DOP-C02 Practice Exam 68 — 20 Questions

Question 1

A DevOps engineer is responsible for a critical application that uses an Amazon Aurora MySQL cluster. The application experiences sudden spikes in read traffic. The engineer needs to ensure that read replicas automatically scale to handle the load and that the application can tolerate the failure of an Availability Zone without manual intervention. Which solution should the engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Aurora Auto Scaling policy that adds Aurora Replicas based on CPU utilization, and place the replicas in multiple Availability Zones.. Aurora Auto Scaling automatically adds or removes Aurora Replicas based on performance metrics, such as CPU utilization, to handle read traffic spikes. Deploying replicas across multiple Availability Zones ensures that the cluster remains available if an AZ fails. This managed feature provides automatic scaling and high availability with minimal operational effort, directly satisfying the requirements.

Answer

Use Amazon RDS for MySQL with Multi-AZ and create read replicas in multiple Availability Zones, then configure an Auto Scaling group for the replicas.

Answer

Enable Aurora Global Database and promote a secondary Region during read spikes to distribute the load.

Answer

Configure an Application Load Balancer to distribute read traffic across multiple Aurora Replicas, and use AWS Lambda to add replicas when CPU exceeds a threshold.

Question 2

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which TWO steps should be taken to accomplish this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch Events rule to send a notification to an Amazon SNS topic.. Amazon CloudWatch Events (now Events) can be configured to match specific API calls logged by CloudTrail, such as CreateAccessKey. When the rule triggers, it can invoke an SNS topic to send an alert, enabling real-time notification. This approach directly monitors the API activity without additional overhead.

Answer

Enable CloudTrail Insights to detect unusual activity in the account.

Answer

Create an AWS Config rule that checks for access key creation and sends an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query on the CloudTrail logs and set an alarm.

Question 3

You are a DevOps engineer for a company that uses AWS CodePipeline to deploy a microservice to Amazon ECS with Fargate. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild) that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that uses an ECS task definition update. Recently, the deploy stage started failing intermittently with the error 'The task definition does not have a compatibilities attribute set correctly.' The task definition is generated dynamically during the build stage and uses the 'FARGATE' launch type. The error occurs only when a new task definition revision is created. You suspect the issue is related to how the task definition is generated. Upon reviewing the buildspec, you see that the task definition JSON is created using environment variables for the image URI. What is the MOST likely cause and solution?

Accepted Answer

The task definition JSON does not include the 'requiresCompatibilities' field with the value '["FARGATE"]'.. The 'requiresCompatibilities' attribute must be explicitly set to 'FARGATE' for Fargate tasks. Option A is incorrect because the error is about compatibilities, not execution role. Option C is incorrect because network mode should be 'awsvpc', but that is not the error. Option D is incorrect because CPU and memory values are required but would cause a different error.

Answer

The task definition is missing the 'executionRoleArn' field, which is required for Fargate.

Answer

The task definition specifies 'networkMode' as 'bridge', but Fargate requires 'awsvpc'.

Answer

The task definition does not specify 'cpu' and 'memory' values, which are required for Fargate.

Question 4

A DevOps team is designing an incident response plan for a critical microservices architecture. They need to automatically collect and analyze logs from all services during an incident. Which solution should they use?

Accepted Answer

Centralize logs in Amazon CloudWatch Logs and use CloudWatch Logs Insights for real-time querying.. Amazon CloudWatch Logs provides a centralized log management service that integrates natively with AWS services. During an incident, CloudWatch Logs Insights enables real-time, ad-hoc querying and analysis of logs from all microservices without needing to set up additional infrastructure, making it the most efficient solution for incident response.

Answer

Stream logs to Amazon Kinesis Data Firehose and analyze with Amazon OpenSearch Service.

Answer

Store logs in Amazon S3 and use Amazon Athena to query them.

Answer

Use AWS Systems Manager Run Command to execute log collection scripts on each instance.

Question 5

A DevOps engineer manages a CI/CD pipeline that builds Docker images and pushes them to Amazon ECR. The security team requires that every image be scanned for known vulnerabilities before deployment, and that the pipeline fail if any critical severity findings are detected. The engineer enables scan on push for the repository. Which additional step must be added to the pipeline to meet the requirement?

Accepted Answer

Use the ECR DescribeImageScanFindings API to retrieve the scan results and fail the pipeline if any finding has a severity of CRITICAL.. ECR scan on push generates vulnerability findings but does not enforce any action. To gate the pipeline, the engineer must call DescribeImageScanFindings after the push and evaluate the severity counts. If any CRITICAL finding exists, the pipeline should fail. This is the standard pattern for integrating ECR image scanning into a CI/CD workflow and meets the security team's requirement.

Answer

Use AWS Config to evaluate the ECR image scan results and trigger an AWS Lambda function that stops the pipeline.

Answer

Configure the ECR repository to block pushes of images that contain critical vulnerabilities.

Answer

Enable Amazon Inspector and configure it to fail the CodePipeline stage when critical findings are detected.

Question 6

A company uses Amazon S3 to store critical data. An incident occurs where an S3 bucket is accidentally deleted. The DevOps engineer needs to recover the bucket and its objects. What should the engineer do?

Accepted Answer

Recreate the bucket with the same name and restore objects from a previous backup. S3 bucket names are globally unique and, once deleted, cannot be restored by AWS — the bucket and its configuration are gone. The correct recovery approach is to recreate the bucket with the same name (if the name is still available) and restore the objects from a backup or from versioned copies if versioning was enabled. This is the only viable path to recovery.

Answer

Restore the bucket from AWS CloudTrail event history

Answer

Contact AWS Support to restore the bucket from a backup if versioning was enabled

Answer

Use the AWS S3 console to undo the deletion

Question 7

A DevOps engineer needs to store database credentials for an application running on Amazon ECS. The credentials must be automatically rotated every 30 days and encrypted at rest. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store credentials in AWS Secrets Manager and configure automatic rotation.. AWS Secrets Manager is purpose-built for storing and managing secrets such as database credentials, and it natively supports automatic rotation via Lambda functions on a schedule (e.g., every 30 days). It encrypts secrets at rest using KMS by default and integrates directly with ECS task definitions via the secrets parameter, so credentials are injected at runtime without hardcoding. This delivers the required rotation and encryption with minimal operational overhead.

Answer

Store credentials in AWS Systems Manager Parameter Store as SecureString.

Answer

Encrypt credentials with AWS KMS and store them in a versioned S3 bucket.

Answer

Embed credentials as environment variables in the ECS task definition.

Question 8

A team uses AWS CloudFormation to manage infrastructure. They want to automatically update the stack when a new version of a Docker image is pushed to Amazon ECR. Which approach should they use?

Accepted Answer

Configure an Amazon EventBridge rule to detect ECR image pushes and invoke an AWS Lambda function that calls 'UpdateStack' with the new image URI.. Amazon EventBridge can detect ECR image push events and trigger an AWS Lambda function. The Lambda function can then call the CloudFormation UpdateStack API with the new image URI, automating the stack update. This approach is serverless, event-driven, and directly integrates with CloudFormation, making it the most efficient and least operational overhead solution.

Answer

Create a CodeBuild project that triggers on ECR push, and have the build execute an 'aws cloudformation update-stack' command.

Answer

Use AWS CodeDeploy with a trigger on ECR push to deploy the new image to a target group, and have the target group update the stack.

Answer

Set up an Amazon SNS topic subscribed to ECR image push events, and have the SNS topic send a notification to an AWS CloudFormation stack update endpoint.

Question 9

A company uses Amazon RDS for MySQL and has enabled automated backups. The database administrator accidentally deleted a critical row from a table. The deletion occurred 15 minutes ago. What is the fastest way to recover the lost data?

Accepted Answer

Perform a Point-in-Time Restore to a time just before the deletion.. Amazon RDS automated backups enable Point-in-Time Restore (PITR), which uses continuous transaction log backups to restore the instance to any second within the retention window (up to 35 days). Since the deletion happened 15 minutes ago, performing a PITR to a time just before the deletion is the fastest and most precise recovery method. This restores to a new instance, from which the lost row can be extracted.

Answer

Use the RDS console to undo the last transaction.

Answer

Use the binary log to replay transactions before the deletion.

Answer

Create a manual snapshot of the current instance and restore it.

Question 10

A company runs a stateful web application on EC2 instances behind a Network Load Balancer (NLB) in a single Availability Zone. The application stores session state locally on the instance. The company wants to achieve high availability across multiple AZs with minimal application changes. What should the DevOps engineer do?

Accepted Answer

Replace the NLB with an ALB and enable sticky sessions (session affinity) using the ALB's cookie.. Replacing the NLB with an ALB and enabling sticky sessions (session affinity) using the ALB's cookie allows the stateful web application to maintain session state across multiple AZs without modifying the application code. The ALB generates a cookie (AWSALB) that binds a client's session to a specific target instance, ensuring subsequent requests from the same client are routed to the same EC2 instance. This achieves high availability across AZs with minimal changes, as the application continues to store session state locally on the instance.

Answer

Add more AZs and configure the NLB with cross-zone load balancing.

Answer

Replace the NLB with an ALB and use ElastiCache for session storage.

Answer

Use a Multi-AZ RDS instance to store session state.

Question 11

A company uses AWS CodeBuild to run unit tests as part of a CI pipeline. The buildspec.yaml file is located in the root of the source repository. The build takes 30 minutes to complete. The team wants to speed up the build by caching dependencies. Which approach should they take?

Accepted Answer

Configure the buildspec.yaml to enable local caching and specify the paths to cache.. CodeBuild supports caching dependencies to speed up builds. The simplest native approach is to enable caching in the buildspec.yaml using the cache configuration, specifying local caching paths (e.g., /root/.m2 for Maven or /root/.cache/pip for pip) so dependencies are preserved between builds on the same build environment. This avoids re-downloading dependencies from the internet each time and can significantly reduce build time. Note that CodeBuild also supports Amazon S3 caching, and EFS can be mounted for shared storage, but local caching is the most direct and commonly recommended option for dependency caching within the buildspec.

Answer

Download dependencies from the internet each time the build runs.

Answer

Mount an Amazon EFS file system to the build container and store dependencies there.

Answer

Store dependencies in an AWS CodeCommit repository and clone it during the build.

Question 12

A company is using AWS CodeBuild as part of its CI/CD pipeline. The build projects need to access a private Amazon ECR repository to pull Docker images. What is the MOST secure way to grant CodeBuild access to ECR?

Accepted Answer

Create a service role for CodeBuild with an IAM policy that grants ECR pull access.. CodeBuild can assume an IAM service role with a policy that grants pull access to the ECR repository. This is the most secure approach because it avoids static credentials and leverages AWS identity and access management. Option A is wrong: a VPC endpoint provides private network connectivity to ECR but does not grant access; IAM permissions are still required. Option B is wrong: storing ECR credentials in Parameter Store introduces static credentials that must be managed and rotated, making it less secure than using an IAM role. Option D is wrong: using the AWS CLI to retrieve an authorization token requires managing temporary credentials and is more complex; the service role approach is simpler and more secure.

Answer

Configure a VPC endpoint for ECR and allow CodeBuild to connect through it.

Answer

Store ECR credentials in AWS Systems Manager Parameter Store and retrieve them in the buildspec.

Answer

Use the AWS CLI to retrieve an ECR authorization token and pass it to Docker.

Question 13

A development team uses AWS CodeBuild to run unit tests on every commit to the develop branch. The tests take a long time because they download dependencies each time. What should the team do to reduce build time?

Accepted Answer

Enable the local cache feature in CodeBuild.. Enabling the local cache feature in CodeBuild allows the build environment to cache dependencies, such as Maven or npm packages, in a local directory that persists across builds. This avoids re-downloading unchanged dependencies on every commit, significantly reducing build time. The cache can be stored in an S3 bucket or locally on the build instance, and is automatically restored at the start of each build.

Answer

Store dependencies in Amazon Elastic File System (EFS) and mount it during builds.

Answer

Increase the compute type of the build environment.

Answer

Use multiple builds in parallel for the same commit.

Question 14

A company runs a Stateful application on EC2 that requires sticky sessions. They use an ALB with duration-based stickiness. During a deployment, they want to drain existing connections gracefully before terminating instances. Which step is necessary?

Accepted Answer

Increase the deregistration delay on the target group.. ALB target groups use a 'deregistration delay' (formerly called connection draining) to allow in-flight requests to complete before an instance is terminated. This setting is configured on the target group, not the load balancer, and it works with sticky sessions by waiting for the delay period (default 300 seconds) for existing connections to finish, even if the stickiness cookie would otherwise route new requests to the same instance. During a deployment, increasing this delay or ensuring it is set appropriately is the necessary step to gracefully drain connections.

Answer

Reduce the stickiness duration to zero.

Answer

Configure health checks to mark instances unhealthy.

Answer

Enable connection draining on the target group.

Question 15

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary DB instance fails, and automatic failover does not occur within the expected 1-2 minutes. The DevOps team needs to quickly restore database availability. What should the team do first?

Accepted Answer

Reboot the DB instance with failover selected.. When automatic failover does not occur within the expected 1-2 minutes, the fastest way to manually trigger a failover is to reboot the DB instance with the 'Reboot with Failover' option selected. This forces the RDS service to promote the standby replica to the new primary, restoring database availability without waiting for the automated health check to complete. Option D is correct because it directly initiates the failover process, leveraging the existing Multi-AZ setup.

Answer

Restore the latest automated snapshot to a new DB instance.

Answer

Modify the DB instance to change the Multi-AZ setting to enable automatic failover.

Answer

Connect to the standby instance directly and promote it to primary.

Question 16

An application running on Amazon EC2 instances sends custom metrics to CloudWatch. The team notices that some metrics are not appearing. What is the most likely cause?

Accepted Answer

The CloudWatch agent is not installed or configured on the EC2 instances.. The most likely cause is that the CloudWatch agent is not installed or configured on the EC2 instances. Custom metrics require the CloudWatch agent to collect and send data to CloudWatch. Option A is incorrect because custom metric namespaces do not need to be pre-registered; they are automatically created when metrics are published. Option B is incorrect because instances in a private subnet can still publish metrics using a VPC endpoint or a proxy, so a NAT gateway is not strictly required. Option C is incorrect because even with proper IAM permissions, the CloudWatch agent must be installed and running to collect and send custom metrics. Therefore, option D is correct.

Answer

The custom metric namespace is not pre-registered in CloudWatch.

Answer

The EC2 instances are in a private subnet without a NAT gateway.

Answer

The IAM role attached to the EC2 instance lacks permissions to publish metrics.

Question 17

Match each AWS automation or configuration management tool to its description.

Accepted Answer

AWS CloudFormation: Infrastructure as Code service using templates to provision AWS resources.. AWS CloudFormation is for IaC, OpsWorks for configuration management, Elastic Beanstalk for PaaS, and CodeDeploy for automated deployments. Distractors swap definitions.

Answer

AWS CloudFormation: Automated code deployment service.

Answer

AWS OpsWorks: Platform as a Service for web applications.

Question 18

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to enforce a policy that prevents creating S3 buckets with public read access. They plan to use AWS CloudFormation StackSets to deploy a stack across all accounts. What is the BEST way to enforce this policy?

Accepted Answer

Create a service control policy (SCP) in the root organizational unit that denies the s3:PutBucketPublicAccessBlock action.. A service control policy (SCP) applied at the root organizational unit in AWS Organizations can centrally deny the s3:PutBucketPublicAccessBlock action across all accounts, effectively preventing any user or role from disabling the bucket-level public access block settings. This approach works even if an IAM principal has full administrative permissions, as SCPs act as a guardrail that cannot be overridden by account-level policies. It enforces the policy at the organization level without requiring per-account configuration or modifying individual IAM users.

Answer

Use AWS CloudFormation Guard to validate templates before deployment and reject those with public access.

Answer

Create an IAM policy that denies s3:PutBucketAcl and attach it to all IAM users.

Answer

Create an S3 bucket policy in each account that denies public read access.

Question 19

A development team uses AWS CodePipeline to orchestrate builds and deployments. They want to automatically deploy to a staging environment only if a manual approval step is granted. Which configuration should they use?

Accepted Answer

Add an approval action in the pipeline stage before the deploy action.. AWS CodePipeline supports a manual approval action that pauses the pipeline at a specified stage until an authorized user approves or rejects the deployment. By placing the approval action in the stage before the deploy action, the pipeline will only proceed to the staging deployment after the manual approval is granted, satisfying the requirement exactly.

Answer

Use a Lambda function to check a parameter in Parameter Store.

Answer

Configure a CloudWatch Events rule to trigger deployment after a manual event.

Answer

Set the deploy action to manual invocation only.

Question 20

A company uses AWS Organizations with 20 accounts. The Security team has configured AWS CloudTrail to deliver logs from all accounts to a central S3 bucket (central-bucket). The bucket policy allows CloudTrail to write objects and uses SSE-S3 encryption. Recently, auditors found that some log files were missing for a few hours. The CloudTrail console shows that trails are enabled in all accounts. The central-bucket has default encryption enabled. What is the MOST likely cause of the missing logs?

Accepted Answer

The S3 bucket policy denies access unless the PutObject request includes the x-amz-server-side-encryption header with value AES256. The bucket policy denies PutObject requests that do not include the `x-amz-server-side-encryption` header with value `AES256`. CloudTrail does not include this header by default when delivering logs, so the requests are denied, causing missing logs. The bucket's default encryption (SSE-S3) does not override the bucket policy requirement. Option D is correct because it directly addresses the policy condition that blocks CloudTrail writes. Options A, B, and C are incorrect: A refers to multi-region trails, but the issue is about encryption headers; B is wrong because CloudTrail uses HTTPS, not HTTP; C is wrong because the IAM role permissions are not the issue—the bucket policy is the cause.

Answer

The CloudTrail trail is not configured to deliver to the central bucket from all regions

Answer

The S3 bucket policy contains a deny condition that requires aws:SecureTransport to be true, but CloudTrail uses HTTP

Answer

The IAM role used by CloudTrail does not have s3:PutObject permission