DOP-C02 Mock Exam 75 — 25 Questions

Question 1

A company runs a critical application on Amazon ECS with Fargate. The application is deployed across multiple Availability Zones and uses an Application Load Balancer (ALB) as the front-end. During a recent incident, users experienced intermittent connectivity failures. The DevOps team suspects that tasks are being stopped due to resource exhaustion. Which combination of metrics and actions should the team use to diagnose and prevent recurrence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor CPU and memory utilization metrics in CloudWatch; increase the task size (CPU and memory) in the task definition.. CPU and memory utilization metrics in CloudWatch directly indicate resource exhaustion, which is the suspected cause of tasks being stopped. Increasing the task size (CPU and memory) in the task definition provides more resources per task, preventing the OOM killer or CPU throttling from stopping tasks, without changing the number of tasks or scaling logic.

Answer

Set up CloudWatch Logs for the application and check for out-of-memory errors; then increase the number of tasks.

Answer

Monitor NetworkPacketsIn and NetworkPacketsOut metrics in CloudWatch; increase the number of tasks.

Answer

Monitor the ALB error metrics (5xx count) and scale the ECS service based on request count.

Question 2

A team uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS instance. During an update, the stack fails with 'CREATE_FAILED' for the DB instance resource, and the error message indicates 'The DB instance already exists.' What is the most likely cause?

Accepted Answer

An RDS instance with the same identifier already exists in the account and region.. The error 'The DB instance already exists' indicates that CloudFormation is attempting to create a new RDS instance with a DB instance identifier that is already in use within the same AWS account and region. Since DB instance identifiers must be unique per account and region, the creation fails. This typically occurs when a stack update triggers a resource replacement (e.g., due to a property change that requires recreation) and the old instance was not deleted or its identifier is still reserved.

Answer

The stack update is trying to replace the DB instance without a proper UpdateReplace policy.

Answer

The stack has a DeletionPolicy of Retain on the RDS instance.

Answer

The RDS instance has deletion protection enabled.

Question 3

A DevOps engineer is designing a monitoring solution for a multi-tier web application hosted on AWS. The application consists of an Application Load Balancer (ALB), EC2 instances, and an RDS database. The engineer needs to capture and analyze HTTP request logs from the ALB to understand client behavior and troubleshoot errors. Which THREE steps are necessary to achieve this?

Accepted Answer

Use Amazon Athena to query the access logs in S3. Option D is correct because ALB access logs must be explicitly enabled on the load balancer, which captures detailed information about every HTTP/HTTPS request including client IP, request path, response codes, and latency. Option E is correct because ALB access logs are delivered to an Amazon S3 bucket, so a target S3 bucket (with the proper bucket policy allowing the ALB to write) must exist before enabling logging. Option C is correct because Amazon Athena can query the ALB access logs stored in S3 directly using SQL, enabling analysis of client behavior and troubleshooting of errors without loading data into a database. Option A is incorrect because the CloudWatch Agent runs on EC2 instances or on-premises servers, not on ALBs, which are managed services that cannot host agents. Option B is incorrect because AWS CloudTrail records API activity and management events, not HTTP request logs, so it does not capture ALB access log data.

Answer

Install the CloudWatch Agent on the ALB

Answer

Enable AWS CloudTrail for the ALB

Question 4

A company is designing a highly available architecture for a web application. The application runs on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The instances are behind an Application Load Balancer (ALB). Which additional step should the team take to ensure that traffic is evenly distributed across all healthy instances in all Availability Zones?

Accepted Answer

Enable cross-zone load balancing on the ALB.. By default, ALB distributes traffic evenly across AZs, but cross-zone load balancing must be enabled to distribute traffic evenly across all instances regardless of AZ. Option A is wrong because Route 53 weighted routing is not needed for internal load balancing; the ALB already distributes traffic across AZs. Option B is wrong because configuring health checks to mark instances unhealthy based on AZ instance count would not help with even distribution and could cause unnecessary failures. Option D is wrong because the least outstanding requests routing algorithm optimizes for request queue depth but does not enable cross-zone load balancing; cross-zone load balancing must be explicitly enabled.

Answer

Use Amazon Route 53 weighted routing policy to distribute traffic to each AZ.

Answer

Configure health checks on the target group to mark instances as unhealthy if they are in an AZ with fewer instances.

Answer

Configure the ALB to use least outstanding requests routing algorithm.

Question 5

A company has a production Amazon EKS cluster with multiple node groups. The DevOps team notices that some pods are frequently restarting due to OOMKilled errors, but the cluster-level metrics (CPU, memory) appear normal. Which CloudWatch Container Insights metric should be analyzed to identify the specific node or pod causing the issue?

Accepted Answer

pod_memory_utilization.. OOMKilled errors are caused by individual containers exceeding their memory limits, which is a pod-level (container-level) condition. CloudWatch Container Insights exposes 'pod_memory_utilization' (and 'container_memory_utilization') per pod, allowing you to pinpoint which pod is hitting its memory limit even when node-level memory looks normal. This is the metric that directly correlates with OOMKilled restarts.

Answer

node_memory_utilization.

Answer

number_of_running_pods.

Answer

pod_cpu_utilization.

Question 6

An application running on Amazon EC2 instances in an Auto Scaling group is experiencing intermittent connectivity issues. The DevOps team suspects a security group configuration problem. Which approach should the team use to analyze security group traffic and identify denied requests?

Accepted Answer

Enable VPC Flow Logs and query Amazon Athena. VPC Flow Logs capture IP traffic metadata (source, destination, port, protocol, action) for ENIs, subnets, or VPCs, and publishing them to CloudWatch Logs or S3 lets you query with Amazon Athena to identify REJECT entries caused by security group or NACL rules. This is the standard AWS approach for diagnosing denied traffic at the network layer.

Answer

Use AWS Config to review security group rules

Answer

Check AWS CloudTrail for security group modification events

Answer

Enable AWS Security Hub and review the security findings

Question 7

A company runs a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application processes financial transactions. The DevOps team needs to monitor for duplicate transactions that could occur due to retries. The team wants to set up an alert when the number of duplicate transaction attempts exceeds 10 in a 5-minute window. The application logs each transaction attempt with a unique transaction ID to CloudWatch Logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudWatch Logs metric filter that counts log events containing 'DuplicateTransaction' and set an alarm on the metric with a threshold of 10.. CloudWatch Logs metric filters can scan log events for specific terms like 'DuplicateTransaction' and convert matches into a custom metric. You can then create a CloudWatch alarm on that metric with a threshold of 10 over a 5-minute period. This requires no code changes, no additional services, and is the most efficient and native solution for monitoring log-based patterns.

Answer

Use DynamoDB Streams to trigger a Lambda function that counts duplicates and publishes metrics.

Answer

Stream the CloudWatch Logs to Amazon Kinesis Data Analytics and use SQL queries to detect duplicates.

Answer

Modify the Lambda function to publish a custom metric to CloudWatch for each duplicate transaction, then set an alarm.

Question 8

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom health check endpoint '/health'. The DevOps team notices that the ALB is marking some instances as unhealthy even though the application is running fine. The team checks the security groups and network ACLs and confirms they allow traffic. What should the team check next?

Accepted Answer

Confirm that the health check path is correctly configured to '/health' on the target group.. If security groups and NACLs are confirmed correct, the next most likely cause is a misconfigured health check path on the target group — for example, the path is set to '/' or '/healthz' instead of '/health', so the ALB receives a 404 and marks the instance unhealthy. Verifying the exact path string in the target group's health check settings is the correct next diagnostic step. The other options either do not apply or are premature tuning steps.

Answer

Ensure the health check path is case-insensitive.

Answer

Increase the health check interval and timeout values.

Answer

Verify that the health check port matches the application port.

Question 9

Refer to the exhibit. A security engineer sees this CloudTrail event. What action did the user 'admin' perform?

Accepted Answer

Created a new KMS key.. The CloudTrail event shows the API call CreateKey, which is the KMS operation that provisions a brand-new customer managed key. The event name in CloudTrail directly maps to the KMS API action, and CreateKey returns a new key ID with key state 'Enabled' and no key material yet until first use. This is distinct from Encrypt, RotateKey, or ScheduleKeyDeletion, each of which produces a different eventName.

Answer

Encrypted data with a KMS key.

Answer

Rotated a KMS key.

Answer

Deleted a KMS key.

Question 10

A company is migrating to AWS and has a requirement to encrypt all data at rest and in transit. They are using AWS KMS with Customer Master Keys (CMKs) for encryption. The DevOps engineer has set up an S3 bucket with default encryption using SSE-KMS. The bucket policy allows access only to a specific IAM role. The engineer also enabled S3 bucket versioning and MFA Delete. However, when the engineer tries to download an object using the AWS CLI with the IAM role, the command fails with 'AccessDenied'. The IAM role has the following permissions: s3:GetObject, s3:ListBucket, kms:Decrypt, kms:DescribeKey. What is the most likely missing permission?

Accepted Answer

The KMS key policy does not grant the IAM role permission to decrypt using the key.. When an IAM role has kms:Decrypt but the KMS key policy does not grant that role access to the key, all KMS operations fail with AccessDenied. KMS requires BOTH the IAM policy and the key policy to allow the principal — the key policy is the primary gatekeeper, so a missing grant there is the most likely cause.

Answer

The IAM role is missing kms:GenerateDataKey permission.

Answer

The IAM role is missing kms:Encrypt permission.

Answer

The IAM role is missing kms:CreateGrant permission.

Question 11

A DevOps team is using this IAM policy to allow a CI/CD pipeline to launch EC2 instances and retrieve parameters. However, the pipeline is failing with an 'AccessDenied' error when trying to create an instance. The pipeline uses a role with this policy attached. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on additional resources required for RunInstances, such as images and network interfaces.. The IAM policy likely only grants permissions on the 'ec2:RunInstances' action for the EC2 instance resource (arn:aws:ec2:region:account:instance/*), but creating an EC2 instance also requires permissions on other resources such as Amazon Machine Images (AMI), security groups, network interfaces, subnets, etc. Without explicit permissions on these additional resources, the RunInstances call fails with AccessDenied. Option A is incorrect because the condition syntax does not cause an AccessDenied; it would simply not match if poorly formatted. Option B is incorrect because the ssm:GetParameter action is allowed by the policy if it includes a resource specification, but the failure is on RunInstances, not SSM. Option D is incorrect because DescribeInstances does not require a Resource specification in the policy; the policy syntax is valid.

Answer

The condition StringEquals on InstanceType is incorrectly formatted.

Answer

The pipeline does not have permission to call ssm:GetParameter because the resource is not specified.

Answer

The policy must include a 'Resource' for the 'ec2:DescribeInstances' action to be valid.

Question 12

A company is using Amazon CloudWatch Logs to store application logs. The DevOps team wants to set up real-time monitoring for specific error patterns and trigger remediation actions. Which TWO services can process the log events in real time and invoke an AWS Lambda function for remediation? (Choose two.)

Accepted Answer

Stream log events to Amazon Kinesis Data Streams and configure a Lambda function to process the stream.. Option A is correct because CloudWatch Logs subscription filters can stream log events in real time to Amazon Kinesis Data Streams, and a Lambda function can be configured with the Kinesis stream as an event source to process records and invoke remediation logic. Option B is correct because a CloudWatch Logs subscription filter can deliver matching log events directly to AWS Lambda in real time, which is the native pattern for real-time log processing and automated remediation. Option C is not correct because EventBridge rules match on CloudWatch Logs API events such as CreateLogGroup or PutRetentionPolicy, not on the contents of individual log events, so it cannot process error patterns in real time. Option D is not correct because CloudWatch Logs does not natively send log events to Amazon SQS, and polling SQS is not a real-time push-based processing pattern. Option E is not correct because CloudWatch Logs does not publish log events directly to Amazon SNS, and even if it did, SNS-to-Lambda is not a supported real-time log event processing path for this scenario.

Answer

Create an Amazon EventBridge rule that matches on CloudWatch Logs log group events.

Answer

Configure the log group to send log events to an Amazon SQS queue, and have the Lambda function poll the queue.

Answer

Publish log events to an Amazon SNS topic and subscribe the Lambda function.

Question 13

A DevOps engineer is designing a centralized logging solution for a multi-account AWS environment. The solution must be cost-effective and provide real-time log analysis. Which THREE services should they consider?

Accepted Answer

Amazon OpenSearch Service (Elasticsearch). Amazon CloudWatch Logs (D) is correct because it is the native AWS service for collecting, storing, and monitoring log data from EC2 instances, Lambda functions, and other AWS resources, and it supports real-time metric filters and subscription filters for analysis. Amazon Kinesis Data Firehose (B) is correct because it reliably streams log data in near real-time to destinations such as Amazon S3, Amazon OpenSearch Service, or Splunk, and it can transform and batch records cost-effectively. Amazon OpenSearch Service (A) is correct because it provides real-time search, analytics, and visualization of log data via Kibana, making it ideal for interactive log analysis in a centralized multi-account setup. Amazon S3 (C) is not marked correct because, while it is a cost-effective storage destination for logs, it is not a real-time analysis service on its own. AWS CloudTrail (E) is not marked correct because it records API activity and account events for auditing, not application or system log aggregation and real-time analysis.

Answer

Amazon S3

Answer

AWS CloudTrail

Question 14

A DevOps team needs to enforce that all S3 buckets in an AWS account are encrypted at rest. Which THREE steps should be taken to achieve this? (Choose THREE.)

Accepted Answer

Configure AWS Config rules to detect buckets without encryption. Option A is correct because AWS Config managed rules such as s3-bucket-server-side-encryption-enabled continuously evaluate buckets and flag any that lack default encryption, giving the team the detection and compliance visibility needed to enforce encryption at rest. Option B is correct because an S3 bucket policy with a Deny effect on s3:PutObject when the request lacks the s3:x-amz-server-side-encryption condition (or aws:SecureTransport-style encryption conditions) blocks unencrypted uploads, actively enforcing encryption for objects written to the bucket. Option D is correct because enabling default encryption (SSE-S3/AES-256 or SSE-KMS) on each bucket ensures all objects are encrypted at rest automatically, even if clients do not specify encryption headers. Option C is not correct because S3 server access logging only records request details for auditing; it does not detect or enforce encryption. Option E is not correct because S3 Transfer Acceleration only speeds up uploads over long distances using edge locations and has no bearing on encryption at rest.

Answer

Enable S3 server access logging

Answer

Enable S3 Transfer Acceleration

Question 15

A DevOps engineer is tasked with auditing all AWS API calls made in the account for compliance purposes. The engineer needs to ensure that the audit logs are tamper-proof and stored cost-effectively. Which TWO services should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it is the service that records all AWS API activity in an account as event logs, which is exactly what is needed to audit API calls for compliance. Amazon S3 with Object Lock enabled (C) is correct because CloudTrail delivers its logs to an S3 bucket, and S3 Object Lock provides WORM (write-once-read-many) protection so the logs cannot be altered or deleted, while S3 storage classes keep the cost low for long-term retention. AWS Config (A) is not correct because it records resource configuration changes and compliance state, not the full set of API calls. Amazon CloudWatch Logs (D) is not correct because it is a log storage and monitoring service, not the API audit trail itself, and it lacks the immutable WORM guarantee. AWS KMS (E) is not correct because it provides encryption key management, which supports security but does not by itself create tamper-proof, cost-effective audit logs.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS KMS

Question 16

A company is using AWS KMS to encrypt data. Which TWO statements about AWS KMS key rotation are correct? (Choose TWO.)

Accepted Answer

Customer managed keys can be configured for automatic rotation. Option A is correct because AWS KMS allows you to enable automatic rotation on customer managed keys, rotating the backing key material every year (365 days) while keeping the same key ID and ARN. Option E is correct because AWS managed keys are automatically rotated every year by AWS, with no configuration required or possible on the customer's part. Option B is incorrect because imported key material (keys with origin EXTERNAL) cannot be automatically rotated by KMS; you must manually rotate by re-importing new material. Option C is incorrect because automatic rotation is opt-in for customer managed keys and is not enabled by default. Option D is incorrect because you cannot enable or disable rotation for AWS managed keys; AWS controls their rotation lifecycle entirely.

Answer

Keys imported into KMS support automatic rotation

Answer

Automatic rotation is enabled by default for customer managed keys

Answer

Automatic rotation can be disabled for AWS managed keys

Question 17

A company experiences a security incident where an IAM user's access key is compromised. Which THREE steps should the DevOps engineer take immediately?

Accepted Answer

Review AWS CloudTrail logs for any unauthorized API calls. Option A is correct because AWS CloudTrail records all API activity in the account, so reviewing its logs lets the engineer identify unauthorized calls made with the compromised access key and assess the incident's scope. Option B is correct because rotating the access key—creating a new key pair and deleting the compromised key—immediately invalidates the leaked credential so it can no longer be used for API authentication. Option E is correct because if the compromised IAM user had assumed roles or obtained temporary credentials via STS, those session tokens remain valid until expiry, so they must be explicitly revoked (e.g., by attaching a deny-all policy or using AWSRevokeOlderSessions) to cut off the attacker's access. Option C does not belong because changing the IAM user's console password does not affect the compromised access key, which is used for programmatic API calls rather than console sign-in. Option D does not belong because deleting and recreating the IAM user is a disruptive, unnecessary step that would break existing permissions and resource associations; rotating the key and revoking sessions is sufficient to contain the incident.

Answer

Change the IAM user's password

Answer

Delete the IAM user and recreate it

Question 18

A DevOps team is troubleshooting an application that occasionally throws 'Connection reset by peer' errors when connecting to an RDS MySQL instance. The errors are intermittent and seem to correlate with high traffic. Which TWO steps should the team take to diagnose the issue?

Accepted Answer

Check the RDS error log for messages about connection timeouts or aborted connections.. Option A is correct because the RDS error log records server-side events such as 'Aborted connection' and connection timeout messages that directly explain why the server is resetting client connections under load. Option D is correct because Performance Insights captures database load (DBLoad) broken down by wait events and top SQL, letting the team pinpoint the bottleneck causing intermittent resets during high traffic. Option B is not a diagnostic step and blindly raising max_connections may not address the root cause. Option C is a high-availability configuration change, not a troubleshooting action, and Multi-AZ does not resolve connection resets. Option E is unlikely to be the cause since security group misconfiguration would produce consistent connection failures, not intermittent resets correlated with traffic.

Answer

Increase the max_connections parameter in the DB parameter group.

Answer

Enable Multi-AZ deployment to provide a standby instance.

Answer

Review the security group rules to ensure the application can connect.

Question 19

A company is designing a CI/CD pipeline for a microservices architecture using AWS CodePipeline. They want to use infrastructure as code to manage the pipeline itself. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CodePipeline. AWS CloudFormation [CORRECT] is the infrastructure-as-code service that lets you define and provision AWS resources, including the CodePipeline pipeline itself, in a declarative template so the pipeline is version-controlled and reproducible. AWS CodePipeline [CORRECT] is the CI/CD orchestration service that is being managed as code; CloudFormation supports an AWS::CodePipeline::Pipeline resource type, so the two services work together to define and run the pipeline from a template. AWS Service Catalog is a catalog of approved products for governed provisioning, not a way to author the pipeline as code, so it does not belong. AWS CodeDeploy is a deployment service used as a pipeline action provider, not the IaC mechanism for managing the pipeline. AWS Elastic Beanstalk is a PaaS application-hosting service, not a pipeline-definition or IaC tool.

Answer

AWS Service Catalog

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 20

A company wants to protect its AWS account credentials. Which TWO practices are recommended by AWS? (Choose TWO.)

Accepted Answer

Enable multi-factor authentication (MFA) for privileged users.. Option C is correct because AWS recommends enabling multi-factor authentication (MFA) for privileged users, adding a second authentication factor (such as a virtual MFA device, hardware TOTP token, or FIDO2 security key) so that a stolen password alone cannot compromise the account. Option E is correct because IAM roles provide temporary credentials via AWS STS (AssumeRole), so applications, EC2 instances, and Lambda functions can access AWS services without embedding long-lived access keys in code or configuration. Option A is wrong because AWS advises against generating and sharing access keys; keys are long-lived credentials that should be rotated and never shared, and permissions should be granted per identity. Option B is wrong because storing IAM user passwords in a shared document exposes credentials; passwords should be managed with strong policies and never stored in plaintext shared locations. Option D is wrong because the root user has unrestricted access and AWS strongly recommends locking away root credentials, enabling MFA on root, and using IAM users or roles with least privilege for daily administrative tasks.

Answer

Generate and share access keys for all users.

Answer

Store IAM user passwords in a shared document.

Answer

Use the root user for daily administrative tasks.