DOP-C02 Mock Exam 71 — 25 Questions

Question 1

A company wants to receive a notification when an AWS IAM user creates a new access key. Which AWS service should be used to capture this event and trigger a notification?

Accepted Answer

AWS CloudTrail with CloudWatch Events. AWS CloudTrail captures API activity, including the CreateAccessKey event when an IAM user creates a new access key. By sending these events to Amazon CloudWatch Events (now part of Amazon EventBridge), you can define a rule that triggers a notification via SNS, Lambda, or other targets. This combination provides the real-time event-driven notification the company requires.

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Answer

AWS Config

Question 2

Refer to the exhibit. After a deployment at 10:00, the error rate increases steadily. What is the MOST likely cause?

Accepted Answer

A bug in the new release causes errors to accumulate over time.. A steadily increasing error rate that begins right after a deployment and grows over time is the signature of a bug in the new release that accumulates state — for example, a memory leak, connection leak, unbounded cache, or counter that eventually corrupts behavior. Because the errors ramp up gradually rather than spiking immediately, the cause is inside the deployed code, not an external dependency or a hard resource ceiling hit at t=0. This pattern points to the new release as the root cause.

Answer

An external dependency became unavailable after the deployment.

Answer

The database connection limit was reached immediately after deployment.

Answer

The deployment triggered a scaling event that overloaded the application.

Question 3

A company runs a web application on EC2 behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting (XSS) attacks. Which AWS service should they use?

Accepted Answer

Deploy AWS WAF in front of the ALB and create rules to block SQL injection and XSS.. AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests for common attack patterns. It provides managed rule sets specifically designed to block SQL injection and cross-site scripting (XSS) attacks at the application layer, which is exactly what this scenario requires.

Answer

Configure security groups to allow only HTTP/HTTPS traffic.

Answer

Configure network ACLs to block common attack patterns based on IP ranges.

Answer

Enable AWS Shield Advanced to protect the ALB.

Question 4

A DevOps engineer needs to create an IAM policy that allows a user to start and stop EC2 instances, but only for instances that have a specific tag 'Environment=Production'. The current policy allows all actions on all instances. Which modification must be made to enforce the tag-based restriction?

Accepted Answer

Add a Condition block: "Condition": {"StringEquals": {"ec2:ResourceTag/Environment": "Production"}}. The `ec2:ResourceTag` condition key allows you to restrict actions based on the tags already attached to the EC2 instance. By using `StringEquals` with `ec2:ResourceTag/Environment` set to `Production`, the policy will only permit the `ec2:StartInstances` and `ec2:StopInstances` actions on instances that currently have that tag. This is the standard AWS mechanism for tag-based resource-level authorization in IAM policies.

Answer

Add a Condition block: "Condition": {"StringEquals": {"aws:PrincipalTag/Environment": "Production"}}

Answer

Change the Action to "ec2:Describe*" and add a NotAction element.

Answer

Add a Condition block: "Condition": {"StringEquals": {"aws:RequestTag/Environment": "Production"}}

Question 5

A DevOps team is implementing a CI/CD pipeline for a microservices architecture on AWS ECS. They want to ensure zero-downtime deployments and automatic rollback if health checks fail. Which combination of services should they use?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment and CloudWatch alarms for automatic rollback.. AWS CodeDeploy supports blue/green deployments for ECS, which creates a new replacement task set alongside the original, allowing traffic to shift only after health checks pass. CloudWatch alarms can be configured to trigger an automatic rollback if the new deployment fails health checks, ensuring zero-downtime and automated recovery.

Answer

AWS CodePipeline with ECS rolling update and manual rollback.

Answer

AWS Elastic Beanstalk with rolling deployment and enhanced health reporting.

Answer

AWS CloudFormation with ECS service update and SNS notification on failure.

Question 6

A company uses Amazon DynamoDB as the database for a mobile application. The application requires single-digit millisecond read and write latency and must be resilient to the failure of an entire AWS Region. Which DynamoDB feature should the company use?

Accepted Answer

DynamoDB global tables. DynamoDB global tables provide multi-Region, multi-active replication, ensuring the application can withstand an entire AWS Region failure while maintaining single-digit millisecond read and write latency in each Region. This is achieved through DynamoDB Streams and a last-writer-wins conflict resolution mechanism, making it the correct choice for cross-Region resilience.

Answer

DynamoDB point-in-time recovery (PITR)

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB on-demand capacity mode

Question 7

A company uses AWS CodePipeline to deploy a web application. The pipeline uses artifacts stored in an S3 bucket. The Security team requires that all artifacts be encrypted in transit and at rest, and that the pipeline only access the bucket using a specific VPC endpoint. Which configuration meets these requirements?

Accepted Answer

Create a VPC endpoint for S3 and attach a bucket policy that denies access unless aws:SourceVpce matches the endpoint and aws:SecureTransport is true, and use S3 default encryption. To enforce encryption in transit and at rest plus restrict access to a specific VPC endpoint, you need an S3 gateway or interface endpoint and a bucket policy that denies requests unless aws:SourceVpce matches the endpoint and aws:SecureTransport is true. S3 default encryption (SSE-S3) satisfies encryption at rest. This combination meets all stated requirements.

Answer

Configure an IAM role for CodePipeline with a policy that allows s3:GetObject and s3:PutObject, and attach a bucket policy that allows only that role

Answer

Use an S3 bucket with a lifecycle policy to expire old artifacts

Answer

Enable S3 block public access and use SSE-S3 encryption on the bucket

Question 8

A DevOps engineer is troubleshooting a Lambda function that processes S3 events. The function has been running successfully for months, but today it started timing out. The engineer checks CloudWatch Logs and sees 'Task timed out after 3.01 seconds' errors. The function is configured with a 3-second timeout. What should the engineer do to resolve the issue?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. The error 'Task timed out after 3.01 seconds' indicates the function is exceeding its configured 3-second timeout. Since the function has been running successfully for months and only recently started timing out, the workload has likely grown (larger S3 objects, downstream latency, or cold starts). Increasing the timeout to 10 seconds gives the function enough time to complete its processing, directly addressing the timeout error.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Configure a dead-letter queue (DLQ) for the Lambda function.

Question 9

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. Which AWS service can automatically manage the encryption keys with minimal configuration?

Accepted Answer

SSE-S3. SSE-S3 (Server-Side Encryption with S3-Managed Keys) is the correct answer because it requires minimal configuration: you simply enable it on the bucket or object, and AWS fully manages the encryption keys, including rotation and protection, without any additional setup or key management overhead.

Answer

SSE-C

Answer

SSE-KMS

Answer

Client-side encryption

Question 10

A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)

Accepted Answer

Use CloudWatch Logs Insights to run queries across multiple log groups.. Option A is correct because CloudWatch Logs Insights natively supports querying across multiple log groups in a single query — you can select up to 50 log groups in the console or specify multiple log group ARNs/names in the StartQuery API, and use the query syntax (fields, filter, stats, parse) to search for a specific error pattern. Option B is correct because exporting CloudWatch Logs to Amazon S3 (via CreateExportTask or subscription filters) and then querying the exported data with Amazon Athena lets you run SQL across many log groups' data at once, which is a standard approach for cross-log-group searching and analysis. Option C is not correct because installing the CloudWatch Logs agent and tailing logs only reads logs on a single EC2 instance and does not provide cross-log-group search capability. Option D is not correct because a custom Lambda function reading each log group would be a bespoke, inefficient workaround rather than a supported cross-log-group search feature, and it is not the intended solution. Option E is not correct because Kinesis Data Analytics processes streaming data for real-time analytics, not for searching historical log data across multiple CloudWatch log groups.

Answer

Install the CloudWatch Logs agent on an EC2 instance and tail the logs.

Answer

Create a Lambda function that reads logs from each log group and searches for the pattern.

Answer

Use Amazon Kinesis Data Analytics to process the log streams.

Question 11

A company is running a production database on Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences a failover due to an AZ outage. What happens to the existing database connections during the failover?

Accepted Answer

Existing connections are dropped, and applications must reconnect to the new primary using the same endpoint.. During an RDS Multi-AZ failover, the DNS CNAME for the DB instance is updated to point to the standby, which is promoted to primary. However, existing TCP connections are severed because the standby has a different IP and the failover breaks the session; applications must reconnect using the same endpoint hostname, which now resolves to the new primary.

Answer

Existing connections are automatically redirected to the standby without interruption.

Answer

The RDS endpoint IP address changes, and the application must update its configuration.

Answer

The primary DB instance is promoted to standby and connections remain active.

Question 12

A company's security team requires that all API calls to AWS are logged for audit purposes. Which service should be enabled to capture and store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services. CloudTrail captures the identity of the caller, the time of the call, the source IP address, the request parameters, and the response elements, storing this information in a log file that can be delivered to an Amazon S3 bucket for long-term audit storage. This directly meets the security team's requirement to capture and store all API calls for audit purposes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 13

Drag and drop the steps to configure an AWS Auto Scaling group with a launch template and scaling policies.

Accepted Answer

Create launch template, then Auto Scaling group, then configure network, then set capacities, then add scaling policy. First create the launch template, then create the Auto Scaling group, then configure network, then set capacities, then add scaling policy.

Answer

Auto Scaling group, then launch template, then configure network, then set capacities, then add scaling policy

Answer

Configure network, then launch template, then Auto Scaling group, then set capacities, then add scaling policy

Answer

Create launch template, then Auto Scaling group, then configure network, then add scaling policy, then set capacities

Question 14

Which THREE services can be used to protect a VPC from malicious traffic? (Choose 3.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are stateless, subnet-level firewalls that filter traffic based on rules evaluating source/destination IP, protocol, and port. They provide an additional layer of defense by explicitly allowing or denying inbound and outbound traffic at the subnet boundary, making them a correct choice for protecting a VPC from malicious traffic.

Answer

AWS Shield

Answer

Amazon Route 53 Resolver

Question 15

A company uses AWS CloudFormation to deploy infrastructure. During an incident, a stack update fails with a stack rollback. The engineer needs to prevent the stack from rolling back on future failures and instead retain the resources for debugging. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the '--disable-rollback' option when updating the stack. The `--disable-rollback` option (or `DisableRollback` in the CloudFormation template) instructs AWS CloudFormation to leave the stack in its current state (with the failed resources intact) instead of automatically rolling back to the last known good state. This allows engineers to retain the resources for debugging without the stack being torn down on failure.

Answer

Enable drift detection on the stack

Answer

Use AWS CloudFormation StackSets to deploy the stack

Answer

Create a change set before updating instead of direct update

Question 16

Match each AWS service to its primary function in a DevOps pipeline.

Accepted Answer

CodeCommit: Source control service for storing and managing code. In a DevOps pipeline, AWS CodeCommit provides source control, CodeBuild compiles and tests code, CodeDeploy automates deployments, and CodePipeline orchestrates the entire CI/CD process. Common confusions include mixing up the roles of CodeCommit and CodeDeploy or CodeCommit and CodeBuild.

Answer

CodeCommit: Service for deploying code to EC2 instances

Answer

CodeBuild: Service for managing source code repositories

Question 17

Drag and drop the steps to set up an AWS CloudFormation stack with a nested stack.

Accepted Answer

Upload the nested stack template, then create the parent template, then validate the templates, then create the stack, then monitor the stack creation.. First upload the nested stack template, then create the parent template, then validate, then create stack, then monitor.

Answer

Create the parent template, then upload the nested stack template, then validate the templates, then create the stack, then monitor the stack creation.

Answer

Validate the templates, then upload the nested stack template, then create the parent template, then create the stack, then monitor the stack creation.

Answer

Upload the nested stack template, then create the parent template, then create the stack, then validate the templates, then monitor the stack creation.

Question 18

An application running on Amazon RDS for PostgreSQL is experiencing slow query performance. The DevOps team suspects a specific query is causing high CPU usage. Which tool should they use to identify the problematic query?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct tool because it provides a database performance tuning and monitoring feature that visualizes database load and lets you identify specific queries causing high CPU usage. It breaks down the database load by wait events, SQL statements, hosts, and users, making it straightforward to pinpoint the problematic query. This directly addresses the DevOps team's need to find the query responsible for high CPU consumption.

Answer

Amazon RDS Event Subscriptions

Answer

Amazon CloudWatch Logs with metric filters

Answer

Amazon RDS Enhanced Monitoring

Question 19

Which TWO AWS services can be used to implement a blue/green deployment for an application running on Amazon EC2 instances?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy (Option B) is correct because it natively supports blue/green deployments for Amazon EC2 instances by allowing you to provision a new set of instances (the green environment), deploy the new application revision to them, and then shift traffic from the old (blue) environment to the new one. This is achieved through integration with an Elastic Load Balancer (ELB) or Auto Scaling groups, where CodeDeploy manages the lifecycle of instances and traffic routing during the deployment process.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS CodeBuild

Question 20

A DevOps engineer runs the above AWS CLI commands and notices that the CodeBuild project 'my-project' exists but builds fail with the error 'Access Denied' when trying to fetch source code from CodeCommit. The IAM role 'CodeBuildServiceRole' has a policy that allows 'codecommit:GitPull' on all repositories. What is the most likely cause of the failure?

Accepted Answer

The IAM role does not have a trust policy that allows CodeBuild to assume the role.. The error 'Access Denied' when CodeBuild tries to fetch source code from CodeCommit typically indicates that the IAM role CodeBuild is using does not have the necessary permissions to perform the action. Even though the role 'CodeBuildServiceRole' has a policy allowing 'codecommit:GitPull', the role itself must have a trust policy that allows the CodeBuild service to assume it. Without a proper trust policy, CodeBuild cannot assume the role, and any attached permissions are irrelevant, leading to an access denied error.

Answer

The IAM role does not have permissions to access the CodeCommit repository.

Answer

The CodeCommit repository does not exist.

Answer

The source location in the build project is incorrect.