWS X-Ray traces requests but does not capture raw network packets. Option B is wrong because CloudWatch Logs does not capture network traffic. Option C is wrong because EC2 instances are not used with Fargate.

Answer

Enable detailed CloudWatch Logs for the ECS task.

Answer

Enable AWS X-Ray tracing on the ECS task.

Answer

Run tcpdump on the EC2 instance hosting the ECS task.

Question 2

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent 503 errors. The engineer suspects the ALB is returning these errors because the target instances are unhealthy. Which metric should the engineer monitor to confirm this suspicion?

Accepted Answer

HealthyHostCount. Option A is correct because the ALB publishes a metric 'HealthyHostCount' that shows the number of healthy targets. If this metric drops to zero, the ALB returns 503 errors. Option B is wrong because 'UnhealthyHostCount' is not a standard ALB metric. Option C is wrong because 'RequestCount' does not indicate health. Option D is wrong because 'TargetResponseTime' does not indicate health status.

Answer

RequestCount

Answer

UnhealthyHostCount

Answer

TargetResponseTime

Question 3

A company has a multi-account AWS organization. The security team needs to detect and respond to security incidents across all accounts centrally. Which THREE services should the team use together? (Choose three.)

Accepted Answer

AWS Security Hub. Option A is correct because GuardDuty provides threat detection across accounts. Option B is correct because Security Hub aggregates findings from multiple services and accounts. Option D is correct because Detective analyzes and investigates security findings. Option C is wrong because Inspector is for vulnerability assessments, not incident response. Option E is wrong because Macie is for data classification, not incident response.

Answer

Amazon Inspector

Answer

Amazon Macie

Question 4

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Review the canary's CloudWatch Logs for error details.. Option A is correct because canary logs are stored in CloudWatch Logs and can be analyzed. Option D is correct because canaries run on Lambda, and Lambda execution logs may contain additional error details. Option B is wrong because CloudTrail does not log canary execution details. Option C is wrong because CloudWatch Metrics do not provide detailed error information. Option E is wrong because the canary code is not accessible for modification.

Answer

Modify the canary script to add more logging.

Answer

Examine CloudWatch metrics for the canary.

Answer

Check CloudTrail for CanaryRun API calls.

Question 5

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?

Accepted Answer

AWS Config and AWS Systems Manager Automation. The correct answer is D. AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance. EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Question 6

A DevOps engineer receives an alert that an Amazon EC2 instance’s CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a step scaling policy based on average CPU. The engineer checks the CloudWatch alarm and sees that it is in the ALARM state. What should the engineer do to verify that the Auto Scaling group is scaling out properly?

Accepted Answer

Review the Auto Scaling group’s activity history in the EC2 console. Option A is correct because checking the Auto Scaling activity history will show if scaling actions were triggered. Option B is wrong because CloudWatch logs show instance logs, not scaling actions. Option C is wrong because the alarm state indicates it’s triggered. Option D is wrong because the scaling policy is for scale-out on high CPU.

Answer

Ensure the scaling policy is configured to scale in

Answer

Check the CloudWatch Logs for the instance

Answer

Verify that the CloudWatch alarm is in INSUFFICIENT_DATA state

Question 7

A DevOps engineer observes the CloudWatch alarm output shown in the exhibit. The alarm is in ALARM state for instance i-0abcd1234efgh5678. The engineer checks the EC2 console and sees that the instance's CPU utilization is currently 10%. What is the MOST likely explanation?

Accepted Answer

The alarm has not yet evaluated enough low datapoints to change state. Option D is correct because the alarm evaluated only 1 datapoint (EvaluationPeriods=1) and the CPU spiked to 100% at 09:55, triggering the alarm. It has since dropped, but the alarm state persists until manually reset or until it transitions to OK after enough low datapoints. Option A is wrong because the metric exists. Option B is wrong because the threshold is 90%. Option C is wrong because the alarm is correctly configured.

Answer

The alarm is misconfigured with wrong metric

Answer

The threshold was set too low

Answer

The CPUUtilization metric is not being emitted

Question 8

A company uses AWS CloudFormation to manage infrastructure. A recent stack update failed with the error 'UPDATE_ROLLBACK_FAILED'. The stack is now in a 'UPDATE_ROLLBACK_FAILED' state, and the engineer needs to fix the stack. What is the correct course of action?

Accepted Answer

Continue the rollback using the 'ContinueUpdateRollback' API. Option A is correct because when a rollback fails, you can continue the rollback (which may skip resources that failed to roll back) or perform a stack operation to fix. Option B is wrong because deleting may not be possible if the stack is stuck. Option C is wrong because you cannot update a stack in rollback failed state without first continuing rollback. Option D is wrong because support can help but is not the direct action.

Answer

Contact AWS Support to fix the stack

Answer

Delete the stack and recreate it

Answer

Submit another stack update with the desired configuration

Question 9

A DevOps engineer receives an alarm that an EC2 instance's status check has failed. The instance is part of an Auto Scaling group. How should the engineer respond?

Accepted Answer

Verify the instance's system and instance status checks, then consider terminating the instance to allow the Auto Scaling group to launch a new one. Option B is correct because if the instance fails status checks, the engineer should verify the instance is healthy and replace it if needed. Option A is wrong because status checks are internal, not security group issues; C is wrong because terminating the instance manually may not be necessary; D is wrong because the Auto Scaling group will launch a new instance only if the instance is terminated or marked unhealthy.

Answer

Immediately terminate the instance to trigger a replacement

Answer

Do nothing, because the Auto Scaling group will automatically replace the instance

Answer

Check the security group rules to ensure they allow traffic

Question 10

A DevOps engineer is troubleshooting a failed deployment. The engineer needs to identify the root cause. Which TWO AWS services can provide information about the deployment events and errors? (Choose two.)

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls for deployments. Option C is correct because AWS Config provides a history of configuration changes. Option A is wrong because Amazon Inspector is for vulnerability assessment. Option D is wrong because AWS Trusted Advisor is for cost optimization and best practices. Option E is wrong because AWS Service Catalog is for managing IT service catalogs.

Answer

AWS Trusted Advisor

Answer

AWS Service Catalog

Answer

Amazon Inspector

Question 11

A company uses AWS Secrets Manager to store database credentials. The security team needs to automatically rotate the secrets every 30 days. Which action should be taken?

Accepted Answer

Enable automatic rotation on the secret and configure the rotation interval to 30 days. Secrets Manager can automatically rotate secrets using a Lambda function. Option A is wrong because rotation is not enabled by default. Option C is wrong because manual rotation is not automatic. Option D is wrong because Systems Manager Parameter Store does not natively rotate secrets.

Answer

Manually rotate the secret every 30 days using the AWS Management Console

Answer

Store the secret in AWS Systems Manager Parameter Store and use a scheduled Lambda to update it

Answer

Use AWS KMS to rotate the secret by re-encrypting with a new key

Question 12

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to the S3 bucket 'my-bucket' without server-side encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. Option A is correct because the policy requires encryption, so the upload will fail with Access Denied. Option B is wrong because the condition requires encryption. Option C is wrong because SSE-S3 uses AES256, but the condition requires it to be set explicitly. Option D is wrong because the policy does not allow unencrypted uploads.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-S3 encryption.

Answer

The upload succeeds and is automatically encrypted with SSE-S3.

Question 13

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. During a deployment, the Auto Scaling group launches new instances, but users experience session loss. What is the most likely cause?

Accepted Answer

The target group's deregistration delay is too short.. The correct answer is D. Sticky sessions are tied to the instance ID. If the ALB target group's deregistration delay is too short, the ALB may route traffic to a new instance before the session is migrated. Session stickiness duration would affect how long sessions persist on the same instance, but not cause loss during deployments. Lifecycle hooks are for custom actions. Health check thresholds affect availability.

Answer

The Auto Scaling group's lifecycle hooks are not configured.

Answer

The stickiness duration is set too low.

Answer

The target group's health check interval is too long.

Question 14

A DevOps engineer receives an alert that an Amazon S3 bucket has become publicly accessible. The engineer needs to identify who made the bucket public. Which AWS service should the engineer use to find the API call that changed the bucket policy?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail records all S3 API calls, including bucket policy changes. Option A is wrong because CloudWatch monitors metrics. Option C is wrong because Config records configuration changes but not the identity. Option D is wrong because GuardDuty detects threats but doesn't log API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 15

A company's production RDS MySQL instance experienced a failover. The DevOps team needs to understand the root cause. Which set of logs should be reviewed first?

Accepted Answer

AWS CloudTrail logs. Option B is correct because RDS events (failover, maintenance) are logged in CloudTrail. Option A is wrong because slow query logs do not record failover events. Option C is wrong because error logs may show errors but not the failover trigger. Option D is wrong because VPC Flow Logs capture network traffic, not database events.

Answer

VPC Flow Logs

Answer

RDS MySQL error logs

Answer

RDS slow query logs

Question 16

During a security incident, a DevOps engineer discovers that an EC2 instance has been compromised. The instance has an IAM role with permissions to access S3 and DynamoDB. Which THREE immediate actions should the engineer take to contain the incident?

Accepted Answer

Stop the EC2 instance. Option A is correct to stop the instance. Option D is correct to detach the IAM role to prevent further actions. Option E is correct to isolate the instance by modifying the security group. Option B is wrong because snapshotting may capture malware. Option C is wrong because terminating destroys evidence.

Answer

Terminate the instance immediately

Answer

Create an AMI of the instance for forensic analysis

Question 17

A company uses AWS CloudFormation to manage infrastructure. An engineer notices that a stack update has failed, leaving the stack in a ROLLBACK_IN_PROGRESS state. Which TWO actions should the engineer take to investigate and resolve the issue?

Accepted Answer

View the stack events in the CloudFormation console to see the specific error message. Options B and D are correct. The engineer should view the stack events to see the specific error, then review the change set to understand what changes were attempted. Option A is wrong because deleting the stack would lose resources; C is wrong because re-launching may repeat the error; E is wrong because stopping rollback is not recommended without understanding the issue.

Answer

Manually stop the rollback and continue with the update

Answer

Re-launch the stack with the same template

Answer

Delete the stack and re-launch it

Question 18

A company uses AWS CloudFormation to deploy a multi-tier web application. During an incident, the stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The operations team needs to investigate the root cause quickly without losing the stack's current state. What is the MOST efficient approach?

Accepted Answer

Use the ContinueUpdateRollback API with the ResourcesToSkip parameter.. Option C is correct because using 'ContinueUpdateRollback' with the 'ResourcesToSkip' parameter allows skipping resources that caused the failure while preserving the stack. Option A is wrong because deleting the stack removes all resources. Option B is wrong because creating a new stack does not help investigate the current failure. Option D is wrong because manually fixing resources and retrying the update without rollback is risky; the stack is already in rollback.

Answer

Create a change set and execute it to see the changes.

Answer

Delete the stack and recreate it using the same template.

Answer

Manually fix the resources and then retry the stack update.

Question 19

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. Option D is correct because AWS Config conformance packs can evaluate whether CloudTrail trails are enabled across accounts using managed rules. Option A is wrong because Trusted Advisor does not monitor CloudTrail configuration across all accounts. Option B is wrong because CloudTrail itself does not monitor trail configuration. Option C is wrong because CloudWatch Events can be used but require custom rules per account; Config is more efficient.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 20

A company is subject to regulatory compliance that requires all access to S3 buckets to be logged and monitored. The company has thousands of buckets. Which solution is MOST scalable and cost-effective?

Accepted Answer

Enable AWS CloudTrail with data events for S3 and send logs to CloudWatch Logs. Using AWS CloudTrail with data events for S3 provides detailed logging. Option B is wrong because S3 server access logs require enabling per bucket and storing in another bucket, which is less scalable. Option C is wrong because Config rules detect but don't log access. Option D is wrong because VPC Flow Logs only capture network traffic, not S3 API calls.

Answer

Enable S3 server access logging on each bucket and aggregate logs into a central bucket

Answer

Use VPC Flow Logs to capture traffic to S3

Answer

Use AWS Config rules to track bucket access and publish to SNS