DOP-C02 Mock Exam 73 — 25 Questions

Question 1

A company is designing a disaster recovery plan for a MySQL database running on Amazon RDS. The database is critical and must have an RPO of 5 minutes and an RTO of 1 hour. The primary Region is us-east-1, and the DR Region is us-west-2. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a cross-Region read replica in us-west-2.. Option A is correct because a cross-Region read replica continuously replicates data asynchronously from the primary RDS instance in us-east-1 to us-west-2, which can keep the DR copy within the 5-minute RPO requirement. Option D is correct because, during a disaster, the cross-Region read replica must be promoted to a standalone DB instance in us-west-2 so it can accept writes and become the new primary, enabling recovery within the 1-hour RTO. Option B is not correct because a 5-minute backup window does not guarantee a 5-minute RPO; automated backups are periodic snapshots and the backup window only defines when backups occur, not continuous replication. Option C is not correct because cross-Region automated snapshot copy is periodic and typically cannot achieve a 5-minute RPO, and restoring from a snapshot would likely exceed the 1-hour RTO. Option E is not correct because Multi-AZ in us-east-1 only provides high availability within the same Region and does not protect against a Region-wide disaster or provide a DR copy in us-west-2.

Answer

Enable automated backups with a 5-minute backup window.

Answer

Configure cross-Region automated snapshot copy to us-west-2.

Answer

Enable Multi-AZ deployment in us-east-1.

Question 2

A DevOps engineer notices that an EC2 instance running a critical web application has been terminated unexpectedly. The instance was part of an Auto Scaling group. Which step should the engineer take FIRST to investigate the root cause?

Accepted Answer

Review AWS CloudTrail logs for TerminateInstances API calls.. CloudTrail records all AWS API activity, including TerminateInstances calls, capturing the identity, source IP, timestamp, and whether the termination was user-initiated, by an Auto Scaling policy, or by another service. Reviewing CloudTrail first establishes who or what triggered the termination before examining instance-level artifacts.

Answer

Look at the EC2 console's 'Termination Protection' setting.

Answer

Check the application logs on the instance's attached EBS volume (detached and attached to another instance).

Answer

Verify the Auto Scaling group's scaling policies and scheduled actions.

Question 3

A company uses AWS CloudFormation StackSets to deploy a VPC with subnets across multiple accounts and regions. Recently, a new account was added to the organization, and the DevOps team wants to deploy the stack set to this new account without affecting existing stacks. The stack set has self-managed permissions. The engineer creates a new stack instance for the account and region, but the operation fails with an 'Access Denied' error when CloudFormation tries to create resources in the new account. The engineer has verified that the stack set's IAM roles exist in the new account. What is the most likely cause?

Accepted Answer

The trust policy of the IAM role in the target account does not grant permissions to the administrator account.. With self-managed permissions in CloudFormation StackSets, the administrator account assumes an IAM role in each target account to deploy stacks. The trust policy of that target-account role must explicitly grant sts:AssumeRole to the administrator account (or its role). If the trust policy does not list the administrator account, CloudFormation's attempt to assume the role fails with Access Denied, even though the role exists and has the right permissions policy.

Answer

The stack set template contains a resource that is not supported in the target region.

Answer

The target account has reached a service limit for VPCs.

Answer

The IAM roles in the target account are not named correctly.

Question 4

A company uses an AWS Elastic Load Balancer (ELB) to distribute traffic to EC2 instances. During an incident, some users report slow response times. The DevOps engineer suspects that one instance is unhealthy but the health check is not detecting it. What should the engineer do to improve health check accuracy?

Accepted Answer

Configure a health check that checks a specific application endpoint. A health check that targets a specific application endpoint (e.g., /health or /api/status) validates that the application is actually functioning, not just that the instance responds on a port. This catches unhealthy instances that still accept TCP connections but fail to serve requests, which is exactly the scenario described. The other options either weaken detection or do not improve accuracy.

Answer

Increase the health check interval to reduce load on instances

Answer

Decrease the health check unhealthy threshold to 2

Answer

Set the health check path to the root document ('/')

Question 5

A company uses AWS CloudTrail to log all API calls in their AWS account. They need to ensure that any changes to CloudTrail configuration (such as disabling the trail or modifying the log file validation) are immediately detected and trigger an automated response. Which solution should the DevOps engineer implement?

Accepted Answer

Create an Amazon EventBridge rule that matches CloudTrail API calls like StopLogging or UpdateTrail and triggers an SNS topic.. Amazon EventBridge can match AWS CloudTrail API calls such as StopLogging or UpdateTrail and trigger an SNS topic for immediate notification and automated response. This provides real-time detection of changes to CloudTrail configuration, satisfying the requirement.

Answer

Enable Amazon GuardDuty and configure it to monitor CloudTrail logs for suspicious activity.

Answer

Use AWS Config rules with remediation actions to detect and revert changes to CloudTrail.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration and send alerts via email.

Question 6

A company uses AWS CodePipeline with multiple stages. The pipeline includes a Beta stage that deploys to a test environment and a Prod stage. The team wants to require manual approval before the Prod stage. Which TWO actions should be taken to implement this? (Choose TWO.)

Accepted Answer

Ensure that the IAM user or role performing the approval has codepipeline:PutApprovalResult permissions.. Option D is correct because AWS CodePipeline implements manual gating through a dedicated approval action: you add a manual approval action to the stage (or a stage placed between Beta and Prod) so the pipeline pauses and waits for a human decision before continuing to Prod. Option A is correct because the person or role that approves the action must call the CodePipeline PutApprovalResult API, which requires the codepipeline:PutApprovalResult IAM permission; without it, the approval cannot be submitted and the pipeline stays blocked. Option B is not needed because CloudWatch Events/EventBridge with Lambda is a custom workaround, whereas CodePipeline natively supports manual approval actions. Option C is incorrect because CodePipeline stages do not have a 'manual invocation only' setting; approvals are handled by approval actions, not stage invocation modes. Option E is incorrect because CodeCommit approval rule templates govern pull-request merges in CodeCommit, not CodePipeline stage transitions.

Answer

Use CloudWatch Events to trigger a Lambda function that requires manual sign-off.

Answer

Set the Prod stage to only run on manual invocation.

Answer

Configure a CodeCommit approval rule template to require approval before merging.

Question 7

A DevOps engineer is investigating a performance issue in a serverless application using AWS Lambda. The engineer wants to view the duration of each invocation and identify cold starts. Which TWO AWS services should be used? (Choose TWO.)

Accepted Answer

AWS X-Ray to trace invocations and detect cold starts. Option B (AWS X-Ray) is correct because X-Ray traces individual Lambda invocations end-to-end, showing per-invocation duration via subsegments and explicitly flagging cold starts with an 'Initialization' subsegment, which is exactly what the engineer needs to identify cold starts. Option D (Amazon CloudWatch Logs) is correct because Lambda automatically streams each invocation's execution logs, including the REPORT line with Duration, Billed Duration, Memory Size, and Init Duration (the latter indicating a cold start), so per-invocation duration and cold-start evidence can be extracted from these logs. Option A (CloudWatch Metrics) is not correct here because Lambda metrics such as Duration and Invocations are aggregated at one-minute granularity and do not expose per-invocation duration or cold-start identification. Option C (AWS CloudTrail) is not correct because it only records control-plane API calls (e.g., CreateFunction, Invoke via management events) and does not provide invocation duration or cold-start data. Option E (AWS Config) is not correct because it tracks Lambda configuration/resource changes for compliance, not runtime performance or invocation timing.

Answer

Amazon CloudWatch Metrics for Lambda (duration, invocations)

Answer

AWS CloudTrail to record Lambda API calls

Answer

AWS Config to track Lambda configuration changes

Question 8

A DevOps engineer is designing a multi-Region active-active architecture for a stateless web application using Route 53 latency-based routing and DynamoDB global tables. The application must continue to serve traffic even if an entire AWS Region becomes unavailable. Which additional step is MOST critical for resilience?

Accepted Answer

Configure Route 53 health checks and associate them with the latency records. In a multi-Region active-active architecture using Route 53 latency-based routing, the routing policy alone does not detect or react to a Region failure. Route 53 health checks must be created and associated with each latency record so that unhealthy endpoints are removed from DNS responses. Without health checks, Route 53 would continue directing traffic to a failed Region, defeating the resilience goal.

Answer

Use an Auto Scaling group with a scheduled scaling policy

Answer

Enable DynamoDB Accelerator (DAX) in each Region

Answer

Place a CloudFront distribution in front of the application

Question 9

A company is deploying a new microservice on AWS Lambda. The DevOps team needs to monitor the function for errors and performance issues. Which TWO steps should the team take to set up effective monitoring?

Accepted Answer

Enable active tracing with AWS X-Ray to trace requests through the function. Option C is correct because enabling active tracing with AWS X-Ray on a Lambda function instruments the function and its downstream calls, letting the team trace requests end-to-end, identify latency bottlenecks, and pinpoint errors across the microservice. Option D is correct because Lambda automatically streams function output to CloudWatch Logs, which captures application logs, stack traces, and custom metrics needed to diagnose errors and performance issues. VPC Flow Logs (A) only record IP-level network traffic metadata for VPC resources and do not provide function-level error or performance insight. AWS Config rules (B) evaluate resource configuration compliance, not runtime errors or performance. The CloudWatch Agent (E) is installed on EC2 instances or on-premises servers and cannot be installed inside the managed Lambda execution environment.

Answer

Enable VPC Flow Logs to monitor network traffic to the function

Answer

Enable AWS Config rules to evaluate the function configuration

Answer

Install the CloudWatch Agent on the Lambda execution environment

Question 10

A security team is investigating a potential data exfiltration from an S3 bucket. They need to identify which IAM user accessed a specific object and whether the access was from a known IP address. Which THREE AWS services or features should they use together to conduct this investigation?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (C) is correct because it records S3 data-plane API calls such as GetObject, including the IAM identity (user or role) that made the request, the source IP address, and the timestamp, which directly answers who accessed the object and from where. S3 server access logs (D) are correct because they provide detailed, object-level records for every request against the bucket, including the requester, source IP, request URI, and HTTP status, giving a second authoritative source for the specific object access. Amazon Athena (E) is correct because it lets the team query CloudTrail logs and S3 access logs stored in S3 using standard SQL, so they can efficiently correlate the IAM user, object key, and source IP across large log datasets. AWS Config (A) is not appropriate because it tracks resource configuration changes and compliance, not individual object access events or source IPs. VPC Flow Logs (B) capture IP traffic metadata at the ENI/subnet level and do not identify IAM users or S3 object-level requests, so they cannot answer who accessed the object.

Answer

AWS Config

Answer

VPC Flow Logs

Question 11

A company uses a centralized AWS KMS customer master key (CMK) in the security account to encrypt data in S3 buckets across multiple accounts. The S3 buckets are accessed by EC2 instances in the same accounts. The security team wants to ensure that the CMK can only be used by authorized IAM roles in the member accounts. Which policy configuration should be used?

Accepted Answer

Add a statement to the KMS key policy that grants the IAM roles in the member accounts permission to use the key.. A KMS key policy is the primary resource-based policy that controls who can use a customer managed key, and it must explicitly grant the member-account IAM roles permission to use the key for cross-account access. Because the CMK lives in the security account and the roles live in member accounts, the key policy must include a statement allowing those external principals to call kms:Decrypt and related actions. Without this key policy statement, IAM policies in the member accounts alone cannot grant access to the cross-account key.

Answer

Attach an IAM policy to the IAM roles in the member accounts that allows kms:Decrypt on the CMK.

Answer

Create a service control policy (SCP) that allows kms:Decrypt for the CMK.

Answer

Use a VPC endpoint policy for KMS to allow access from the member accounts' VPCs.

Question 12

A DevOps engineer is troubleshooting an issue where an EC2 instance in a private subnet cannot reach the internet. The instance has a route to a NAT gateway. Which TWO of the following should the engineer check? (Choose TWO.)

Accepted Answer

The route table of the private subnet has a route to the NAT gateway. Option B is correct because the private subnet's route table must contain a specific route (typically 0.0.0.0/0) pointing to the NAT gateway; without this route, traffic from the instance will never be forwarded to the NAT gateway even if one exists. Option E is correct because security groups are stateful and must have an outbound rule permitting the traffic (e.g., HTTPS/443 or HTTP/80) to the internet; a restrictive outbound rule will silently drop the packets before they leave the instance. Option A is incorrect because a NAT gateway must reside in a public subnet, not the same private subnet as the instance, and it is associated via the route table rather than subnet co-location. Option C is incorrect because an internet gateway attaches to a VPC, not to a subnet, and private subnets should not have a direct route to an internet gateway. Option D is incorrect because instances in private subnets should not have public IP addresses; outbound internet access via a NAT gateway does not require the instance to have a public IP.

Answer

The NAT gateway is in the same subnet as the instance

Answer

The internet gateway is attached to the private subnet

Answer

The instance has a public IP address

Question 13

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. They want to ensure that all instances have a specific software package installed. Which approach should they take?

Accepted Answer

Create a State Manager association with a custom document that installs the package.. AWS Systems Manager State Manager is designed to maintain a consistent configuration state on managed instances. By creating an association with a custom document that installs the required software package, State Manager will apply and re-apply the configuration on a schedule or on instance registration, ensuring the package remains installed.

Answer

Use OpsCenter to create an OpsItem for each instance.

Answer

Use Run Command to execute the installation on all instances.

Answer

Create a Patch Baseline that includes the package.

Question 14

A DevOps engineer needs to ensure that an S3 bucket policy enforces encryption in transit for all access. Which policy statement should be added?

Accepted Answer

{"Effect":"Deny","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. To enforce encryption in transit, the S3 bucket policy must deny requests that are not using SSL/TLS. The condition key aws:SecureTransport is a boolean that is true when the request uses HTTPS and false when it uses HTTP. Therefore, a Deny statement with a condition that aws:SecureTransport is false blocks all unencrypted (HTTP) access, effectively enforcing encryption in transit.

Answer

{"Effect":"Deny","Condition":{"StringEquals":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Condition":{"Bool":{"aws:SecureTransport":"false"}}}

Answer

{"Effect":"Allow","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 15

A DevOps engineer executes the above CloudWatch Logs Insights query. What will the output contain?

Accepted Answer

The count of ERROR messages per 5-minute interval for the most recent 20 intervals. The CloudWatch Logs Insights query uses 'stats count(*) by bin(5m)' which aggregates log events into 5-minute buckets, and 'limit 20' restricts the output to the 20 most recent buckets. Therefore the output is a count of ERROR messages per 5-minute interval for the most recent 20 intervals. The bin() function defines the time bucket size, and the limit applies to the number of result rows returned.

Answer

The count of ERROR messages per 1-minute interval for the most recent 20 intervals

Answer

The total count of ERROR messages in the log group

Answer

A list of the 20 most recent log entries that contain the word 'ERROR'

Question 16

An EC2 instance is in 'running' state according to the CLI output, but the application hosted on it is unreachable. The DevOps engineer checks the security group and finds it allows inbound HTTP traffic from 0.0.0.0/0. The instance has a public IP. What is the MOST likely issue?

Accepted Answer

The instance's OS firewall (e.g., iptables) is blocking the traffic.. The instance is running, has a public IP, and the security group allows inbound HTTP from 0.0.0.0/0. Since the security group is correctly configured, the most likely cause is a host-level firewall (e.g., iptables, Windows Firewall) blocking the traffic. Security groups operate at the hypervisor level and do not override OS-level firewalls; thus, even with permissive security group rules, the OS can still drop packets. This is a common misconfiguration when instances are launched with restrictive default OS firewall rules.

Answer

The network ACL is blocking inbound HTTP traffic.

Answer

The instance does not have a public IP address assigned.

Answer

The security group is attached to the instance but does not allow inbound HTTP.

Question 17

A DevOps team uses AWS CodePipeline to deploy a web application. The pipeline has a deploy stage that uses CodeDeploy to deploy to an Auto Scaling group. During deployment, the new instances fail health checks and the deployment rolls back. However, the rollback also fails because the old instances have been terminated. What should the team do to avoid this issue?

Accepted Answer

Use a blue/green deployment strategy in CodeDeploy to keep the old instances running until the new ones pass health checks.. A blue/green deployment strategy in CodeDeploy keeps the old (blue) instances running while the new (green) instances are provisioned and validated, so if the new instances fail health checks, the deployment can roll back to the still-running old instances. This avoids the scenario where in-place deployment terminates old instances before new ones are confirmed healthy, leaving nothing to roll back to. Blue/green also supports traffic shifting controls like all-at-once, linear, or canary.

Answer

Increase the health check grace period in the Auto Scaling group.

Answer

Add a manual approval step before the deploy stage.

Answer

Configure the pipeline to deploy to a new Auto Scaling group each time.

Question 18

A DevOps engineer is troubleshooting a failed AWS CodeBuild project. The build fails with an error indicating that the IAM role does not have permission to describe Amazon ECR repositories. The role used by CodeBuild has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage"],"Resource":"*"}]}. What is the missing permission?

Accepted Answer

ecr:DescribeRepositories. The error explicitly states the role lacks permission to 'describe Amazon ECR repositories,' which maps directly to the IAM action ecr:DescribeRepositories. This action is required by CodeBuild when it needs to verify the existence, URI, or configuration of an ECR repository before pulling an image. The existing policy only grants authentication and image-pull permissions (GetAuthorizationToken, BatchCheckLayerAvailability, GetDownloadUrlForLayer, BatchGetImage), none of which cover repository-level metadata inspection.

Answer

ecr:InitiateLayerUpload

Answer

ecr:GetRepositoryPolicy

Answer

ecr:ListImages

Question 19

A company wants to monitor CPU utilization of its EC2 instances and receive an alert when utilization exceeds 80% for 5 consecutive minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms is the correct service to monitor CPU utilization of EC2 instances and trigger an alert when the metric exceeds a threshold for a specified period. CloudWatch collects metrics from EC2 instances, and alarms can be configured to watch a metric over a time period and perform actions (e.g., send an SNS notification) when the threshold is breached. This directly matches the requirement.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Answer

AWS Config

Question 20

A company runs a critical application on Amazon EKS. The operations team needs to monitor the health of the Kubernetes cluster and the applications running on it. Which THREE services can be used together to achieve comprehensive monitoring? (Choose THREE.)

Accepted Answer

AWS X-Ray. AWS X-Ray (A) is correct because it provides distributed tracing for applications running on EKS, letting the team follow requests across microservices and pinpoint latency or errors in the application layer. Amazon CloudWatch Container Insights (D) is correct because it collects and aggregates container-level metrics and logs (CPU, memory, disk, network) from EKS nodes and pods, giving cluster and workload health visibility. Amazon Managed Service for Prometheus (E) is correct because it is a Prometheus-compatible managed service that scrapes and stores Kubernetes metrics and supports alerting, complementing Container Insights for deeper, PromQL-based monitoring. Amazon VPC Flow Logs (B) only captures IP traffic metadata at the network interface level and does not provide application or Kubernetes-level health insight. AWS CloudTrail (C) records AWS API activity for auditing and governance, not runtime health or performance monitoring of the cluster or its applications.

Answer

Amazon VPC Flow Logs

Answer

AWS CloudTrail