DOP-C02 Mock Exam 72 — 25 Questions

Question 1

A company uses an AWS Elastic Load Balancer (ELB) to distribute traffic to EC2 instances. During an incident, some users report slow response times. The DevOps engineer suspects that one instance is unhealthy but the health check is not detecting it. What should the engineer do to improve health check accuracy?

Accepted Answer

Configure a health check that checks a specific application endpoint. Option C is correct because a deep health check (checking an application-specific endpoint) ensures the instance is truly healthy. Option A is incorrect because increasing the interval makes checks less frequent. Option B is incorrect because decreasing the threshold makes it easier to mark unhealthy. Option D is incorrect because the health check path should be specific to the application.

Answer

Increase the health check interval to reduce load on instances

Answer

Decrease the health check unhealthy threshold to 2

Answer

Set the health check path to the root document ('/')

Question 2

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer invalidated the CloudFront cache. What is the MOST likely reason?

Accepted Answer

The invalidation has not propagated to all edge locations.. Option B is correct because by default, CloudFront does not invalidate objects in edge locations immediately; invalidation requests can take minutes to complete. Also, users may be hitting a different edge location that still has cached content. Option A is wrong because S3 bucket policies do not affect cache. Option C is wrong because TTL settings affect how long content is cached, but invalidation should override that. Option D is wrong because the origin is S3, not an ALB.

Answer

The origin is an Application Load Balancer that returns stale content.

Answer

The S3 bucket policy does not allow CloudFront to access the updated objects.

Answer

The CloudFront distribution has a default TTL of 86400 seconds set.

Question 3

A company uses AWS CloudFormation to manage infrastructure. After a failed stack update, the stack is in ROLLBACK_COMPLETE state. The DevOps team needs to identify the specific resource that caused the rollback and review the error message. Which approach provides the most efficient way to achieve this?

Accepted Answer

View the Events tab in the AWS CloudFormation console.. Option C is correct because the CloudFormation console Events tab lists all stack events, including the failure reason and resource that caused the rollback. Option A is wrong because describe-stack-resources shows resources but not error details. Option B is wrong because describe-stack-events includes the error message. Option D is wrong because CloudTrail logs API calls but does not directly show CloudFormation resource errors in an aggregated view.

Answer

Run describe-stack-events and filter by status.

Answer

Check AWS CloudTrail for the UpdateStack API call.

Answer

Run describe-stack-resources to list all stack resources.

Question 4

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users report that they see outdated content even after the engineer has updated the files in the S3 bucket. What should the engineer do to ensure users see the latest content?

Accepted Answer

Create an invalidation for the updated file paths.. Option C is correct because creating a CloudFront invalidation removes cached objects from edge locations. Option A is wrong because TTL settings affect how long content is cached, but invalidation is immediate. Option B is wrong because invalidating the entire distribution is not necessary; a path-specific invalidation works. Option D is wrong because changing S3 bucket policy does not affect cache.

Answer

Change the S3 bucket policy to allow public access.

Answer

Reduce the TTL for the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 5

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During an incident, the primary DB instance becomes unreachable. The failover to the standby instance succeeds, but application connections are failing with 'Access denied for user'. What is the most likely cause?

Accepted Answer

The application is using the old master user credentials that were changed on the primary but not replicated to the standby. Option A is correct because after failover, the standby instance may have different credentials if not using the same secret. Option B is incorrect because DNS propagation does not cause access denied errors. Option C is incorrect because the security group is associated with the RDS instance, not the endpoint. Option D is incorrect because the standby instance has the same storage as the primary.

Answer

The DNS CNAME for the RDS endpoint has not propagated to the application's DNS resolver

Answer

The standby instance has a different storage configuration than the primary

Answer

The security group for the RDS instance does not allow inbound traffic from the application's new IP address

Question 6

A company uses AWS CloudTrail to record API calls across multiple accounts and regions. The security team needs to be alerted immediately when an IAM user creates a new access key. Which combination of services should be used to achieve this with minimal latency?

Accepted Answer

Send CloudTrail logs to CloudWatch Logs, create a metric filter, and set up a CloudWatch Alarm to publish to an SNS topic.. Option B is correct because CloudTrail delivers events to CloudWatch Logs, and a metric filter on 'CreateAccessKey' can trigger a CloudWatch Alarm to send an SNS notification. Option A is wrong because CloudWatch Events (now Amazon EventBridge) can directly match CloudTrail events, but the question asks for minimal latency and a common pattern. Option C is wrong because S3 event notifications are not designed for real-time alerting on API calls. Option D is wrong because Lambda polling CloudTrail is inefficient and introduces latency.

Answer

Enable S3 event notifications on the CloudTrail S3 bucket to trigger a Lambda function.

Answer

Use Amazon EventBridge to match the CloudTrail event and invoke an AWS Lambda function that sends an email.

Answer

Configure a Lambda function to poll the CloudTrail API every minute and check for new access keys.

Question 7

A company runs a critical application on EC2 instances in an Auto Scaling group. The application must be highly available across multiple Availability Zones. Which TWO configurations are necessary to achieve this? (Choose TWO.)

Accepted Answer

Place an Application Load Balancer in front of the Auto Scaling group.. Options A and D are correct. Option A: Distributing instances across multiple AZs ensures that if one AZ fails, the application continues in other AZs. Option D: An Application Load Balancer (ALB) distributes traffic across instances in multiple AZs. Option B is wrong because a single AZ defeats high availability. Option C is wrong because a Classic Load Balancer is not recommended; ALB is better for cross-zone. Option E is wrong because spot instances can be terminated, reducing availability.

Answer

Use a single Availability Zone to reduce latency.

Answer

Use Spot Instances to reduce costs.

Answer

Use a Classic Load Balancer to distribute traffic.

Question 8

A company's application running on EC2 instances behind an Application Load Balancer (ALB) is returning intermittent 504 errors. The instances are in an Auto Scaling group with a health check grace period of 300 seconds. What should the DevOps engineer check first to troubleshoot the issue?

Accepted Answer

Check ALB access logs for target response times.. Option A is correct because 504 errors indicate the load balancer is not receiving a response from the target within the idle timeout period. Checking the ALB access logs for target response times can confirm if the backend is slow. Option B is wrong because if the ELB is not healthy, the instances would be replaced, but the issue is intermittent. Option C is wrong because scaling policies affect capacity, not response times. Option D is wrong because security group rules would cause connection timeouts, not 504s.

Answer

Review the Auto Scaling group scaling policies.

Answer

Verify the target group health checks are passing.

Answer

Check security group rules for the ALB.

Question 9

A company uses RDS Multi-AZ with a read replica. During a failover test, the application experiences a 30-second write outage. The application uses a single DB endpoint. How can the outage be minimized?

Accepted Answer

Use RDS Proxy to handle database connections and failover.. Option C is correct because using the RDS proxy with connection pooling and failover handling reduces the outage window by automatically rerouting connections. Option A is wrong because Multi-AZ already provides a standby, but DNS propagation takes time. Option B is wrong because multiple write endpoints are not supported. Option D is wrong because increasing instance size does not reduce failover time.

Answer

Increase the instance class to improve failover performance.

Answer

Use a Route 53 weighted record with health checks to point to both instances.

Answer

Configure the application to use the read replica endpoint for writes.

Question 10

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a sudden spike in connections, causing the application to timeout. The DevOps engineer notices that the 'DatabaseConnections' metric is high, but the 'CPUUtilization' is low. Which THREE actions should the engineer take to diagnose the issue?

Accepted Answer

Check the 'max_connections' parameter in the DB parameter group and increase it if needed.. Option B is correct because Performance Insights can show which queries are consuming connections. Option D is correct because increased max_connections can help if legitimate, but it's a temporary fix. Option E is correct because enabling connection logging can identify the source of connections. Option A is wrong because increasing instance class addresses CPU, not connection limits. Option C is wrong because read replicas do not reduce write connection load.

Answer

Add a read replica to offload read traffic.

Answer

Scale up the DB instance class to handle more connections.

Question 11

A DevOps team is investigating a security incident where an unauthorized user accessed an S3 bucket. The team needs to determine what actions were taken by the user. Which TWO AWS services should be used together to investigate? (Choose TWO.)

Accepted Answer

S3 server access logs. Option A and Option D are correct. CloudTrail logs all API calls to S3, including who made the call, from where, and what action was taken. S3 server access logs provide detailed records of requests made to the bucket, including object-level operations. Option B is wrong because Config records configuration changes, not access. Option C is wrong because GuardDuty detects threats but does not provide detailed logs of past actions. Option E is wrong because CloudWatch metrics provide performance data, not access details.

Answer

Amazon CloudWatch metrics

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A DevOps engineer receives a CloudWatch alarm for high CPU utilization on an EC2 instance. The engineer needs to investigate the cause. Which AWS service can provide a detailed analysis of the running processes and their resource consumption?

Accepted Answer

AWS Systems Manager Run Command. Option C is correct because AWS Systems Manager Run Command can execute commands (e.g., 'top') on EC2 instances to gather process-level details. Option A (CloudTrail) does not provide OS-level metrics. Option B (Config) records configuration state. Option D (Inspector) is for vulnerability assessment.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 13

A company runs a multi-tier web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors during peak traffic. The Auto Scaling group is configured with a step scaling policy based on CPU utilization. CloudWatch metrics show that CPU utilization never exceeds 70%, but the ALB target group reports that some targets are unhealthy. What is the MOST likely cause?

Accepted Answer

The application health check endpoint is returning HTTP 5xx or timing out.. Option A is correct because health checks are failing, causing the ALB to stop sending traffic to those instances, which results in 503 errors. The CPU utilization might be low because the unhealthy instances are not receiving traffic. Option B is wrong because if the scaling policy were too aggressive, you'd see more instances and possibly lower CPU, not 503 errors. Option C is wrong because connection draining does not cause health check failures. Option D is wrong because the application itself is failing health checks, not the ALB configuration.

Answer

The ALB is misconfigured with an incorrect security group blocking traffic to the targets.

Answer

The ALB connection draining settings are too short, causing in-flight requests to fail.

Answer

The step scaling policy is too aggressive and is terminating instances prematurely.

Question 14

Refer to the exhibit. The DevOps engineer runs the commands and sees the output. What is the most likely issue with the instance?

Accepted Answer

The underlying hardware is having issues (system status check failed).. Option C is correct. The SystemStatus is 'impaired', meaning there is a problem with the underlying physical host (system status check). The instance status is 'ok', so the OS is fine. Option A is wrong because the instance is running. Option B is wrong because instance status is ok. Option D is wrong because there is a system impairment.

Answer

The instance is healthy and no issues exist.

Answer

The instance is stopped.

Answer

The instance has a failed status check due to OS-level issues.

Question 15

A company experiences a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The DevOps team needs to identify the source IP address and user agent of the request. Which AWS service provides this information?

Accepted Answer

Amazon S3 server access logs. Option B is correct because S3 server access logs contain detailed information about each request, including source IP, user agent, and requester. Option A is wrong because CloudTrail logs S3 API calls but does not include user agent by default. Option C is wrong because CloudWatch Logs can store logs but does not generate them. Option D is wrong because VPC Flow Logs capture network traffic but not application-level details like user agent.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 16

The CloudWatch alarm 'HighCPU' has transitioned to ALARM state. What does the alarm history indicate about the metric that triggered it?

Accepted Answer

The metric value of 90.0 exceeded the threshold of 80.0.. Option D is correct because the history shows that 1 datapoint with value 90.0 was greater than the threshold of 80.0. Option A is wrong because the datapoint is 90.0, not 80.0. Option B is wrong because it crossed the threshold. Option C is wrong because the alarm uses 1 datapoint, not 3.

Answer

The metric value remained below the threshold.

Answer

The metric value was exactly 80.0 at the time of the alarm.

Answer

The alarm was triggered after 3 consecutive datapoints breached the threshold.

Question 17

Which TWO actions should a DevOps engineer take to ensure that an Amazon RDS for PostgreSQL database is automatically recovered in the event of a failure?

Accepted Answer

Enable automated backups with a retention period of at least 1 day. Options A and D are correct. Multi-AZ deployment provides automatic failover, and automated backups with point-in-time recovery allow restoring to a specific time. Option B is incorrect because manual snapshots require manual intervention. Option C is incorrect because read replicas are for read scaling, not automatic failover. Option E is incorrect because cross-region replication is for disaster recovery, not automatic recovery.

Answer

Create a read replica in a different Availability Zone

Answer

Take manual snapshots every hour

Answer

Configure cross-region replication to a secondary region

Question 18

A DevOps engineer is investigating a security incident where an unauthorized user accessed an S3 bucket containing sensitive data. The engineer needs to determine what actions the user performed and from which IP address. Which AWS service should be used to retrieve this information?

Accepted Answer

Amazon S3 server access logs.. Option A is correct because S3 server access logs provide detailed records of requests made to a bucket, including requester, IP address, and action. Option B is wrong because CloudTrail logs API calls made by users or roles, but for S3 object-level operations, it must be specifically enabled for data events. Option C is wrong because CloudWatch Logs can store logs but are not the source of S3 access logs. Option D is wrong because Amazon Inspector is for vulnerability assessments, not logging.

Answer

AWS CloudTrail management events.

Answer

Amazon Inspector findings.

Answer

Amazon CloudWatch Logs for the S3 bucket.

Question 19

A company uses Amazon RDS for MySQL and has enabled automated backups. The database administrator accidentally deleted a critical row from a table. The deletion occurred 15 minutes ago. What is the fastest way to recover the lost data?

Accepted Answer

Perform a Point-in-Time Restore to a time just before the deletion.. Option C is correct because Point-in-Time Restore (PITR) allows restoring to any time within the backup retention period, down to the second. Option A is wrong because a manual snapshot from before the deletion would need to be created, which is slower. Option B is wrong because the binlog contains changes, but replaying requires manual effort and is not the fastest AWS-native method. Option D is wrong because RDS does not have a native 'undo' feature.

Answer

Use the RDS console to undo the last transaction.

Answer

Use the binary log to replay transactions before the deletion.

Answer

Create a manual snapshot of the current instance and restore it.

Question 20

A company uses Amazon CloudFront with an S3 origin. Users in Europe report slow load times. The engineer needs to improve performance for European users. Which TWO actions should the engineer take?

Accepted Answer

Add additional price classes to the CloudFront distribution (e.g., Price Class 200).. Option A is correct because adding additional price class can include more edge locations in Europe. Option C is correct because using origin shield reduces load on the origin and improves performance. Option B is wrong because S3 Transfer Acceleration is for uploads, not CloudFront. Option D is wrong because enabling logging does not improve performance. Option E is wrong because enabling WAF does not improve performance.

Answer

Enable S3 Transfer Acceleration on the origin bucket.

Answer

Enable CloudFront access logs to identify slow requests.

Answer

Enable AWS WAF on the CloudFront distribution to block malicious traffic.