DOP-C02 Mock Exam 74 — 25 Questions

Question 1

An organization uses AWS Config to track resource changes. They notice that a particular S3 bucket policy was deleted, but the Config rule 's3-bucket-policy-grantee-check' did not trigger a remediation. What is the most likely reason?

Accepted Answer

The bucket was deleted and recreated, and the configuration recorder did not capture the deletion event.. Option C is correct because AWS Config evaluates rules only when a configuration change occurs. If the bucket was deleted and recreated, the deletion of the policy may not have been recorded as a change if the bucket itself was recreated without a policy. Option A is wrong because Config supports bucket policies. Option B is wrong because evaluation frequency does not affect triggered evaluations. Option D is wrong because S3 bucket policy changes are supported.

Answer

The Config rule does not support S3 bucket policies.

Answer

The rule is set to evaluate resources only on a periodic basis.

Answer

The S3 bucket policy change is not supported by AWS Config.

Question 2

A company uses AWS CodePipeline for CI/CD. A recent pipeline execution failed at the 'Deploy' stage with the error 'Action execution failed: Access Denied'. The pipeline uses an IAM service role. Which THREE checks should the engineer perform to resolve this?

Accepted Answer

Verify that the IAM service role has sufficient permissions to perform the deploy action on the target resource.. Option A is correct because the service role may lack permissions to the deployment target. Option C is correct because the artifact bucket needs permissions for the pipeline. Option D is correct because the IAM role trust policy must allow CodePipeline to assume it. Option B is wrong because CloudWatch Events are not required for pipeline execution. Option E is wrong because S3 events are not relevant to the deploy stage.

Answer

Check that CloudWatch Events rule is configured to trigger the pipeline.

Answer

Enable S3 event notifications to trigger the pipeline on code changes.

Question 3

A security audit reveals that EC2 instances have security groups with overly permissive inbound rules allowing all traffic (0.0.0.0/0) on SSH port 22. What is the BEST way to remediate this at scale?

Accepted Answer

Use AWS Config with a managed rule to detect and auto-remediate.. Option A is correct because AWS Config with a managed rule like 'restricted-ssh' can detect and remediate non-compliant security groups. Option B is wrong because manually updating is not scalable. Option C is wrong because SCPs do not control security group rules directly. Option D is wrong because a Lambda function triggered by CloudWatch Events could work but AWS Config provides built-in remediation.

Answer

Apply a service control policy (SCP) to deny opening port 22.

Answer

Manually update each security group to restrict SSH to known IPs.

Answer

Use CloudWatch Events to trigger a Lambda function that modifies security groups.

Question 4

A DevOps engineer is designing an incident response plan for a multi-region application. The application runs on EC2 instances behind an Application Load Balancer (ALB) and uses Amazon RDS for MySQL with Multi-AZ. Which TWO actions should the engineer include to ensure high availability and fast failover during a regional incident?

Accepted Answer

Set up an Amazon RDS read replica in a second region and promote it during failover.. Options B and D are correct. B is correct because using Route 53 with health checks on the ALB endpoint can route traffic away from an unhealthy region. D is correct because a warm standby with a read replica in another region allows for promoting the replica to primary quickly. Option A is wrong because a Multi-AZ RDS instance is in a single region. Option C is wrong because a single ALB cannot span regions. Option E is wrong because Auto Scaling groups are per-region, not cross-region.

Answer

Create an Auto Scaling group that can launch instances in multiple regions.

Answer

Deploy an Application Load Balancer that spans both regions.

Answer

Configure Amazon RDS Multi-AZ in a second region.

Question 5

A company uses AWS Systems Manager to patch EC2 instances. After a patch window, several instances are unreachable. The engineer checks the SSM Agent logs and finds no errors. What should the engineer do next to diagnose the issue?

Accepted Answer

Check if the instances have outbound internet connectivity to the SSM endpoints.. Option B is correct because checking if the instances have internet connectivity is essential for SSM Agent to communicate with the Systems Manager service. Option A is wrong because the state manager association is not directly related to connectivity. Option C is wrong because IAM roles are necessary for SSM, but the logs show no errors, so roles are likely correct. Option D is wrong because the SSM Agent logs show no errors, so agent is running.

Answer

Restart the SSM Agent on the affected instances.

Answer

Verify that the patch baseline is associated with the instances.

Answer

Review the IAM role attached to the instances for sufficient permissions.

Question 6

An application runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The engineer checks ALB metrics and sees 'SurgeQueueLength' increasing periodically. What is the most likely cause?

Accepted Answer

The application instances are not able to process requests quickly enough, causing the request queue to back up.. Option B is correct because a high SurgeQueueLength indicates that the ALB is receiving more requests than the instances can handle, and the queue is filling up, leading to 503 errors when the queue overflows. Option A is wrong because unhealthy hosts would cause errors but not necessarily an increasing queue. Option C is wrong because a misconfigured security group would block traffic entirely. Option D is wrong because an SSL certificate issue would cause TLS errors, not 503.

Answer

The target group health checks are failing, causing the ALB to route traffic to unhealthy instances.

Answer

The SSL certificate on the ALB has expired.

Answer

The ALB security group is blocking traffic from the clients.

Question 7

A DevOps engineer applied the above S3 bucket policy to restrict access. Users report that they can download objects from the bucket only when using HTTPS from within the 10.0.0.0/8 network. However, users outside that network receive access denied errors even over HTTPS. What is wrong with the policy?

Accepted Answer

The Allow statement only allows requests from the specific IP range; requests from other IPs are implicitly denied even over HTTPS.. Option C is correct because the Deny statement with SecureTransport false only denies non-HTTPS requests; it does not explicitly allow HTTPS requests from outside the allowed IP range. The Allow statement only allows from the specific IP range, so requests from outside that range are implicitly denied. Option A is wrong because the policy already uses a Deny for non-HTTPS. Option B is wrong because the condition is fine. Option D is wrong because the Deny statement is not the issue; the lack of an Allow for HTTPS from other IPs is the issue.

Answer

The Deny statement blocks all requests over HTTPS because of the BoolIfExists condition.

Answer

The Allow statement should include a condition for SecureTransport.

Answer

The Deny statement should use a Condition for SourceIp instead of SecureTransport.

Question 8

A company uses AWS CloudFormation to manage infrastructure. A stack update fails with a 'ROLLBACK_IN_PROGRESS' status. The DevOps engineer needs to investigate the failure. Which TWO actions should the engineer take?

Accepted Answer

Review the 'Stack Events' tab in the CloudFormation console to see the specific error messages.. Option A is correct because the 'Stack Events' tab shows detailed error messages for each resource. Option D is correct because viewing the stack's template and parameters helps identify misconfigurations. Option B is wrong because rollback triggers are for deletion, not update failures. Option C is wrong because CloudTrail logs API calls, not template validation errors. Option E is wrong because Change Sets are used for reviewing changes before execution, not for debugging failed updates.

Answer

Review AWS CloudTrail logs for the 'UpdateStack' API call.

Answer

Check the 'Rollback triggers' configuration for the stack.

Answer

Create a Change Set to see the proposed changes before re-attempting the update.

Question 9

A company runs a production database on Amazon RDS for PostgreSQL. The DevOps team has set up a read replica to offload read traffic. Recently, the replica started experiencing replication lag that is increasing over time. The primary instance's CPU and memory utilization are normal. The network bandwidth between the primary and replica is not saturated. The team has already increased the replica's instance class, but the lag persists. The primary database is under heavy write load due to a batch job that runs hourly. What is the MOST likely cause of the increasing replication lag?

Accepted Answer

The batch job on the primary is using long-running transactions that are holding up WAL generation.. Option A is correct because long-running transactions on the primary can cause replication lag because the replica must wait for the transaction to complete before applying changes. Option B is wrong because increasing replica instance class does not address the root cause. Option C is wrong because increased checkpoint timeout on the replica would not help. Option D is wrong because the issue is not related to storage type change.

Answer

The primary database should be migrated to a Multi-AZ deployment instead of using a read replica.

Answer

The replica's 'max_standby_streaming_delay' parameter is set too low, causing the replica to cancel queries.

Answer

The replica's instance class is still too small for the write load from the primary.

Question 10

A company wants to centralize logging of all API calls made within their AWS account for auditing. Which service should they use?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail records API calls for auditing. Option A is wrong because CloudWatch Logs is for log storage, not API call recording. Option C is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because S3 is storage, not a logging service.

Answer

Amazon S3 access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 11

A company wants to centralize audit logs from multiple AWS accounts into a single S3 bucket. The logs must be encrypted at rest and access should be limited to the security team. Which solution is MOST secure and scalable?

Accepted Answer

Create a central S3 bucket with a bucket policy that requires encryption (aws:SecureTransport and SSE-KMS) and restricts access to a security team IAM role.. Using a centralized S3 bucket with KMS encryption and bucket policies that enforce encryption and limit access is the best approach. Option B is correct because it combines encryption with access control. Option A (separate buckets) is less scalable. Option C (CloudWatch Logs) is not encrypted at rest by default and not centralized to S3. Option D (IAM with S3) can be complex and less secure than bucket policies.

Answer

Use an IAM role in each account that grants write access to the central bucket, and use S3 default encryption.

Answer

Configure each account to write logs to its own S3 bucket, then replicate to a central bucket using S3 Cross-Region Replication.

Answer

Use Amazon CloudWatch Logs in each account and export logs to a central S3 bucket using a Lambda function.

Question 12

A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager is designed for managing secrets with automatic rotation. Option A is wrong because Systems Manager Parameter Store can store secrets but lacks built-in rotation. Option B is wrong because S3 is not secure by default for secrets. Option D is wrong because DynamoDB is a database, not a secrets manager.

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store (SecureString)

Question 13

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM user or role can create or modify VPCs, but should allow VPC usage for existing VPCs. Which SCP should be attached to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}. Option B is correct because the SCP with Deny effect for ec2:CreateVpc and ec2:ModifyVpc attributes, while allowing all other actions, meets the requirement. Option A would block all EC2 actions. Option C denies only CreateVpc but not ModifyVpc. Option D is too permissive.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:DeleteVpc"],"Resource":"*"}]}

Question 14

A company has an IAM policy that allows users to manage their own passwords and MFA devices. The policy includes a condition that requires MFA for all API operations except for changing passwords and MFA. Which THREE statements are true about this policy? (Choose THREE.)

Accepted Answer

The policy uses NotAction to exclude password and MFA actions.. Options A, C, and E are correct. The condition with Bool: aws:MultiFactorAuthPresent ensures that if MFA is not present (except for allowed actions), access is denied. The policy uses NotAction to allow password and MFA changes without MFA. The policy must be attached to users or groups to take effect. Option B: The policy does not apply to the root user. Option D: The policy does not create an IAM role; it is an identity-based policy.

Answer

The policy creates an IAM role for MFA enforcement.

Answer

The policy applies to the AWS account root user.

Question 15

A company needs to store audit logs for 7 years to meet compliance requirements. Which S3 storage class is the most cost-effective for long-term archival?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class for long-term archival. Option D is correct.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 Glacier Flexible Retrieval

Question 16

An organization needs to audit all AWS API calls made in their account for compliance purposes. Which AWS service should they enable?

Accepted Answer

AWS CloudTrail. Option D is correct because AWS CloudTrail records API activity. Option A is wrong because CloudWatch Logs stores logs but does not record API calls. Option B is wrong because AWS Config tracks resource configuration changes, not API calls. Option C is wrong because Amazon GuardDuty is a threat detection service.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 17

A DevOps engineer is configuring AWS Config rules to detect non-compliant security groups. The rule should trigger if any security group allows inbound SSH (port 22) from 0.0.0.0/0. Which AWS managed Config rule should be used?

Accepted Answer

restricted-ssh. Option A is correct because 'restricted-ssh' is the managed rule that checks for SSH access from 0.0.0.0/0. Option B is wrong because 'incoming-ssh-disabled' is not a managed rule. Option C is wrong because 'vpc-sg-open-only-to-authorized-ports' is not specific to SSH. Option D is wrong because 'ec2-security-group-attached-to-eni' checks attachment, not rules.

Answer

vpc-sg-open-only-to-authorized-ports

Answer

ec2-security-group-attached-to-eni

Answer

incoming-ssh-disabled

Question 18

A company's security team notices that an IAM user has permissions to terminate EC2 instances but should only be allowed to stop them. The current policy allows ec2:TerminateInstances. What is the most secure way to prevent termination while allowing stop?

Accepted Answer

Add a Deny statement for ec2:TerminateInstances with a condition for the user's ARN.. Option B is correct because adding a Deny for ec2:TerminateInstances with a condition for the specific user explicitly blocks the action. Option A is wrong because changing the policy to allow ec2:StopInstances without removing ec2:TerminateInstances still allows termination. Option C is wrong because a service control policy (SCP) can also deny but is less targeted. Option D is wrong because attaching a Deny policy to the user is effective, but using a Deny in the same policy is simpler.

Answer

Use an SCP to deny ec2:TerminateInstances for the entire account.

Answer

Modify the existing policy to include ec2:StopInstances and remove ec2:TerminateInstances.

Answer

Attach a separate managed policy that denies ec2:TerminateInstances to the user.

Question 19

Which TWO AWS services can be used to manage and rotate database credentials automatically? (Select TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. Option A is correct because AWS Secrets Manager provides automatic rotation for supported databases. Option D is correct because AWS Systems Manager Parameter Store (SecureString) can store secrets, but rotation requires custom Lambda. However, Secrets Manager is the primary service for automatic rotation. Option B is wrong because KMS does not rotate secrets. Option C is wrong because IAM does not store database credentials. Option E is wrong because CloudFormation does not manage credential rotation.

Answer

AWS CloudFormation

Answer

AWS KMS

Answer

AWS IAM

Question 20

A company is using AWS CloudTrail to log API events. The security team wants to ensure that log files are tamper-proof and available for incident investigation. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation.. Options A and D are correct. Enabling log file validation allows CloudTrail to create a digest file for integrity verification. Enabling S3 Object Lock prevents logs from being deleted or overwritten. Option B: SSE-S3 provides encryption but not tamper-proofing. Option C: CloudWatch Logs does not provide file integrity. Option E: KMS encryption is for encryption, not integrity.

Answer

Store logs in Amazon CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3).

Answer

Use AWS KMS to encrypt the logs.