DOP-C02 Practice Exam 69 — 20 Questions

Question 1

A DevOps team is troubleshooting a slow website that uses Amazon CloudFront with an Application Load Balancer as the origin. The team notices that cache hit ratio is low. Which THREE actions are most likely to improve the cache hit ratio?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudFront Origin Shield to reduce load on the origin and increase cache effectiveness.. CloudFront Origin Shield acts as an additional caching layer that consolidates requests from multiple edge locations, reducing the load on the origin and increasing the likelihood of cache hits by serving cached content from the Origin Shield regional cache. This improves cache effectiveness, especially for origins with high latency or limited capacity.

Answer

Configure CloudFront to forward all cookies to the origin.

Answer

Decrease the default TTL for objects.

Question 2

A company uses AWS CloudFormation to manage infrastructure as code. They have a stack that creates an Amazon RDS database instance. The database password is stored as a parameter in AWS Systems Manager Parameter Store. The CloudFormation template references the parameter using the 'resolve:ssm' dynamic reference. Recently, a security audit found that the password was exposed in plaintext in the CloudFormation stack outputs. The team wants to prevent sensitive information from being displayed in stack outputs or logs. Which approach should be taken?

Accepted Answer

Remove the output from the CloudFormation stack. The exposure occurred because the sensitive value was placed in the CloudFormation stack Outputs section, which is always visible in plaintext via the console, CLI (describe-stacks), and API regardless of NoEcho or KMS. The only reliable fix is to remove the sensitive value from Outputs entirely and instead surface it through a secure channel such as Secrets Manager, SSM Parameter Store (SecureString), or a custom resource. NoEcho only masks parameter values in the console/API during stack operations — it does not protect Outputs.

Answer

Set the 'NoEcho' property to 'true' for the parameter in the template

Answer

Store the password in AWS Secrets Manager and reference it in the template

Answer

Encrypt the output value using AWS KMS

Question 3

Refer to the exhibit. Why does the build fail?

Accepted Answer

The CodeBuild role does not have permission to create CloudFront invalidations.. The build fails because the CodeBuild service role lacks the necessary IAM permission to create a CloudFront invalidation. In AWS CodeBuild, the service role must have explicit permissions for all AWS API calls made during the build, including cloudfront:CreateInvalidation. Without this permission, the AWS CLI command to invalidate the CloudFront distribution returns an AccessDenied error, causing the build to fail.

Answer

The S3 bucket policy denies write access to the CodeBuild role.

Answer

The CodeBuild project is not associated with the correct service role.

Answer

The CloudFront distribution ID is incorrect.

Question 4

A company uses an Auto Scaling group with a dynamic scaling policy based on the average CPU utilization of the instances. During an incident, the DevOps team notices that the Auto Scaling group is not launching new instances quickly enough to handle a traffic spike. What is a possible cause for the slow scaling response?

Accepted Answer

The cooldown period is set too high.. A high cooldown period prevents the Auto Scaling group from launching additional instances immediately after a scaling activity, even if the CPU utilization remains high. During a traffic spike, if the cooldown is set too high, the group waits before responding to further scaling triggers, resulting in slow scale-out. Reducing the cooldown period allows the group to react more quickly to sustained high demand.

Answer

The health check grace period is set too low.

Answer

The minimum group size is set too low.

Answer

The launch template has a long warm-up time.

Question 5

During a deployment using AWS CodeDeploy, the deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment group is configured with a minimum healthy instances of 75%. What could be the cause?

Accepted Answer

More than 25% of the instances failed the deployment.. The error message explicitly states that too many individual instances failed deployment and too few healthy instances are available. With a minimum healthy instances setting of 75%, the deployment fails when more than 25% of the instances in the deployment group fail their deployment. This is a built-in safety mechanism in AWS CodeDeploy to prevent cascading failures and ensure application availability.

Answer

The deployment configuration timeout is too short.

Answer

The CodeDeploy service role does not have sufficient permissions.

Answer

The instances are not running the CodeDeploy agent.

Question 6

A Lambda function 'my-function' is invoked multiple times, but no logs appear in CloudWatch. The DevOps engineer runs the above CLI command and sees that the log group exists but 'storedBytes' is 0. What is the MOST likely cause?

Accepted Answer

The Lambda execution role lacks permissions to create log streams and put log events.. If the CloudWatch log group exists but storedBytes is 0, the Lambda function is executing but its execution role lacks the IAM permissions required to create log streams and put log events (logs:CreateLogStream, logs:PutLogEvents). Lambda creates the log group automatically on first invocation, but writing log events requires explicit permissions — without them, invocations succeed silently with no logs. This is the classic 'Lambda runs but no logs' scenario.

Answer

The Lambda function is invoked too frequently, causing CloudWatch to throttle log ingestion.

Answer

The log group's retention policy of 7 days deletes logs immediately after creation.

Answer

The Lambda function does not have a log group; the one shown belongs to another resource.

Question 7

An S3 bucket has the above bucket policy. What is the net effect on GetObject requests?

Accepted Answer

Only requests from IP range 192.0.2.0/24 are allowed. The bucket policy grants s3:GetObject to everyone (Principal "*") but wraps it in a Condition restricting the source to the 192.0.2.0/24 CIDR via aws:SourceIp. Because the Allow statement is conditional, only requests originating from that IP range satisfy the policy and are permitted; all other requests are implicitly denied since S3 is deny-by-default. The net effect is that GetObject succeeds only for callers inside 192.0.2.0/24.

Answer

All anonymous users can read objects

Answer

All requests are denied

Answer

Only authenticated users can read objects

Question 8

A developer wants to use AWS CloudFormation to create an Amazon RDS DB instance. The template includes a DB instance resource. Which property is required for the DB instance to be created successfully?

Accepted Answer

DBInstanceClass and Engine. In AWS CloudFormation, when creating an Amazon RDS DB instance using the AWS::RDS::DBInstance resource, the only truly required properties are DBInstanceClass (the compute and memory capacity) and Engine (the database engine, e.g., MySQL, PostgreSQL). These two properties are mandatory in the CloudFormation resource specification; without them, the template will fail validation. All other properties, such as AllocatedStorage, DBInstanceIdentifier, MasterUsername, and MasterUserPassword, have default behaviors or can be omitted under certain conditions (e.g., AllocatedStorage defaults to 20 GB for some engines, and MasterUsername/MasterUserPassword are not required if you use a snapshot or a source DB instance).

Answer

AllocatedStorage

Answer

DBInstanceIdentifier

Answer

MasterUsername and MasterUserPassword

Question 9

A company uses AWS CodeCommit for source control. Developers work on feature branches and create pull requests to merge into the 'develop' branch. The company wants to enforce that all commits to the 'develop' branch are signed. Which AWS service or feature should be used to enforce this policy?

Accepted Answer

Create an approval rule template in CodeCommit that requires commits to be signed and associate it with the 'develop' branch.. AWS CodeCommit natively supports enforcing signed commits. You can create an approval rule template with the 'Require commit signing' condition and associate it with the 'develop' branch. This ensures that any commit to the branch must be signed with a valid GPG key, and unsigned commits are rejected. Option A is incorrect because using CloudWatch Events and Lambda to revert unsigned commits is not a native enforcement mechanism and is unnecessary. Option C is incorrect because KMS is not used for Git commit signing. Option D is incorrect because IAM policies cannot inspect commit signatures.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that verifies commit signatures and reverts unsigned commits.

Answer

Use AWS Key Management Service (KMS) to create a signing key and require developers to use it.

Answer

Configure an IAM policy that denies 'git push' unless the commit is signed.

Question 10

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance in us-east-1. What will happen?

Accepted Answer

The action is allowed because StopInstances is explicitly allowed and not denied.. The policy explicitly allows ec2:StopInstances for all resources, and there is no explicit deny for StopInstances. The Deny only applies to TerminateInstances. Option A is incorrect because StopInstances is allowed. Option B is incorrect because the Deny is not ambiguous. Option C is incorrect because there is no condition key about instance state.

Answer

The action is denied because the policy does not explicitly allow stopping an instance that is running.

Answer

The action is denied because the Deny statement is ambiguous and could apply to StopInstances.

Answer

The action is allowed only if the instance is in a stopped state.

Question 11

A DevOps engineer needs to securely store database credentials for an application running on EC2. The credentials must be rotated automatically every 30 days. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with the RDS rotation Lambda blueprint.. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It provides a built-in RDS rotation Lambda blueprint that can be configured to rotate credentials every 30 days without custom code. This fully managed rotation capability meets the requirement for automatic, scheduled rotation with minimal operational overhead.

Answer

Store credentials in AWS Systems Manager Parameter Store and use a Lambda function to rotate them.

Answer

Store credentials in an S3 bucket encrypted with KMS and use S3 Lifecycle policies to rotate the objects.

Answer

Use IAM roles to grant the EC2 instance access to the database, eliminating the need for credentials.

Question 12

A company is using AWS CloudFormation to deploy a critical application stack. The company wants to ensure that the stack can be recovered quickly in case of a failure. Which THREE strategies should the company implement? (Choose THREE.)

Accepted Answer

Use StackSets to deploy the stack across multiple Regions.. AWS CloudFormation StackSets allow you to deploy stacks across multiple AWS Regions and accounts from a single template, enabling multi-Region disaster recovery. By deploying the critical application stack in multiple Regions, you can quickly fail over to a secondary Region if the primary fails, meeting the requirement for rapid recovery.

Answer

Disable rollback on stack creation failure to preserve resources for debugging.

Answer

Define the entire application in a single CloudFormation template.

Question 13

A company uses AWS Elastic Beanstalk for application deployments. They want to integrate infrastructure-as-code practices using AWS CloudFormation. Which approach allows them to manage the Elastic Beanstalk environment and underlying resources as part of a CloudFormation stack?

Accepted Answer

Define the Elastic Beanstalk environment in the CloudFormation template using the AWS::ElasticBeanstalk::Environment resource.. CloudFormation natively supports Elastic Beanstalk through the AWS::ElasticBeanstalk::Environment and AWS::ElasticBeanstalk::Application resource types. Defining the environment in the template lets CloudFormation create, update, and delete the environment and its underlying resources (EC2, ASG, ELB, security groups) as part of the stack, giving full IaC lifecycle management.

Answer

Use a custom resource backed by a Lambda function to create the Elastic Beanstalk environment.

Answer

Use the CloudFormation import feature to bring the existing Elastic Beanstalk environment into the stack.

Answer

Export the Elastic Beanstalk environment configuration as a CloudFormation template from the console.

Question 14

A company is using Amazon CloudWatch Logs to collect logs from multiple EC2 instances. They need to filter logs in real time and send specific log events to a custom application for processing. Which TWO services can they use to achieve this?

Accepted Answer

Configure a CloudWatch Logs subscription filter that invokes an AWS Lambda function.. Option B is correct because a CloudWatch Logs subscription filter performs real-time filtering of log events and can deliver matching events directly to AWS Lambda, which then runs the custom application logic for processing. Option D is correct because a subscription filter can also stream filtered log events to Amazon Kinesis Data Firehose, which reliably delivers them to a custom destination for processing. Option A is incorrect because Kinesis Data Analytics analyzes streaming data but is not a CloudWatch Logs subscription destination for real-time log filtering. Option C is incorrect because CloudWatch Events (EventBridge) rules react to AWS service events, not individual CloudWatch Logs log events, and cannot filter log events to SQS. Option E is incorrect because S3 event notifications only trigger on object creation in S3 and do not provide real-time filtering of CloudWatch Logs streams.

Answer

Use Amazon Kinesis Data Analytics to process the log stream.

Answer

Create a CloudWatch Events rule to capture log events and send them to Amazon SQS.

Answer

Use Amazon S3 event notifications to trigger a Lambda function on new log files.

Question 15

A DevOps engineer is troubleshooting an issue where an Amazon RDS for MySQL instance is experiencing high latency. The engineer wants to identify which queries are causing the problem. Which AWS service should be used?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is a database performance tuning tool that visualizes database load (Average Active Sessions) broken down by SQL statement, wait event, user, and host. It directly identifies which queries are consuming the most DB load, making it the correct tool for diagnosing high-latency MySQL workloads. It retains up to 7 days of free performance data and up to 2 years with paid retention.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Metrics

Answer

VPC Flow Logs

Question 16

A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled binaries, datasets) to the repository, causing repository size to grow and clone operations to become slow. What is the BEST approach to manage this?

Accepted Answer

Enable Git LFS in CodeCommit and configure the large files to use LFS.. AWS CodeCommit supports Git Large File Storage (LFS), which replaces large files in the repository with text pointers while storing the actual binary content in a separate hosted storage backend. This keeps the repository lightweight, speeds up clone and fetch operations, and avoids hitting the default repository size limits. Enabling Git LFS is the recommended and best practice for managing large binary files in CodeCommit.

Answer

Use S3 as the source in CodePipeline and skip CodeCommit for binaries.

Answer

Store binaries in a separate CodeCommit repository.

Answer

Increase the repository size limit by requesting a quota increase.

Question 17

A DevOps engineer is creating an AWS CloudFormation template to deploy a stack that includes an Amazon EC2 instance. The instance needs to be launched in a specific subnet. How should the engineer reference the subnet ID in the template?

Accepted Answer

Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.. Defining a parameter of type `AWS::EC2::Subnet::Id` allows the CloudFormation template to accept a subnet ID as input at stack creation or update time, making the template reusable across different environments without modification. This approach follows infrastructure-as-code best practices by avoiding hardcoded values and enabling parameterized deployments.

Answer

Hardcode the subnet ID in the template.

Answer

Use a mapping (Mappings) to define the subnet ID based on the stack name.

Answer

Use the Fn::GetAtt function to retrieve the subnet ID from a VPC resource.

Question 18

A company uses AWS CodePipeline for CI/CD. The security team requires that all code changes be scanned for secrets before deployment. The pipeline consists of a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team wants to automatically scan for secrets and block the pipeline if any secrets are found. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Configure the build project to fail the build if the scanning tool returns a non-zero exit code.. Option B is correct because CodeBuild treats a non-zero exit code from a build command as a build failure, which stops the pipeline before the deploy stage and thereby blocks deployment when secrets are detected. Option C is correct because the build stage is the appropriate place to run a secret-scanning tool, and CodePipeline supports invoking it either as a custom action or via a pre-built third-party action from AWS Marketplace integrated into the build stage. Option E is correct because CodeBuild needs its service role to have the necessary permissions (for example, s3:GetObject on the specific bucket/object) to download the scanning tool or its dependencies from Amazon S3 during the build. Option A is not appropriate because scanning after deployment is too late—secrets would already be exposed in the deployed environment, and CodeDeploy does not natively support a scanning action that blocks based on findings. Option D is incorrect because an S3 bucket policy cannot detect secrets in code and is unrelated to blocking a CodePipeline deployment based on scan results.

Answer

Add a scanning action in the deploy stage to scan after deployment.

Answer

Configure an S3 bucket policy to deny access if secrets are detected.

Question 19

A company has a multi-account AWS environment managed by AWS Organizations. The DevOps team uses AWS CloudFormation StackSets to deploy a standard VPC across all member accounts. The security team has noticed that in some accounts, the VPC is being modified after deployment, allowing inbound SSH access from the internet. The team wants to automatically detect and remediate these changes. The current setup includes: AWS Config enabled in all accounts with a rule that checks for unrestricted SSH access; an SNS topic in the management account that receives compliance change notifications; and a Lambda function in the management account that can remediate by updating the security group rules. However, the remediation is not working consistently. What is the most likely reason, and what is the best solution?

Accepted Answer

The Lambda function's IAM role does not have permissions to modify security groups in member accounts.. The Lambda function in the management account needs cross-account permissions to modify security groups in member accounts. The most likely issue is that the Lambda function's IAM role does not have the required permissions. The best solution is to use AWS Config conformance packs with remediation actions deployed to each member account, allowing local remediation. Option A is incorrect because the Config rule itself detects the changes. Option C is incorrect because the SNS topic can deliver messages cross-account with proper permissions, but the remediation fails due to the Lambda role's lack of permissions. Option D is incorrect because StackSets are for initial deployment, not for ongoing compliance.

Answer

The AWS Config rule is not evaluating correctly in member accounts.

Answer

The SNS topic is not delivering messages to the Lambda function due to cross-account access issues.

Answer

CloudFormation StackSets is overriding the changes, causing a race condition.

Question 20

Which THREE components are necessary to implement a secure VPC with a public subnet and a private subnet that hosts a database? (Choose THREE.)

Accepted Answer

Internet Gateway attached to the VPC.. Option B is correct because an Internet Gateway attached to the VPC is required to give the public subnet's resources (such as a bastion host or load balancer) inbound and outbound connectivity to the internet. Option C is correct because a NAT Gateway placed in the public subnet allows instances in the private subnet to initiate outbound traffic (for patching, updates, etc.) to the internet without being directly reachable from it. Option E is correct because a security group on the database that permits traffic only from the application tier enforces least-privilege, instance-level access control, which is essential for securing the database in the private subnet. Option A is not required because a Site-to-Site VPN is for connecting on-premises networks to AWS, not for building public/private subnet architecture. Option D is not required because VPC peering connects separate VPCs and is unrelated to creating public and private subnets within a single VPC.

Answer

AWS Site-to-Site VPN connection.

Answer

VPC Peering connection to a central VPC.