DOP-C02 Mock Exam 74 — 25 Questions

Question 1

A company runs a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads to an S3 bucket. The operations team uses CloudWatch Logs for monitoring, but they are finding it difficult to correlate logs across multiple Lambda functions that handle different parts of the workflow. The team wants to trace requests as they flow through the application and identify bottlenecks or errors. The team has already enabled CloudWatch Logs for all Lambda functions. What should the team do to achieve end-to-end request tracing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS X-Ray on the Lambda functions and API Gateway to trace requests end-to-end.. AWS X-Ray is the native distributed tracing service that integrates with Lambda and API Gateway to trace requests end-to-end across services. Enabling X-Ray on the Lambda functions and API Gateway propagates a trace ID through the workflow, letting the team visualize the full request path, latency per segment, and errors. CloudWatch ServiceLens can then surface the X-Ray traces alongside logs and metrics for correlation.

Answer

Use CloudWatch Contributor Insights to analyze the log data and identify the top contributors to latency.

Answer

Use AWS CloudTrail to log all API calls and correlate them with CloudWatch Logs.

Answer

Create a CloudWatch ServiceLens service map to visualize the application components.

Question 2

A company needs to store audit logs for 7 years to meet compliance requirements. Which S3 storage class is the most cost-effective for long-term archival?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for data accessed less than once per year, with a standard retrieval time of 12 hours and a minimum storage duration of 180 days. For 7-year audit log retention where retrieval is rare and compliance-driven, it is the most cost-effective choice.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 Glacier Flexible Retrieval

Question 3

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodeBuild and Amazon ECS. Which TWO actions will help reduce the frequency of Docker image pulls from the public Docker Hub registry?

Accepted Answer

Enable CodeBuild local caching for the cache type 'LOCAL_DOCKER_LAYER_CACHE'. Option B is correct because enabling CodeBuild local caching with the cache type 'LOCAL_DOCKER_LAYER_CACHE' persists Docker image layers between builds on the same host, so previously pulled base image layers are reused and Docker does not need to re-pull them from Docker Hub. Option C is correct because storing the base image in Amazon ECR and referencing it in the build pulls the image from ECR (a private, AWS-hosted registry) instead of the public Docker Hub registry, directly reducing Docker Hub pulls. Option A is incorrect because a Docker Hub access token in Secrets Manager only authenticates and raises rate limits; it does not reduce the number or frequency of image pulls. Option D is incorrect because AWS CodeArtifact does not support Docker/OCI registries as a Docker Hub proxy (it supports package formats like npm, Maven, PyPI, NuGet), so it cannot serve as a pull-through cache for Docker images. Option E is incorrect because attaching CodeBuild to a VPC with a NAT gateway only changes network routing for outbound traffic; it does not cache or eliminate Docker Hub image pulls.

Answer

Create a Docker Hub access token and store it in AWS Secrets Manager

Answer

Use AWS CodeArtifact as a proxy for Docker Hub

Answer

Configure CodeBuild to use a VPC with a NAT gateway

Question 4

A company uses Amazon CloudWatch Logs to store application logs from multiple EC2 instances. The DevOps team needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which combination of services should be used?

Accepted Answer

CloudWatch Logs Insights and CloudWatch Dashboards. CloudWatch Logs Insights allows you to query log data in real time using a query language, and you can create a query that counts ERROR-level entries across multiple log groups. CloudWatch Dashboards can then visualize the results of that query as a widget, providing a real-time dashboard. This combination is native to CloudWatch and requires no additional services or data movement.

Answer

Amazon Athena and Amazon QuickSight

Answer

Amazon Kinesis Data Analytics and Amazon Elasticsearch Service

Answer

Amazon S3 and Amazon QuickSight

Question 5

A company uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to ensure that updates to the stack set are rolled out in a controlled manner, with the ability to roll back if errors occur. Which THREE strategies should they implement? (Choose THREE.)

Accepted Answer

Set a failure tolerance to allow a certain number of stack operation failures before the overall operation fails. Option B is correct because StackSets support a failure tolerance parameter that defines how many stack instance operations may fail before the entire stack set operation is considered failed and rolled back, enabling controlled error handling. Option D is correct because region concurrency (MaximumConcurrentPercentage or a specific number of regions) lets you limit how many regions are updated in parallel, reducing blast radius and allowing controlled rollout across regions. Option E is correct because maximum concurrent accounts controls how many accounts within each region are updated simultaneously, which is the primary mechanism for throttling and controlling the pace of stack set updates. Option A is not correct because CloudFormation StackSets do not provide a native canary deployment feature; controlled rollout is achieved through concurrency and failure tolerance settings rather than a built-in canary mode. Option C is not correct because manually pausing stack instances is not a supported StackSets control mechanism; rollback and failure handling are governed by failure tolerance and concurrency parameters, not manual pausing.

Answer

Use a canary deployment strategy by updating only a subset of accounts first

Answer

Pause stack instances manually if errors are detected

Question 6

A company uses AWS CloudFormation to manage infrastructure. They have a stack that includes a VPC, subnets, and EC2 instances. They want to update the AMI ID of an EC2 instance without causing downtime. Which TWO approaches meet this requirement?

Accepted Answer

Use a CloudFormation update with a rolling update policy on the Auto Scaling group.. Option C is correct because attaching an AutoScalingRollingUpdate policy to the Auto Scaling group resource lets CloudFormation replace instances in batches, keeping a configurable number of instances in service (MinInstancesInService) so the AMI change is applied without downtime. Option D is correct because a custom resource backed by a Lambda function can orchestrate an in-place or rolling update via AWS Systems Manager (for example, SSM Run Command or Automation), allowing the AMI to be changed while maintaining availability. Option A is not correct because setting MinInstancesInService to 0 allows all instances to be taken out of service simultaneously, which causes downtime. Option B is not correct because deleting and recreating the stack destroys the existing resources, causing downtime and data loss. Option E is not correct because spreading instances across Availability Zones does not by itself update the AMI or guarantee zero-downtime replacement.

Answer

Use CloudFormation stack update with 'UpdatePolicy' set to 'AutoScalingRollingUpdate' and 'MinInstancesInService' set to 0.

Answer

Delete the stack and recreate it with the new AMI.

Answer

Deploy the instances across multiple Availability Zones and update each zone separately.

Question 7

A company is using AWS Secrets Manager to rotate database credentials automatically. The DevOps engineer needs to ensure that the rotation process is secure and does not cause downtime. Which THREE steps should the engineer take?

Accepted Answer

Set up CloudWatch alarms to monitor rotation failures.. Option B is correct because CloudWatch alarms on the rotation Lambda's errors, invocation failures, and Secrets Manager rotation metrics let the engineer detect and respond to failed rotations before credentials become stale and cause authentication outages. Option C is correct because the rotation Lambda must authenticate to the database using a dedicated rotation user whose credentials are stored in the secret, and that user needs privileges to modify the password of the target user (for example ALTER USER ... IDENTIFIED BY) so the application user's credentials can be changed without manual intervention. Option E is correct because the Lambda rotation function needs IAM permissions for secretsmanager:GetSecretValue, PutSecretValue, UpdateSecretVersionStage, and DescribeSecret so it can read the current secret, write the new version, and move the AWSCURRENT staging label to complete rotation. Option A is not needed because Secrets Manager automatically deprecates and removes old versions via staging labels; disabling rotation on an old version is not a valid or necessary step. Option D is not required because a VPC endpoint is only needed when the Lambda runs in a private VPC without NAT/internet access; it is an optional network-hardening measure, not one of the three required steps for secure, zero-downtime rotation.

Answer

Disable automatic rotation for the old secret version.

Answer

Configure the Lambda rotation function to use a VPC endpoint for Secrets Manager.

Question 8

Refer to the exhibit. A Lambda function uses the IAM role with the above policy. The function is configured to access a DynamoDB table MyTable and an RDS instance in a VPC. When invoked, the function fails with an error indicating it cannot describe VPC subnets. What is the MOST likely cause?

Accepted Answer

The Lambda function is missing permissions to describe VPC subnets and security groups.. The Lambda execution role policy shown in the exhibit grants DynamoDB and RDS-related actions but omits the ec2:DescribeSubnets, ec2:DescribeSecurityGroups, and ec2:DescribeNetworkInterfaces permissions required when a function is attached to a VPC. When Lambda is configured with VPC access, the service must call these EC2 APIs to validate and place the ENIs, so the invocation fails with a subnet-description error. Adding the missing ec2:Describe* permissions to the role resolves the failure.

Answer

The Lambda function does not have permission to write to DynamoDB.

Answer

The Lambda function cannot create network interfaces in the VPC.

Answer

The DynamoDB table's resource policy denies access from Lambda.

Question 9

A company runs a serverless application using AWS Lambda functions behind an Amazon API Gateway. The application processes user uploads stored in an S3 bucket. The Lambda function writes results to a DynamoDB table. Recently, the function started timing out when processing large files. What should the DevOps engineer do to improve resilience for large file processing?

Accepted Answer

Use S3 event notifications to trigger an AWS Step Functions workflow that processes the file asynchronously.. Using S3 event notifications to trigger an AWS Step Functions workflow enables asynchronous processing of large files, decoupling the upload from the processing and avoiding Lambda's timeout limits. Option A (increasing memory) may improve CPU performance but does not address the timeout issue for large files. Option C (increasing timeout) can extend up to 15 minutes, but large files may still exceed this limit and it does not provide a resilient architecture. Option D (ElastiCache) caches processed results but does not solve the initial timeout problem; it is irrelevant to the large file processing issue.

Answer

Increase the Lambda function memory to improve CPU performance.

Answer

Increase the Lambda function timeout to the maximum 15 minutes.

Answer

Add Amazon ElastiCache to cache processed results and reduce Lambda execution time.

Question 10

A company runs a web application on an Auto Scaling group of EC2 instances. The operations team uses CloudWatch alarms to monitor the application. They have set up a CPUUtilization alarm that triggers when the average CPU exceeds 70% for 5 minutes. The alarm triggers a scaling policy to add instances. Recently, the team noticed that the alarm frequently triggers during the day, but the application performance is acceptable. They suspect the alarm is too sensitive and want to reduce the number of false alarms. The team wants to keep the alarm responsive to real CPU spikes but avoid triggering on short bursts. What should the team change in the alarm configuration?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if CPU is high for 3 consecutive periods.. To reduce false alarms while remaining responsive to real CPU spikes, increase the number of evaluation periods. With 3 consecutive periods, the alarm triggers only if CPU exceeds 70% for 15 minutes (assuming 5-minute periods), filtering out short bursts. This maintains responsiveness to sustained spikes while avoiding triggers on transient spikes.

Answer

Create a composite alarm that combines CPUUtilization with MemoryUtilization.

Answer

Reduce the metric period to 1 minute and keep evaluation periods at 1.

Answer

Lower the threshold to 60% to catch more CPU spikes.

Question 11

An e-commerce application runs on Amazon ECS with Fargate. The operations team notices that the application's latency increases during peak hours. The engineer needs to correlate high CPU usage with increased request latency to identify the root cause. Which approach should be used?

Accepted Answer

Enable Container Insights and ServiceLens to correlate metrics and traces. Amazon CloudWatch Container Insights collects, aggregates, and summarizes metrics and logs from containerized applications on ECS/Fargate, including CPU utilization. ServiceLens integrates CloudWatch with AWS X-Ray traces, allowing you to correlate metrics with request traces and latency. Together they provide the end-to-end visibility needed to link high CPU usage with increased request latency.

Answer

Use CloudWatch Logs Insights to query container logs

Answer

Configure CloudWatch Synthetics canaries to measure latency

Answer

Set up a Prometheus server on an EC2 instance to scrape container metrics

Question 12

A company runs a microservices architecture on Amazon ECS. They want to ensure that if a service fails, it does not cascade to other services. Which TWO design patterns should they implement?

Accepted Answer

Circuit breaker pattern. The circuit breaker pattern (C) is correct because it wraps calls to a failing downstream microservice and, after a threshold of failures, trips open to fail fast instead of repeatedly invoking the unhealthy service, preventing a localized failure from cascading through the call chain. The bulkhead pattern (E) is correct because it isolates resources such as thread pools, connection pools, or ECS tasks per service or dependency, so exhaustion or failure in one component cannot consume shared capacity and take down other services. Together these patterns directly address fault isolation and cascade prevention in a microservices architecture on Amazon ECS. The cache-aside pattern (A) only improves read performance and reduces backend load by populating a cache on demand; it does not stop failure propagation. The Saga pattern (B) manages distributed transaction consistency across services via compensating actions, which is about data integrity rather than preventing cascading failures. The throttling pattern (D) limits request rates to protect a service from overload, but it is a rate-control mechanism and not the primary isolation pattern for stopping cross-service failure cascades.

Answer

Cache-aside pattern

Answer

Saga pattern

Answer

Throttling pattern

Question 13

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is expected to have unpredictable traffic patterns. The DevOps team needs to ensure that the application can handle sudden spikes in traffic without throttling. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes without requiring capacity planning or throttling. This mode charges per request and can accommodate sudden bursts of traffic up to the table's previous peak, making it ideal for serverless applications with variable workloads.

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.

Answer

Increase the Lambda function timeout to the maximum (15 minutes).

Answer

Set API Gateway throttling limits to a high value to prevent throttling.

Question 14

A DevOps team is investigating a security incident where an unauthorized user accessed an S3 bucket. The team needs to determine what actions were taken by the user. Which TWO AWS services should be used together to investigate? (Choose TWO.)

Accepted Answer

S3 server access logs. S3 server access logs (A) are correct because they record detailed, object-level requests made against a bucket, including the requester, bucket name, request time, action (such as REST.GET.OBJECT or REST.PUT.OBJECT), response status, and error code, which lets the team see exactly what operations the unauthorized user performed on the objects. AWS CloudTrail (D) is correct because it captures S3 data events (GetObject, PutObject, DeleteObject) and management events (such as PutBucketPolicy) as API activity with the identity of the caller, source IP address, and timestamp, providing the who-did-what audit trail needed to attribute the actions. Used together, CloudTrail identifies the principal and API calls while S3 server access logs provide the granular request-level detail for the bucket. Amazon CloudWatch metrics (B) only provides aggregate performance and usage statistics, not per-request identity or action detail, so it cannot show what the user did. AWS Config (C) tracks resource configuration changes and compliance over time, not individual object access actions. Amazon GuardDuty (E) is a threat-detection service that generates findings about suspicious activity but does not provide the raw request-level or API-level audit records required to reconstruct the user's actions.

Answer

Amazon CloudWatch metrics

Answer

AWS Config

Answer

Amazon GuardDuty

Question 15

A company needs to enforce that all EC2 instances launched in an AWS account use a specific Amazon Machine Image (AMI) that is approved by the security team. Which combination of services should be used?

Accepted Answer

AWS Config rule to check AMI ID and AWS Systems Manager Automation to remediate non-compliant instances. AWS Config can evaluate whether EC2 instances use the approved AMI ID by creating a custom rule or using a managed rule, and AWS Systems Manager Automation can automatically remediate non-compliant instances (e.g., stop, terminate, or notify). This combination enforces the policy and provides automated remediation, which is the most effective way to ensure compliance.

Answer

AWS Organizations SCP and AWS CloudTrail

Answer

AWS Lambda and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Events

Question 16

A company wants to protect its S3 bucket data from accidental deletion or overwrite. Which feature should be enabled?

Accepted Answer

Enable S3 Versioning. S3 Versioning preserves every prior version of an object, so an accidental overwrite creates a new version while the original remains recoverable, and an accidental delete inserts a delete marker rather than removing data. This directly satisfies the requirement to protect against both accidental deletion and overwrite without blocking legitimate writes. Versioning is the foundational control that MFA Delete and replication build upon.

Answer

Enable cross-region replication

Answer

Apply a bucket policy that denies DeleteObject

Answer

Enable MFA Delete

Question 17

A DevOps engineer needs to manage configuration files for multiple applications across several EC2 instances. The configuration values are sensitive (e.g., database passwords) and must be encrypted at rest and in transit. Which AWS service should be used to store and retrieve these configuration values?

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store with the SecureString parameter type uses AWS KMS to encrypt values at rest and enforces TLS for values in transit, making it purpose-built for storing sensitive configuration such as database passwords. It integrates natively with EC2 instance profiles and IAM, so applications can retrieve secrets without embedding credentials in code or AMIs. This is the canonical DOP-C02 answer for encrypted configuration management.

Answer

AWS CloudFormation template parameters

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Question 18

A DevOps engineer is tasked with setting up monitoring for a serverless application that uses AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The engineer needs to create a centralized dashboard that displays the number of Lambda invocations, API Gateway request counts, and DynamoDB consumed read/write capacity units. The dashboard should be accessible to the operations team without requiring AWS Management Console login. The engineer also wants to set up email alerts when the DynamoDB consumed capacity exceeds 80% of the provisioned capacity. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create a CloudWatch dashboard with the relevant metrics and set CloudWatch alarms on DynamoDB consumed capacity. Share the dashboard as a public read-only dashboard.. A CloudWatch dashboard can display metrics from Lambda, API Gateway, and DynamoDB in one place, and CloudWatch alarms on DynamoDB consumed capacity can trigger email notifications via Amazon SNS. Sharing the dashboard as a public read-only dashboard allows the operations team to view it without AWS Management Console login. This approach uses native AWS monitoring services with minimal setup and no custom code.

Answer

Use Amazon QuickSight to connect to CloudWatch metrics and create a dashboard with email alerts.

Answer

Use CloudWatch Logs Insights to query the logs of each service and create a dashboard from the results.

Answer

Create a CloudWatch dashboard and share it using Amazon Cognito to grant access to the operations team.

Question 19

A company uses AWS CodeBuild to compile and test their Java application. The build takes about 20 minutes. They have enabled Amazon S3 cache to store the Maven repository to speed up subsequent builds. However, they notice that the build time has not improved significantly. The buildspec file includes the 'cache' section with 'paths' pointing to '/root/.m2'. The CodeBuild project has cache type set to 'S3' and a valid bucket. The build logs show that the cache is being downloaded and uploaded, but the Maven dependencies are still being downloaded from the internet each time. What is the most likely cause?

Accepted Answer

The Maven dependencies are not being stored in the local repository path specified in the cache.. The cache is being downloaded and uploaded, but Maven still fetches dependencies from the internet, which means the dependencies are not actually landing in /root/.m2 during the build. This typically happens when the build runs as a non-root user (e.g., the CodeBuild default user), so Maven writes to a different local repository path such as /home/codebuild/.m2 or a path defined by settings.xml. The cache section is syntactically correct, so the fix is to align the cached path with the actual Maven local repository location.

Answer

The cache is too large and takes as long to download as the build itself.

Answer

The S3 bucket is in a different region than the CodeBuild project.

Answer

The buildspec file does not include the 'cache' section correctly.

Question 20

A DevOps engineer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked successfully, but it frequently times out after 15 seconds. The function's CloudWatch Logs show that the timeout occurs while the function is making an HTTP request to an external API. The function's reserved concurrency is set to 5, and the SQS queue has a visibility timeout of 30 seconds. Which change would MOST effectively reduce the number of timeouts?

Accepted Answer

Increase the Lambda function's timeout to 30 seconds.. The function times out at 15 seconds while waiting on an external HTTP call, so the most direct fix is to raise the Lambda timeout to 30 seconds, giving the external API enough time to respond. The SQS visibility timeout (30s) already exceeds the current Lambda timeout, so it is not the bottleneck. Increasing the timeout is the change that most directly reduces the number of timeouts.

Answer

Increase the SQS queue's visibility timeout to 60 seconds.

Answer

Decrease the SQS batch size to 1.

Answer

Increase the Lambda function's reserved concurrency to 10.