DOP-C02 Mock Exam 71 — 25 Questions

Question 1

A company uses AWS Systems Manager to manage a fleet of EC2 instances. During an incident, a DevOps engineer needs to execute a script on a specific instance to collect diagnostic data. The engineer does not have SSH key access. Which approach should the engineer use to execute the script?

Accepted Answer

Use AWS Systems Manager Run Command to execute the script.. Option C is correct because AWS Systems Manager Run Command can execute scripts on EC2 instances without requiring SSH or RDP access, using the SSM Agent. Option A is wrong because AWS OpsWorks requires an agent and is typically used for Chef/Puppet. Option B is wrong because EC2 Instance Connect requires SSH key and port 22. Option D is wrong because SSM Session Manager is for interactive sessions, not script execution triggered as a command.

Answer

Use AWS OpsWorks to run the script as a Chef recipe.

Answer

Use EC2 Instance Connect to SSH into the instance and run the script.

Answer

Use AWS Systems Manager Session Manager to open a shell and run the script.

Question 2

A security team is investigating a potential data exfiltration from an S3 bucket. They need to identify which IAM user accessed a specific object and whether the access was from a known IP address. Which THREE AWS services or features should they use together to conduct this investigation?

Accepted Answer

AWS CloudTrail. Options A, B, and D are correct. A is correct because AWS CloudTrail logs S3 API calls including GetObject. B is correct because S3 server access logs provide detailed object-level access logs including requester, IP, and object key. D is correct because Amazon Athena can query both CloudTrail logs and S3 access logs efficiently. Option C is wrong because AWS Config records resource configuration, not data access. Option E is wrong because VPC Flow Logs capture network traffic but not S3 object-level access.

Answer

AWS Config

Answer

VPC Flow Logs

Question 3

A DevOps team is troubleshooting an application that occasionally throws 'Connection reset by peer' errors when connecting to an RDS MySQL instance. The errors are intermittent and seem to correlate with high traffic. Which TWO steps should the team take to diagnose the issue?

Accepted Answer

Check the RDS error log for messages about connection timeouts or aborted connections.. Option B is correct because RDS performance insights can show database load and identify if connections are being dropped. Option E is correct because checking the RDS error log can reveal connection-related errors. Option A is wrong because increasing max_connections may not help if the issue is resource contention. Option C is wrong because enabling Multi-AZ does not fix connection resets. Option D is wrong because security group changes are unlikely to be the cause of intermittent resets.

Answer

Increase the max_connections parameter in the DB parameter group.

Answer

Enable Multi-AZ deployment to provide a standby instance.

Answer

Review the security group rules to ensure the application can connect.

Question 4

A company's incident response process requires that all changes to production resources are automatically paused when a P1 incident is declared. Which AWS service can be used to enforce this by preventing modifications to CloudFormation stacks?

Accepted Answer

AWS CloudFormation StackSets with a service control policy (SCP). Option B is correct because CloudFormation StackSets with a service control policy (SCP) can prevent stack updates. Option A is wrong because CloudTrail is logging. Option C is wrong because Config evaluates compliance, does not prevent changes. Option D is wrong because Systems Manager Change Manager requires manual approval, not automatic pause.

Answer

AWS Systems Manager Change Manager

Answer

AWS Config rules with remediation

Answer

AWS CloudTrail with Insights

Question 5

An organization uses a multi-account AWS environment with AWS Organizations. During an incident, the security team needs to isolate a compromised account by preventing all API calls from that account's root user and IAM users. Which action should be taken?

Accepted Answer

Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.. Option D is correct because an SCP can deny all actions from the root user and IAM users in the affected account. Option A is wrong because it only affects the root user. Option B is wrong because IAM policies cannot restrict root user. Option C is wrong because it only affects IAM users, not root.

Answer

Create a new IAM group with a deny-all policy and add all users to it.

Answer

Attach an IAM policy denying all actions to all IAM users in that account.

Answer

Apply an SCP that denies all actions to the root user only.

Question 6

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The DevOps team notices that messages are not being processed and are going to the dead-letter queue. The Lambda function code is correct. What is the most likely cause?

Accepted Answer

The Lambda function's execution role lacks the sqs:ReceiveMessage permission.. Option C is correct because if the Lambda function's execution role does not have permission to receive messages from SQS, it cannot process them, causing them to go to DLQ. Option A is wrong because SQS does not have a timeout that causes messages to go to DLQ; that's a Lambda function timeout. Option B is wrong because visibility timeout is set on the queue, not Lambda. Option D is wrong because DLQ is not used for Lambda errors; it's used for messages that cannot be processed.

Answer

The SQS queue's visibility timeout is too long.

Answer

The Lambda function timeout is too short.

Answer

The Lambda function's dead-letter queue is misconfigured.

Question 7

A DevOps engineer is troubleshooting a Lambda function that is timing out. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Increase the function timeout in the Lambda configuration.. Option A is correct because increasing timeout may allow the function to complete. Option D is correct because CloudWatch Logs show execution details and errors. Option B is wrong because memory allocation doesn't directly affect timeout. Option C is wrong because VPC configuration is not directly related to timeout unless network issues. Option E is wrong because reserved concurrency affects scaling, not timeout.

Answer

Set reserved concurrency to 1 to isolate the function.

Answer

Check the VPC configuration for the Lambda function.

Answer

Increase the function memory allocation.

Question 8

A DevOps engineer is troubleshooting an issue where an Amazon RDS instance's CPU utilization is consistently high. The engineer has enabled Performance Insights and sees that the top SQL query is a SELECT statement that scans many rows. What is the best course of action to reduce CPU utilization?

Accepted Answer

Add appropriate indexes to optimize the query.. Option D is correct because adding appropriate indexes can reduce the number of rows scanned, thus reducing CPU usage. Option A is wrong because increasing instance size is a temporary fix. Option B is wrong because read replicas are for read traffic, not for reducing CPU on the primary. Option C is wrong because increasing storage does not reduce CPU.

Answer

Create a read replica to offload read traffic.

Answer

Increase the allocated storage to improve I/O.

Answer

Increase the DB instance size to handle the load.

Question 9

A company uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with the error 'The following resource(s) failed to create: [AWS::RDS::DBInstance]'. Which AWS service should the engineer use to view detailed error messages for the failed resource creation?

Accepted Answer

AWS CloudFormation console Events tab. Option A is correct because CloudFormation events provide detailed error messages for resource creation failures. Option B (CloudTrail) records API calls but not CloudFormation-specific resource errors. Option C (Config) is for configuration compliance. Option D (Service Catalog) is for product provisioning, not troubleshooting stack failures.

Answer

AWS Config timeline

Answer

AWS Service Catalog

Answer

AWS CloudTrail event history

Question 10

A DevOps engineer is troubleshooting an issue where an EC2 instance running a web application becomes unresponsive every few hours. CloudWatch logs show no application errors, but the instance's status checks are passing. The engineer suspects a memory leak. Which AWS service can be used to capture memory utilization metrics at a granular level to confirm the leak?

Accepted Answer

CloudWatch Agent. Option B is correct because CloudWatch Agent can collect memory metrics from EC2 instances and send them to CloudWatch. Option A is wrong because EC2 status checks only check system status, not memory. Option C is wrong because CloudTrail logs API calls, not performance metrics. Option D is wrong because Config records resource configuration changes, not metrics.

Answer

EC2 Status Checks

Answer

AWS Config

Answer

AWS CloudTrail

Question 11

A company runs a critical application on Amazon ECS with Fargate launch type. The application is experiencing intermittent failures due to resource exhaustion. The DevOps team wants to implement automated responses to scale the service. Which THREE steps should the team take to achieve this? (Choose THREE.)

Accepted Answer

Create a CloudWatch alarm based on CPU or memory utilization.. Option A, Option D, and Option E are correct. Creating a CloudWatch alarm on a metric like CPU or memory triggers scaling. Application Auto Scaling adjusts the desired count of tasks based on the alarm. The service auto scaling configuration is necessary to define the min/max tasks and scaling policies. Option B is wrong because ECS Cluster Auto Scaling is for EC2 launch type, not Fargate. Option C is wrong because Lambda for scaling is unnecessary and not a best practice.

Answer

Create an AWS Lambda function to manually update the service.

Answer

Configure EC2 Auto Scaling group for the cluster.

Question 12

A company uses Amazon S3 to store critical data. An incident occurs where an S3 bucket is accidentally deleted. The DevOps engineer needs to recover the bucket and its objects. What should the engineer do?

Accepted Answer

Contact AWS Support to restore the bucket from a backup if versioning was enabled. Option B is correct because S3 bucket names are unique and cannot be recreated immediately; however, objects can be recovered if versioning and MFA delete were enabled. Option A is incorrect because buckets cannot be restored from CloudTrail. Option C is incorrect because only the bucket owner can delete a bucket, but deletion cannot be undone. Option D is incorrect because buckets are not recovered automatically.

Answer

Restore the bucket from AWS CloudTrail event history

Answer

Recreate the bucket with the same name and restore objects from a previous backup

Answer

Use the AWS S3 console to undo the deletion

Question 13

A DevOps engineer is troubleshooting a Lambda function that processes S3 events. The function has been running successfully for months, but today it started timing out. The engineer checks CloudWatch Logs and sees 'Task timed out after 3.01 seconds' errors. The function is configured with a 3-second timeout. What should the engineer do to resolve the issue?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. Option C is correct because the function is timing out at the configured limit. Increasing the timeout to a higher value (e.g., 10 seconds) gives the function more time to complete. Option A is wrong because increasing memory may improve performance but does not directly address the timeout. Option B is wrong because the function already has a DLQ; the issue is the function timing out. Option D is wrong because the function is timing out, not provisioning limits.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 14

Refer to the exhibit. An IAM policy is attached to a user. The user tries to upload an object to 'my-bucket' without specifying server-side encryption. What will happen?

Accepted Answer

The upload is denied because of the Deny statement.. Option A is correct. The Allow statement requires encryption AES256, but the request does not specify encryption, so the condition is not met. The Deny statement catches any request that does not have encryption set to AES256 (since it uses StringNotEquals). The explicit Deny overrides any Allow, so the request is denied. Option B is wrong because the Deny statement is more specific. Option C is wrong because the Allow statement has a condition that is not met. Option D is wrong because the request is not allowed.

Answer

The upload is denied because the Allow statement requires encryption.

Answer

The upload is allowed because the Allow statement grants permission.

Answer

The upload is allowed because no encryption header is specified.

Question 15

A Lambda function processes SQS messages but sometimes times out after 15 seconds. The function performs a database call that occasionally takes longer. What is the best way to handle this without losing messages?

Accepted Answer

Increase the Lambda timeout and increase the SQS visibility timeout, and add a dead-letter queue.. Option D is correct because increasing the visibility timeout allows the function more time to process, and using a DLQ ensures that messages that repeatedly fail are captured. Option A is wrong because decreasing visibility timeout would cause messages to reappear sooner. Option B is wrong because reducing reserved concurrency would cause throttling. Option C is wrong because splitting the batch does not address the timeout.

Answer

Decrease the SQS visibility timeout to retry faster.

Answer

Split the batch into smaller batches using partial batch response.

Answer

Reduce the Lambda reserved concurrency to limit invocations.

Question 16

A DevOps engineer receives an alert that an EC2 instance's CPU utilization has been above 90% for the last 30 minutes. The engineer needs to investigate the root cause. Which AWS service should the engineer use to get OS-level process details and identify which process is consuming the CPU?

Accepted Answer

AWS Systems Manager Run Command. Option D is correct because Systems Manager Run Command can run scripts (e.g., 'top' or 'ps') on EC2 instances to get process-level details. Option A is wrong because CloudWatch metrics only show aggregated CPU utilization. Option B is wrong because CloudTrail logs API calls. Option C is wrong because Config records configuration changes.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon CloudWatch

Question 17

An EC2 instance shows as 'running' in the AWS console, but the system status check is 'impaired'. What is the most likely cause?

Accepted Answer

The underlying physical host has experienced a failure.. Option B is correct because system status checks indicate problems with the underlying physical host, such as loss of network connectivity or power. Option A is wrong because instance status checks are for the OS, not system. Option C is wrong because EBS volume issues are instance status checks. Option D is wrong because security group rules affect network access but not system status checks.

Answer

The instance's security group rules are blocking traffic.

Answer

The EBS root volume is corrupted.

Answer

The instance's operating system is not responding.

Question 18

A DevOps engineer is investigating a security incident where an EC2 instance was used to launch an outbound DDoS attack. Which AWS service can provide details about the source IP addresses and network traffic from the instance?

Accepted Answer

VPC Flow Logs. Option B is correct because VPC Flow Logs capture IP traffic information for network interfaces. Option A (CloudTrail) records API calls, not network traffic. Option C (GuardDuty) is a threat detection service but does not provide raw traffic logs. Option D (Config) records configuration changes.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 19

A company uses AWS CodePipeline for CI/CD. During a production deployment, the pipeline fails at the 'Deploy' stage with an error: 'The deployment failed because the deployment group does not have enough capacity to handle the deployment.' The engineer checks the CodeDeploy deployment group and sees that it is configured with a minimum healthy hosts of 100% and a deployment configuration of 'CodeDeployDefault.OneAtATime'. What is the MOST likely cause?

Accepted Answer

The deployment group has only one instance, and the minimum healthy hosts setting prevents the deployment.. Option B is correct because with a minimum healthy hosts of 100%, CodeDeploy requires that all hosts remain healthy during deployment. The OneAtATime configuration updates only one host at a time, but if the deployment group has only one instance, taking it out of service violates the minimum healthy hosts. Option A is wrong because the error is about capacity, not target group health. Option C is wrong because CodeDeploy agent issues would cause a different error. Option D is wrong because the deployment configuration is correct for rolling updates.

Answer

The deployment configuration 'OneAtATime' is not compatible with the deployment group.

Answer

The target group health check is misconfigured, causing all instances to be unhealthy.

Answer

The CodeDeploy agent on the instances is not running.

Question 20

A DevOps engineer notices that an EC2 instance is unresponsive and the CloudWatch alarm 'StatusCheckFailed' is in ALARM state. The instance was launched in a private subnet with no public IP. Which action should the engineer take to diagnose the issue without creating a new instance?

Accepted Answer

Use EC2 Serial Console to connect to the instance.. Option A is correct because EC2 Serial Console provides out-of-band access to the instance console, useful for troubleshooting OS-level issues even when network connectivity is lost. Option B is wrong because Systems Manager Session Manager requires the instance to have connectivity to the Systems Manager endpoint and the agent running. Option C is wrong because AWS Personal Health Dashboard provides service health notifications, not instance-level troubleshooting. Option D is wrong because modifying the security group to allow SSH on port 22 does not help if the instance is unresponsive at the OS level.

Answer

Modify the security group to allow SSH from the engineer's IP.

Answer

Use AWS Systems Manager Session Manager to start a session.

Answer

Check AWS Personal Health Dashboard for instance issues.