DOP-C02 Practice Exam 68 — 20 Questions

Question 1

Refer to the exhibit. A CloudWatch alarm is configured for an EC2 instance. The CPU utilization exceeds 80% for two consecutive minutes. What action will occur?

Accepted Answer

The instance will be recovered.. Option C is correct because the alarm action is 'ec2:recover', which initiates instance recovery. Option A is wrong because the action is recover, not reboot. Option B is wrong because the alarm does not stop the instance. Option D is wrong because the alarm evaluates every 60 seconds, not 2 minutes as a total period.

Answer

No action will be taken because the period is 60 seconds.

Answer

The instance will be rebooted.

Answer

The instance will be stopped.

Question 2

Which TWO actions should be taken to ensure a highly available and resilient architecture for a critical web application on AWS? (Choose two.)

Accepted Answer

Use an Auto Scaling group to maintain a desired number of instances.. Correct: A and D. Deploying across multiple Availability Zones provides resilience against AZ failures. Using an Auto Scaling group ensures capacity is maintained. Option B provides read scalability but not write availability. Option C is for disaster recovery, not immediate availability. Option E is for performance, not availability.

Answer

Enable Amazon CloudFront with multiple origins.

Answer

Use a Multi-AZ RDS deployment with read replicas.

Answer

Store backups in a different AWS Region.

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all accounts automatically forward their CloudWatch Logs to a central logging account. Which solution should the team implement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a subscription filter and Lambda function in each account. Option A is correct because a CloudFormation StackSet can deploy log forwarding resources across all accounts in the organization. Option B is wrong because Organizations does not forward logs on its own. Option C is wrong because Service Catalog is for provisioning products. Option D is wrong because Config aggregates configuration data, not logs.

Answer

Enable AWS Config aggregator in the central account

Answer

Use AWS Service Catalog to create a product for log forwarding

Answer

Configure AWS Organizations to automatically forward logs

Question 4

An application running on an EC2 instance in a private subnet needs to access an S3 bucket. The instance has an IAM role with S3 access. However, the application is failing with timeout errors. The security group allows all outbound traffic, and the NACL allows outbound ephemeral ports. What is the most likely cause?

Accepted Answer

No VPC endpoint for S3. Option D is correct because a VPC endpoint for S3 (Gateway or Interface) is needed for private subnet access to S3 without NAT. Option A is wrong because the routing table is not typically an issue for S3 access via Internet Gateway. Option B is wrong because the IAM role is already configured. Option C is wrong because no proxy is required.

Answer

Missing route in the route table to an Internet Gateway

Answer

IAM role does not have correct trust policy

Answer

Missing HTTP proxy configuration

Question 5

A company's production EC2 instance running a web application becomes unresponsive. The operations team checks CloudWatch metrics and sees a CPU Utilization spike to 100% for the last 10 minutes. What is the MOST efficient first step to restore service?

Accepted Answer

Reboot the EC2 instance from the AWS Management Console or CLI. Option B is correct because restarting the EC2 instance is the quickest way to restore service when the instance is unresponsive. Option A is wrong because creating an AMI takes time; option C is wrong because investigating CloudWatch Logs delays restoration; option D is wrong because terminating the instance without recovery would cause data loss.

Answer

Check the instance's system logs in CloudWatch Logs to identify the root cause

Answer

Create an AMI of the instance and launch a new instance from that AMI

Answer

Terminate the instance and launch a new one from the latest AMI

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer. The application is experiencing intermittent 503 errors. The DevOps team suspects that the target group's health check settings may be causing healthy instances to be marked as unhealthy. Which THREE configurations should the team review?

Accepted Answer

Health check interval. Options A, C, and E are correct. Health check path, interval, and threshold all affect how the ALB determines instance health. Option B is wrong because cross-zone load balancing does not affect health checks; D is wrong because stickiness is about session persistence.

Answer

Stickiness setting

Answer

Cross-zone load balancing setting

Question 7

A company's production environment uses an Amazon ElastiCache Redis cluster for session caching. The operations team reports that the cache hit ratio has dropped significantly, causing increased load on the backend database. What is the MOST likely cause?

Accepted Answer

The cache is under memory pressure and evicting keys to make room.. Option B is correct because a dropped cache hit ratio often indicates that cached keys are being evicted due to memory pressure, especially if the eviction policy is set to 'allkeys-lru' or similar. Option A is wrong because a cluster mode change would cause a temporary disruption but not necessarily a sustained drop in hit ratio. Option C is wrong because a network partition would cause complete cache unavailability, not just a drop in hit ratio. Option D is wrong because encryption in transit does not affect cache performance.

Answer

The cluster was resized from a single node to a cluster mode.

Answer

The encryption in transit was enabled, adding latency.

Answer

There is a network partition between the application and the cache.

Question 8

A DevOps engineer notices that an Amazon RDS for MySQL instance has failed over to a standby replica. The engineer needs to identify the root cause by examining metrics. Which AWS service should the engineer use to view the database load, replication lag, and failover events?

Accepted Answer

Amazon CloudWatch. Option B is correct because Amazon RDS integrates with CloudWatch to monitor metrics like DatabaseConnections, ReplicaLag, and failover events. Option A is wrong because CloudTrail records API calls but not database-level metrics. Option C is wrong because VPC Flow Logs capture network traffic, not database metrics. Option D is wrong because Trusted Advisor provides best-practice checks, not real-time metrics.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Trusted Advisor

Question 9

A company uses AWS Lambda with an Amazon DynamoDB trigger. Recently, the Lambda function started failing with 'ProvisionedThroughputExceededException' errors. The DevOps team needs to mitigate the issue. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Increase the DynamoDB table's write capacity. Option B is correct because increasing DynamoDB write capacity reduces throttling. Option D is correct because reducing the batch size lowers the number of writes per invocation. Option A is wrong because Lambda concurrency is not the issue; DynamoDB is throttling. Option C is wrong because DynamoDB Streams is required for the trigger; disabling it stops the trigger. Option E is wrong because enabling DynamoDB Accelerator (DAX) is for reads, not writes.

Answer

Increase the Lambda function's reserved concurrency

Answer

Disable DynamoDB Streams on the table

Answer

Enable DynamoDB Accelerator (DAX) for the table

Question 10

A company uses Amazon CloudWatch Logs to collect application logs from EC2 instances. The security team requires that log data be encrypted at rest using a customer-managed AWS KMS key. The logs are currently being delivered, but they are not encrypted. What is the most likely reason?

Accepted Answer

The IAM role for the EC2 instance does not have kms:Encrypt permission. Option C is correct because the CloudWatch Logs role must have kms:Encrypt permission to use CMK. Option A is wrong because KMS key policies allow IAM policies but IAM policies must grant permissions. Option B is wrong because the CMK must be enabled, but that's not the typical issue. Option D is wrong because encryption is applied at log group level, not at the agent level.

Answer

The CloudWatch Logs agent is not configured to encrypt logs

Answer

The KMS key is disabled

Answer

The KMS key policy does not allow the CloudWatch Logs service principal

Question 11

A company experiences an unexpected spike in network traffic to a web application hosted on EC2 instances behind an Application Load Balancer. The DevOps team needs to investigate the source IP addresses generating the traffic. Which AWS service should they use to capture the traffic?

Accepted Answer

VPC Flow Logs. Option B is correct because VPC Flow Logs capture IP traffic information including source and destination IPs. Option A is wrong because CloudTrail logs API calls, not network traffic; C is wrong because CloudWatch Logs captures application logs; D is wrong because AWS Config records resource configuration changes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A DevOps engineer receives a CloudWatch alarm that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance hosts a critical web application. What is the MOST appropriate immediate response to mitigate performance impact?

Accepted Answer

Place the instance into an Auto Scaling group with a scale-out policy based on CPU utilization.. Option A is correct because adding the instance to an Auto Scaling group with a scaling policy to launch additional instances can handle increased load. Option B is wrong because rebooting causes downtime and does not address the root cause of high CPU. Option C is wrong because increasing the instance size manually requires a stop and start, causing downtime. Option D is wrong because creating a new AMI and launching a new instance is time-consuming and not immediate.

Answer

Reboot the EC2 instance to clear any temporary processes.

Answer

Create a new AMI from the instance and launch a new larger instance.

Answer

Stop the instance and change its type to a larger instance size.

Question 13

A DevOps engineer is investigating a security incident where an EC2 instance was compromised. The engineer needs to collect forensic data without losing volatile information. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Create a snapshot of the attached EBS volumes.. Option B is correct because taking a snapshot of the EBS volume preserves the disk state for analysis. Option C is correct because collecting memory dump captures volatile data like running processes and network connections. Option A is wrong because terminating the instance destroys evidence. Option D is wrong because detaching the volume stops the instance, but if the instance is stopped, memory is lost; better to snapshot while running. Option E is wrong because the instance metadata is not volatile and can be retrieved later.

Answer

Detach the EBS volumes and attach them to a forensic instance.

Answer

Retrieve the instance metadata from the console.

Answer

Terminate the instance immediately to prevent further access.

Question 14

A DevOps engineer receives an alert that an Amazon ECS service is failing to start tasks. The service uses the Fargate launch type. The task definition includes a container that requires port 8080. The security group associated with the service allows inbound traffic on port 8080. What should the engineer check NEXT?

Accepted Answer

Verify that the VPC subnets have a route to a NAT Gateway or Internet Gateway.. Option B is correct because Fargate tasks require a VPC and subnets with outbound internet access (NAT Gateway or Internet Gateway) to pull images from ECR or Docker Hub. Option A is wrong because CPU/memory limits would cause tasks to fail with resource errors, not prevent starting. Option C is wrong because the security group is already configured. Option D is wrong because the task definition is already defined.

Answer

Confirm that the task definition's container image exists in ECR.

Answer

Check if the task definition has sufficient CPU and memory allocated.

Answer

Review the security group rules for outbound traffic.

Question 15

An application running on Amazon EC2 instances in an Auto Scaling group is experiencing intermittent connectivity issues. The DevOps team suspects a security group configuration problem. Which approach should the team use to analyze security group traffic and identify denied requests?

Accepted Answer

Enable VPC Flow Logs and query Amazon Athena. Option C is correct because VPC Flow Logs can capture all traffic (accepted and rejected) and be analyzed to find denied connections. Option A is wrong because Security Hub aggregates security findings but does not log traffic. Option B is wrong because CloudTrail logs API calls, not network traffic. Option D is wrong because Config records resource configurations, not traffic.

Answer

Use AWS Config to review security group rules

Answer

Check AWS CloudTrail for security group modification events

Answer

Enable AWS Security Hub and review the security findings

Question 16

A company uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is experiencing intermittent HTTP 503 errors. The DevOps team needs to diagnose the cause. Which THREE of the following should the team investigate? (Choose THREE.)

Accepted Answer

Auto Scaling group minimum capacity and scaling policy. Option A is correct because if the instances are unhealthy, the ALB returns 503. Option C is correct because insufficient instances cannot handle the load. Option E is correct because idle timeout can cause premature connection closure leading to 503. Option B is wrong because SSL certificate issues cause 502 or 400 errors. Option D is wrong because security group inbound rules affect access, but 503 is from ALB, not the client.

Answer

Security group inbound rules for the ALB

Answer

SSL certificate expiration on the ALB

Question 17

A DevOps engineer receives a CloudWatch alarm that the 'StatusCheckFailed' metric for an EC2 instance is in ALARM state. The instance is part of an Auto Scaling group. What should the engineer do first to restore service?

Accepted Answer

Wait for Auto Scaling to replace the instance. Option B is correct because the instance status check failure indicates a system issue; if the instance is unhealthy, Auto Scaling will terminate and replace it. Option A is wrong because rebooting may not fix underlying issues. Option C is wrong because terminating manually is not needed; Auto Scaling handles it. Option D is wrong because changing the AMI is not immediate.

Answer

Update the Auto Scaling group's launch configuration

Answer

Manually terminate the instance

Answer

Reboot the instance

Question 18

An organization uses AWS Systems Manager to manage its EC2 instances. After a security incident, the security team wants to ensure that all future API calls to Systems Manager are logged and monitored. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS CloudTrail for the Systems Manager service. Option C is correct because enabling CloudTrail for Systems Manager logs all API calls. Option A is wrong because S3 server access logs are for S3 bucket access, not Systems Manager; B is wrong because CloudWatch Logs agent runs on instances, not for API calls; D is wrong because Config rules track configuration, not API calls.

Answer

Enable S3 server access logging on the Systems Manager log bucket

Answer

Install the CloudWatch Logs agent on each instance to capture Systems Manager logs

Answer

Create an AWS Config rule to monitor Systems Manager usage

Question 19

A company uses an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security team reports that a specific client IP address is sending malicious requests and must be blocked immediately. The ALB's security group only allows HTTP/HTTPS from 0.0.0.0/0. What is the FASTEST way to block traffic from this IP address without affecting other traffic?

Accepted Answer

Create an AWS WAF web ACL with an IP set deny rule and associate it with the ALB.. Option C is correct because updating the ALB's security group to deny the specific IP address would block all traffic from that IP inbound to the ALB, but the current security group allows all traffic, so you would need to modify it to deny that IP. However, security groups are stateful and cannot deny rules; they only allow. The correct approach is to use a network ACL on the ALB's subnets, which is not listed. Among the options, Option C (creating a WAF web ACL and associating it with the ALB) is the fastest and most appropriate because AWS WAF can block requests based on IP addresses immediately without changing network infrastructure. Option A is wrong because updating the security group to deny is not possible; security groups only support allow rules. Option B is wrong because modifying the ALB's listener rules does not block traffic; it only affects routing. Option D is wrong because updating route tables would affect all traffic to the ALB, not just that IP.

Answer

Modify the ALB listener rules to drop requests from the client IP.

Answer

Update the ALB security group to add a deny rule for the client IP address.

Answer

Update the VPC route table to drop packets from the client IP.

Question 20

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all CloudTrail trails across the organization are delivering events to a centralized S3 bucket in the management account. Currently, some member accounts have their own trails. Which THREE steps should the security team take to enforce this? (Choose three.)

Accepted Answer

Create an organization trail in the management account that applies to all accounts.. Option A is correct because creating an organization trail in the management account will automatically apply to all accounts. Option B is correct because enabling CloudTrail on the S3 bucket ensures logs are delivered. Option D is correct because SCP can deny the ability to create or modify trails, preventing member accounts from creating separate trails. Option C is wrong because disabling CloudTrail in member accounts is manual and not scalable. Option E is wrong because Config rules can detect but not prevent.

Answer

Manually disable CloudTrail in each member account.

Answer

Use AWS Config rules to detect non-compliant trails and trigger automatic remediation.

DOP-C02 Practice Exam 68 — 20 Questions

Exhibit

DOP-C02 Practice Exam 68 — 20 Questions

Exhibit