DOP-C02 Practice Exam 70 — 20 Questions

Question 1

A company uses CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed KMS key. What must be done to enable this?

Accepted Answer

Associate a customer-managed KMS key with the log group and update the key policy to allow CloudWatch Logs to use it.. CloudWatch Logs supports encryption at rest using a customer-managed KMS key. To enable this, you must associate the KMS key with the log group via the CloudWatch Logs console or API, and you must update the key policy to grant CloudWatch Logs the necessary permissions (kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:DescribeKey). Without this key policy update, CloudWatch Logs cannot use the key to encrypt the log data at rest.

Answer

Enable encryption on the log group using the default AWS managed key.

Answer

Use a third-party encryption tool before sending logs to CloudWatch.

Answer

Create a new log group in a region where KMS is enabled.

Question 2

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They need to ensure that the stack can be updated to modify a resource's property that requires replacement. Which CloudFormation stack policy should they use?

Accepted Answer

No stack policy, or a policy that allows updates to all resources.. CloudFormation stack policies are designed to prevent accidental updates to critical resources, not to block updates that require replacement. By default, if no stack policy is applied, all resources can be updated, including those that require replacement. A policy that allows updates to all resources (or no policy) is necessary to permit a stack update that modifies a property requiring resource replacement, as the replacement process involves creating a new resource and deleting the old one, which is a valid update action.

Answer

A stack policy with an AllowAll statement.

Answer

A stack policy with a DenyAll statement.

Answer

A stack policy that explicitly denies updates to the resource.

Question 3

A company uses AWS CodeDeploy for application deployments to EC2 instances. The team recently noticed that deployments are failing because some instances do not have the CodeDeploy agent installed. Which configuration management approach should the team implement to ensure the CodeDeploy agent is installed and running on all instances before deployment?

Accepted Answer

Create a custom AMI with the CodeDeploy agent pre-installed, or use a user data script to install the agent at launch.. It ensures the CodeDeploy agent is present on every EC2 instance from the moment it is launched, either by baking the agent into a custom AMI or by installing it via a user data script. This approach aligns with immutable infrastructure and configuration management best practices, preventing deployment failures caused by missing agents. AWS CodeDeploy requires the agent to be installed and running on target instances before any deployment can proceed.

Answer

Use an AWS Config rule to detect instances without the agent and trigger a Lambda function to install it.

Answer

Use the CodeDeploy deployment configuration to skip instances that do not have the agent.

Answer

Configure the CodeDeploy deployment group to automatically install the agent on new instances.

Question 4

A company uses AWS Secrets Manager to store database credentials. The security team wants to automatically rotate secrets every 30 days. The database is an Amazon RDS for PostgreSQL instance. The team has configured automatic rotation with a Lambda function that updates the password in RDS and Secrets Manager. However, after the first rotation, the application starts getting database connection errors. The application uses a connection string with the secret ARN and retrieves the secret from Secrets Manager at startup using the AWS SDK. Which of the following is the most likely cause of the connection errors?

Accepted Answer

The application caches the secret at startup and does not refresh it after rotation.. If the application caches the secret at startup, it will not retrieve the updated password after rotation, causing connection errors. Option A is incorrect because a Lambda timeout or throttling would prevent the rotation from completing, but the rotation succeeded (new password set), so the issue is on the application side. Option C is incorrect because if the Lambda lacked permissions to update the secret, the rotation would have failed entirely, not just after the first rotation. Option D is incorrect because Amazon RDS does not have built-in automatic password rotation; Secrets Manager manages the rotation, so there is no conflict.

Answer

The Lambda function is not configured with a sufficient timeout and is being throttled.

Answer

The Lambda function does not have permission to update the secret in Secrets Manager.

Answer

The RDS instance has automatic password rotation enabled, which conflicts with Secrets Manager rotation.

Question 5

A company needs to audit all changes to security groups in a multi-account environment. The logs must be centrally stored and immutable. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Enable AWS CloudTrail in all accounts, deliver logs to a central S3 bucket with S3 Object Lock enabled. AWS CloudTrail records all API activity, including `AuthorizeSecurityGroupIngress`, `RevokeSecurityGroupIngress`, and related security group modifications, across every account. Delivering these logs to a central S3 bucket with S3 Object Lock (WORM) enabled satisfies both the audit requirement and the immutability requirement, and CloudTrail organization trails can be enabled once at the Organizations level for minimal operational overhead.

Answer

Enable VPC Flow Logs in each VPC and aggregate them in Amazon CloudWatch Logs

Answer

Enable Amazon GuardDuty and send findings to a central S3 bucket

Answer

Enable AWS Config rules to detect security group changes and store results in a central S3 bucket

Question 6

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing intermittent errors. The DevOps engineer needs to identify if the errors are caused by the application or the underlying infrastructure. Which solution provides the MOST detailed visibility into the application's behavior?

Accepted Answer

Instrument the application with AWS X-Ray SDK and analyze traces. AWS X-Ray traces individual requests as they travel through the application, showing latency, errors, and downstream calls at each segment. This provides the granular, request-level visibility needed to determine whether errors originate in application code or in dependencies like databases or external services. CloudWatch metrics and VPC Flow Logs operate at a coarser level and cannot pinpoint application logic failures.

Answer

Enable VPC Flow Logs and analyze traffic patterns

Answer

Enable AWS CloudTrail and monitor for API errors

Answer

Enable detailed CloudWatch metrics on the EC2 instances and ALB

Question 7

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that stack updates do not accidentally delete critical resources like a database. Which CloudFormation stack policy should they apply to protect the database resource?

Accepted Answer

Create a stack policy that denies delete actions on the logical resource ID of the database.. A CloudFormation stack policy allows you to define resource-level permissions that prevent specific resources (identified by their logical resource ID) from being updated or deleted during a stack update. By creating a policy that denies delete actions on the database's logical resource ID, the DevOps team ensures that even if the template or parameters change, the database resource cannot be accidentally removed.

Answer

Apply an IAM policy that denies cloudformation:DeleteStack on the database.

Answer

Use an S3 bucket policy to deny deletion of the database snapshot.

Answer

Enable termination protection on the CloudFormation stack.

Question 8

A DevOps engineer needs to grant an IAM user temporary access to an S3 bucket for exactly one hour. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is the service that issues temporary, limited-privilege credentials via APIs like AssumeRole, GetSessionToken, and GetFederationToken. To grant an IAM user one-hour access to an S3 bucket, the engineer calls AssumeRole (or AssumeRoleWithSAML/WebIdentity) with a DurationSeconds of 3600 and attaches a scoped policy. STS returns an access key, secret key, and session token that expire automatically, which is exactly the temporary-credential requirement.

Answer

Amazon Cognito

Answer

AWS SSO

Answer

AWS IAM

Question 9

Which THREE AWS services can be used as a source action in AWS CodePipeline? (Choose three.)

Accepted Answer

Amazon S3. Amazon S3 is a supported source action in AWS CodePipeline because you can configure a pipeline to use an S3 bucket as a source location for your application code or artifacts. When you upload a new version of a file to the specified S3 bucket, CodePipeline can automatically detect the change (via Amazon CloudWatch Events or S3 event notifications) and start the pipeline execution. This is commonly used for deploying static websites or integrating with third-party CI/CD tools that output artifacts to S3.

Answer

Amazon DynamoDB

Answer

AWS CloudFormation

Question 10

An organization uses AWS CodePipeline with a multi-branch strategy. They want to run unit tests on every push to any branch, but only deploy to production on pushes to the 'main' branch. What is the most efficient way to achieve this?

Accepted Answer

Configure a single pipeline with a source action that triggers on all branches, then use a 'branch' condition on the deployment stage to only proceed if the branch is 'main'.. AWS CodePipeline supports a single pipeline with a source action configured to trigger on all branches (e.g., using a webhook event filter for 'refs/heads/*'). You can then add a 'branch' condition on the deployment stage using a Lambda function or a manual approval action that checks the branch name, ensuring only pushes to 'main' proceed to production. This approach avoids duplicating pipelines while still running unit tests on every push.

Answer

Use a single pipeline with a source action that triggers on all branches, and deploy to a test environment for all branches, then promote to production manually.

Answer

Create separate pipelines for each branch, each with its own test and deploy stages.

Answer

Use a single pipeline with a source action that only triggers on the 'main' branch, and run tests in a separate system.

Question 11

A DevOps engineer needs to centrally collect and analyze logs from multiple AWS accounts and on-premises servers. Which AWS service should be used to aggregate logs in a single dashboard?

Accepted Answer

Amazon CloudWatch Logs.. Amazon CloudWatch Logs is the correct service for centrally collecting, storing, and analyzing logs from multiple AWS accounts and on-premises servers, with the ability to visualize them in a single dashboard via CloudWatch Logs Insights and CloudWatch dashboards. It supports cross-account log aggregation through subscription filters and centralized log groups.

Answer

Amazon Athena.

Answer

Amazon S3.

Answer

Amazon Kinesis Data Firehose.

Question 12

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda. They want to automatically deploy the latest version of the Lambda function to production after running integration tests. The source code is in AWS CodeCommit. Which pipeline configuration should they use?

Accepted Answer

CodeCommit -> CodeBuild (test) -> CodeDeploy (Lambda deployment) -> Lambda.. It uses CodeDeploy's built-in Lambda deployment support, which enables safe, gradual traffic shifting (e.g., canary or linear deployments) and automatic rollback on CloudWatch alarm failures. This pipeline integrates CodeCommit for source, CodeBuild for integration tests, and CodeDeploy to orchestrate the Lambda update with minimal risk, aligning with AWS best practices for serverless CI/CD.

Answer

CodeCommit -> CodeBuild (test) -> Lambda (deploy via update-function-code).

Answer

CodeCommit -> Lambda (deploy via S3 trigger) -> CodeBuild (test) -> production.

Answer

CodeCommit -> CodeBuild (test and deploy) -> Lambda via AWS CLI in buildspec.

Question 13

A company is designing a resilient architecture for a web application that uses Amazon RDS for MySQL. The application must be able to withstand the loss of an entire AWS Region. Which TWO actions should the company take?

Accepted Answer

Configure automated backups to be copied to another Region.. To withstand the loss of an entire AWS Region, the company must have a disaster recovery strategy that includes cross-region data replication. Option B is correct because copying automated backups to another Region ensures that a recoverable copy of the database exists in a different geographic area, allowing restoration in a separate Region if the primary Region fails. Option D is correct because a Cross-Region Read Replica provides a live, asynchronously replicated copy of the database in another Region, which can be promoted to a standalone primary instance during a regional outage, minimizing recovery time.

Answer

Use RDS Proxy to pool database connections.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Enable deletion protection on the RDS instance.

Question 14

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a patching window, some instances fail to apply patches. The engineer checks the SSM Agent logs and sees 'ERROR: Failed to download patch files from the source.' What is the most likely cause?

Accepted Answer

The security group or NACL is blocking outbound HTTPS traffic (port 443).. The error 'Failed to download patch files from the source' indicates that the SSM Agent on the instance cannot reach the patch source repositories (e.g., Windows Update, Amazon Linux repos, or custom patch sources). Systems Manager Patch Manager requires outbound HTTPS (port 443) connectivity to download patch metadata and binaries. If a security group or NACL blocks this traffic, the download fails, producing this exact error in the agent logs.

Answer

The IAM instance profile does not grant ssm:UpdateInstanceInformation.

Answer

The SSM Agent is outdated.

Answer

The patch baseline is configured incorrectly.

Question 15

A company is designing an incident response strategy for its Amazon EKS cluster. Which THREE steps should be taken to ensure rapid response to a compromised pod?

Accepted Answer

Delete the pod using kubectl delete pod.. Deleting the pod with `kubectl delete pod` immediately terminates the compromised container, stopping any malicious activity. This is a rapid containment step that removes the pod from the cluster without affecting the broader deployment or namespace, allowing the incident response team to investigate and remediate without unnecessary disruption.

Answer

Delete the entire namespace to ensure all resources are removed.

Answer

Scale down the deployment to 0 replicas.

Question 16

Which TWO approaches can be used to automate the creation of an AWS CloudFormation stack that includes IAM resources? (Select TWO.)

Accepted Answer

Use an AWS Lambda function to call the CreateStack API with the capabilities parameter set to 'CAPABILITY_IAM'.. When a CloudFormation stack includes IAM resources, you must explicitly acknowledge that the stack may create IAM entities. An AWS Lambda function calling the CreateStack API with the `capabilities` parameter set to `CAPABILITY_IAM` satisfies this requirement. Option E is correct because the AWS CLI `create-stack` command with the `--capabilities CAPABILITY_IAM` parameter also provides the required acknowledgment, allowing the stack to be created successfully.

Answer

Store the CloudFormation template in an Amazon S3 bucket and use the 'aws cloudformation deploy' command.

Answer

Set the 'CAPABILITY_NAMED_IAM' capability when calling the CreateStack API.

Answer

Attach the AWS managed policy 'IAMFullAccess' to the IAM user or role executing the stack creation.

Question 17

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. Users report intermittent 503 errors. CloudWatch metrics show that the ALB's 'RequestCount' is normal, but 'HTTPCode_ELB_5XX_Count' spikes. The 'TargetResponseTime' metric shows occasional high latency. Which troubleshooting step should the DevOps engineer take FIRST?

Accepted Answer

Enable and analyze the ALB access logs stored in S3, filtering for 503 errors and correlating with target response times.. ALB access logs capture detailed per-request information including target IP, response time, and the specific error (e.g., 503 due to target connection errors or target timeouts). Analyzing these logs filtered for 503s and correlated with TargetResponseTime reveals whether the errors originate from unhealthy targets, connection limits, or slow responses, making it the correct first diagnostic step.

Answer

Increase the desired capacity of the Auto Scaling group to handle more requests.

Answer

Disable connection draining on the target group to prevent slow-draining instances from causing errors.

Answer

Review AWS CloudTrail logs for any recent configuration changes to the ALB.

Question 18

A DevOps team is setting up centralized logging for a multi-account AWS environment. They want to aggregate logs from all accounts into a single S3 bucket. Which services should be used to achieve this? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it can be configured to deliver log files from multiple accounts to a single S3 bucket by setting up a trail in the management account and using the 'Enable for all accounts in my organization' option, which automatically applies the trail to all member accounts in AWS Organizations. This centralizes CloudTrail logs without requiring per-account configuration.

Answer

AWS Config

Answer

Amazon Kinesis Data Firehose

Answer

Amazon S3 replication

Question 19

A company runs a critical application on an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). The DevOps team needs to implement a dashboard that shows real-time request latency, error rates, and the number of healthy hosts. Which AWS service should be used to create this dashboard?

Accepted Answer

Amazon CloudWatch Dashboards. Amazon CloudWatch Dashboards is the correct choice because it provides real-time monitoring and visualization of metrics such as request latency, error rates, and healthy host counts directly from CloudWatch. These metrics are automatically emitted by the Application Load Balancer (e.g., TargetResponseTime, HTTPCode_ELB_5XX_Count, HealthyHostCount) and can be displayed on a customizable dashboard without additional data transformation or querying.

Answer

Amazon QuickSight

Answer

AWS CloudTrail

Answer

AWS Config

Question 20

A DevOps engineer is configuring CloudWatch Logs for a Lambda function that processes streaming data from Kinesis. The function sometimes fails due to memory exhaustion. The engineer wants to ensure that logs from the function are shipped to CloudWatch Logs even when the function fails. Which configuration should be used?

Accepted Answer

Ensure the Lambda function writes logs to stdout or stderr; CloudWatch Logs will automatically capture them. Lambda functions automatically send all output written to stdout (via print or console.log) and stderr to CloudWatch Logs, regardless of whether the function succeeds or fails. This is a built-in behavior of the Lambda runtime, so no additional agents or configuration are needed to capture logs from a failed invocation due to memory exhaustion.

Answer

Configure a Kinesis Agent on the Lambda execution environment to stream logs to CloudWatch Logs

Answer

Install the CloudWatch Logs agent on the Lambda function to continuously send logs

Answer

Enable detailed CloudWatch metrics for the Lambda function