DOP-C02 Mock Exam 76 — 25 Questions

Question 1

A company is using AWS CloudTrail to log API events. The security team wants to ensure that log files are tamper-proof and available for incident investigation. Which TWO actions should be taken? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable CloudTrail log file validation.. Option C is correct because enabling CloudTrail log file validation generates a digest file for each log file, allowing you to verify that logs have not been altered or deleted after delivery. Option D is correct because S3 Object Lock enforces WORM (write once, read many) protection, preventing log files from being overwritten or deleted during a defined retention period, which directly supports tamper-proofing and availability for investigations. Option A is not correct because CloudWatch Logs is a monitoring/log aggregation service and does not by itself provide tamper-proofing or immutability for CloudTrail log files. Option B is not correct because SSE-S3 only provides encryption at rest and does not prevent modification or deletion of log files. Option E is not correct because AWS KMS encryption, while stronger in key control, still does not enforce immutability or tamper resistance on its own.

Answer

Store logs in Amazon CloudWatch Logs.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3).

Answer

Use AWS KMS to encrypt the logs.

Question 2

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Use the CloudWatch Logs console or API to associate the KMS key with the log group. Option E is correct because CloudWatch Logs encryption at rest with a customer-managed key requires first creating a customer-managed KMS key in KMS and attaching a key policy that grants the CloudWatch Logs service principal (logs..amazonaws.com) the necessary kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:Describe* permissions. Option A is correct because, once the key exists, you must explicitly associate it with the specific log group using the CloudWatch Logs console, the AWS CLI (aws logs associate-kms-key --log-group-name --kms-key-id ), or the AssociateKmsKey API; encryption is applied at the log group level. Option B is not correct because CloudWatch Logs has no account-level 'default encryption' toggle; encryption must be set per log group. Option C is not correct because a log group resource policy controls access to log data, not KMS encryption, and does not enable encryption at rest. Option D is not correct because KMS keys are associated with log groups, not individual log streams, so per-stream association is neither possible nor required.

Answer

Enable default encryption for CloudWatch Logs in the AWS account settings

Answer

Update the log group's resource policy to reference the KMS key

Answer

Associate the KMS key with each log stream individually

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application logs show that some requests are timing out. The team needs to identify the source of the issue. Which TWO steps should they take?

Accepted Answer

Enable ALB access logs and analyze them.. Option A is correct because ALB access logs capture detailed per-request information such as request processing time, target response time, and the specific error codes (e.g., 504 Gateway Timeout) returned by the load balancer, which directly helps pinpoint whether timeouts originate at the ALB or the backend targets. Option D is correct because CloudWatch metrics for the ALB, particularly 'TargetResponseTime' and 'RequestCount', reveal latency trends and traffic patterns that indicate whether targets are slow or overloaded, helping isolate the source of the timeouts. Option B is not appropriate because VPC Flow Logs only capture IP-level metadata (source/destination, ports, accept/reject) and cannot show HTTP-layer timing or application-level errors. Option C is not appropriate because AWS WAF logs only record requests that match or are blocked by WAF rules, and the scenario does not indicate WAF is in use or that requests are being blocked. Option E is not appropriate because CloudTrail records AWS API calls for auditing, not application request behavior or latency.

Answer

Enable VPC Flow Logs to capture network traffic.

Answer

Enable AWS WAF logs to inspect HTTP requests.

Answer

Enable AWS CloudTrail to log all API calls.

Question 4

A company wants to audit all changes to IAM policies in their AWS account. Which THREE services can be used to capture and alert on IAM policy changes? (Choose THREE.)

Accepted Answer

AWS Config. AWS Config is correct because it continuously records resource configuration changes, including IAM policy changes, and can evaluate them against rules or configuration snapshots to detect and audit modifications. AWS CloudTrail is correct because it logs all API activity in the account, including IAM policy creation, modification, and deletion events (e.g., CreatePolicy, PutRolePolicy, AttachRolePolicy), providing the authoritative audit trail. Amazon EventBridge is correct because it can receive CloudTrail management events and match IAM policy change events via event patterns, then route them to targets such as SNS or Lambda for alerting. AWS Trusted Advisor is not correct because it provides best-practice checks and recommendations, not a change audit or alerting mechanism for IAM policies. Amazon Inspector is not correct because it is a vulnerability management service that scans EC2 instances, container images, and Lambda functions, and does not capture IAM policy changes.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 5

A company uses AWS Lambda for data processing. The operations team wants to be alerted when a function fails. Which TWO methods can they use?

Accepted Answer

Configure a dead-letter queue (DLQ) for the Lambda function and monitor the queue.. Option D is correct because Lambda automatically publishes the 'Errors' metric to Amazon CloudWatch, and a CloudWatch alarm can be created on that metric to trigger an Amazon SNS notification when the error threshold is breached, directly alerting the operations team. Option C is correct because configuring a dead-letter queue (an Amazon SQS queue or SNS topic) for the Lambda function captures failed asynchronous invocations, and monitoring that queue (e.g., via CloudWatch metrics like ApproximateNumberOfMessagesVisible) provides an alerting mechanism for failures. Option A is incorrect because S3 event notifications only trigger Lambda invocations on object events; they do not detect or report Lambda execution errors. Option B is incorrect because CloudTrail records API activity and management events, not Lambda function invocation failures, and it is not an alerting service. Option E is incorrect because AWS Config evaluates resource configuration compliance, not runtime function failures.

Answer

Configure S3 event notifications to trigger on Lambda errors.

Answer

Enable AWS CloudTrail to log Lambda invocations.

Answer

Use AWS Config to detect Lambda function failures.

Question 6

A company uses AWS Systems Manager Patch Manager to patch its EC2 instances. After a patch window, some instances report a 'Failed' status. The DevOps engineer needs to investigate the cause. Which actions should be taken? (Choose three.)

Accepted Answer

Check the S3 bucket where Patch Manager logs are stored for detailed error messages.. Option A is correct because Patch Manager stores detailed patch execution logs, including error messages for failed patching operations, in an S3 bucket (configured as the patch log destination), which is the primary place to inspect granular failure reasons. Option B is correct because the Patch Manager dashboard in Systems Manager shows per-instance and per-patch compliance status, letting the engineer identify exactly which patches failed and on which instances. Option D is correct because patching is executed by the SSM Agent via RunCommand; if the agent is stopped, outdated, or unable to communicate with the Systems Manager endpoints, the patch operation will fail, so verifying the agent is running and current is a key troubleshooting step. Option C is not the right focus because CloudTrail records the RunCommand API calls for auditing and API-level errors, but it does not contain the patch-level failure details needed to diagnose why a patch failed. Option E is not appropriate because AWS Config tracks resource configuration changes and compliance rules, not the execution details or error messages of Patch Manager patch jobs.

Answer

Review CloudTrail logs for the RunCommand API calls.

Answer

Use AWS Config to check the configuration history of the instances.

Question 7

A company needs to enforce that all IAM users must use multi-factor authentication (MFA) to perform any AWS Console actions. Which TWO steps should be taken to enforce this?

Accepted Answer

Attach the policy to all IAM users or a group containing all users. Option C is correct because an IAM policy that uses the aws:MultiFactorAuthPresent condition key with a Deny effect when the value is false is the standard mechanism to block console (and API) actions for users who have not authenticated with MFA. Option A is correct because such a policy only takes effect once it is attached to the relevant principals — attaching it to all IAM users or to a group that contains all users ensures every user is covered. Option B is not appropriate here because SCPs apply at the AWS Organizations OU/account level and cannot enforce per-IAM-user MFA for console sign-in within a single account. Option D is irrelevant since an account alias only changes the sign-in URL and has no bearing on MFA enforcement. Option E is incorrect because CloudTrail only records API activity for auditing; it does not enforce MFA.

Answer

Create an SCP in AWS Organizations

Answer

Set an account alias for the root user

Answer

Enable CloudTrail to log MFA usage

Question 8

A company uses AWS Organizations to manage multiple accounts. The DevOps team needs to monitor for any IAM user creation across all accounts in the organization. Which THREE steps should be taken to implement this centralized monitoring?

Accepted Answer

Create a CloudWatch Logs metric filter on the organization's CloudTrail log group for 'CreateUser' events.. Option B is correct because an organization trail created in the management account automatically applies to all member accounts, delivering CloudTrail events such as IAM CreateUser to a central S3 bucket and CloudWatch Logs, which is the foundation for centralized monitoring. Option A is correct because a CloudWatch Logs metric filter on the organization's CloudTrail log group can match the 'CreateUser' event name and turn each occurrence into a custom metric, enabling detection of IAM user creation across all accounts. Option E is correct because a CloudWatch alarm on that metric can trigger notifications through Amazon SNS, providing the DevOps team with real-time alerts when IAM users are created. Option C is not needed because S3 event notifications on object creation only signal that a log file was delivered, not that a CreateUser event occurred, and CloudWatch Logs metric filters are the appropriate mechanism. Option D is not appropriate because AWS Config rules evaluate resource configuration compliance and are not the primary real-time event-detection mechanism for API calls like CreateUser; CloudTrail plus CloudWatch is the intended solution.

Answer

Configure an S3 bucket to receive CloudTrail logs from all accounts and enable S3 event notifications for object creation.

Answer

Use AWS Config rules to detect IAM user creation across accounts.

Question 9

Which TWO AWS services can be used to monitor for unauthorized API calls in an AWS account? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (D) is correct because it records every API call made in the account as events, including the identity of the caller, source IP, and time, which lets you detect unauthorized or suspicious API activity. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to surface findings such as anomalous or unauthorized API calls. AWS Config (A) is not the right choice because it evaluates resource configuration compliance and records configuration changes, not the authorization status of API callers. Amazon S3 (B) is only object storage and does not monitor API activity. Amazon CloudWatch Logs (C) can store and query log data, but by itself it does not capture or detect unauthorized API calls without CloudTrail as the source.

Answer

AWS Config

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Question 10

Which TWO actions are effective ways to protect an AWS account root user? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) on the root user.. Option C is correct because enabling MFA on the root user adds a second authentication factor, so a compromised password alone cannot be used to sign in to the highly privileged root account. Option E is correct because root user access keys grant programmatic access with full account privileges, and AWS best practice is to delete them or, if they cannot be deleted, disable and rotate them so they cannot be abused. Options A and D are not the recommended controls: AWS does not require or recommend periodic root password rotation as a primary protection, and password complexity alone does not mitigate credential theft. Option B is incorrect because using the root user for everyday administrative tasks violates least privilege and greatly increases the blast radius of a compromise; instead, create IAM users or roles with the needed permissions.

Answer

Use a strong, complex password and change it every 90 days.

Answer

Use the root user for everyday administrative tasks.

Answer

Rotate the root user password every 30 days.

Question 11

A DevOps team is designing a solution to encrypt data at rest for an Amazon RDS for MySQL database. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use AWS KMS to create a customer managed key and assign it to the RDS instance. Option D is correct because Amazon RDS encryption at rest must be enabled at the moment the DB instance is created — you select 'Enable encryption' in the create-database workflow, and RDS then encrypts the underlying storage, automated backups, read replicas, and snapshots with the chosen KMS key. Option C is correct because RDS encryption at rest is implemented through AWS KMS, so the team should create a customer managed key (CMK) in KMS and assign it to the DB instance during creation to control key rotation, policies, and audit via CloudTrail. Option A is wrong because you cannot enable encryption on an existing unencrypted RDS instance by modifying it; you must restore from a snapshot into a new encrypted instance. Option B is wrong because SSL/TLS secures data in transit between clients and the DB, not data at rest on storage. Option E is wrong because RDS manages its own storage volumes and does not store database files in an S3 bucket that you can encrypt.

Answer

Enable encryption after creating the RDS instance by modifying the instance

Answer

Enable SSL/TLS for the RDS instance

Answer

Store the database files in an encrypted S3 bucket

Question 12

Which TWO actions should a DevOps engineer take to secure an AWS account root user? (Choose 2.)

Accepted Answer

Delete or disable the root user access keys.. Option C is correct because deleting or disabling the root user's access keys eliminates a long-lived, highly privileged credential that could be used for programmatic access; AWS best practice is to have no access keys on the root user at all. Option E is correct because enabling MFA on the root user adds a second authentication factor, so a compromised password alone cannot be used to sign in to the account's most powerful identity. Options A, B, and D are not appropriate: sharing the root password violates least privilege and accountability, IAM roles cannot be created for or assumed by the root user (roles are for IAM principals), and using root for daily administrative tasks contradicts the practice of using scoped IAM users or roles for routine work.

Answer

Share the root user password with the team.

Answer

Create an IAM role for the root user.

Answer

Use the root user for daily administrative tasks.

Question 13

Which THREE are components of the AWS Shared Responsibility Model? (Choose THREE.)

Accepted Answer

Customers are responsible for managing IAM users and permissions. Option B is correct because under the AWS Shared Responsibility Model, identity and access management — including creating, managing, and rotating IAM users, groups, roles, and policies — is a customer responsibility in the cloud. Option D is correct because customers are always responsible for the security and classification of their own data, including encryption choices and access controls, regardless of which AWS service is used. Option E is correct because AWS is responsible for security OF the cloud, meaning the physical facilities, hardware, networking, and foundational services that underpin the AWS global infrastructure. Option A is incorrect because patching guest operating systems and customer applications on EC2 is the customer's responsibility, not AWS's. Option C is incorrect because managing customer IAM roles is a customer task; AWS only provides and secures the IAM service itself.

Answer

AWS is responsible for patching customer applications on EC2

Answer

AWS is responsible for managing customer IAM roles

Question 14

A company is using Amazon CloudWatch Logs to collect logs from multiple applications. The DevOps team wants to create a metric filter to count the number of ERROR log entries and trigger an alarm when the count exceeds 10 in 5 minutes. Which TWO steps must the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group that extracts ERROR count.. Option B is correct because a CloudWatch Logs metric filter must be defined on the log group to parse log events and publish a custom metric that counts occurrences of the ERROR pattern; this is the mechanism that turns raw log data into a numeric CloudWatch metric. Option C is correct because once the metric exists, a CloudWatch alarm is created against that metric with a threshold of 10 and an evaluation period of 5 minutes so it can trigger when the count exceeds the limit. Option A is not needed because subscription filters stream logs to destinations like Kinesis Data Firehose for processing, not for creating metrics or alarms. Option D is irrelevant because retention policy only controls how long log events are stored and does not affect metric filtering or alarming. Option E is unnecessary because a dashboard only visualizes metrics and does not create the metric or trigger the alarm.

Answer

Create a subscription filter to stream logs to Amazon Kinesis Data Firehose.

Answer

Set a log group retention policy to retain logs indefinitely.

Answer

Create a CloudWatch dashboard to visualize the ERROR count.

Question 15

A company wants to ensure that its application running on AWS can withstand the failure of an entire AWS Region. Which TWO strategies should the company implement?

Accepted Answer

Deploy the application in multiple AWS Regions using an active-active or active-passive pattern. Option A is correct because deploying the application in multiple AWS Regions using an active-active or active-passive pattern ensures that if an entire Region fails, traffic can be served from another Region, providing true Region-level fault tolerance. Option C is correct because replicating data across Regions with services like DynamoDB global tables or RDS cross-Region replication ensures the application's data is available in the secondary Region, which is essential for the failover strategy in Option A to work. Option B is incorrect because multiple Availability Zones within a single Region only protect against AZ-level failures, not the failure of an entire Region. Option D is incorrect because a single CloudFront distribution with multiple origins in the same Region still depends on that one Region and does not survive a Region-wide outage. Option E is incorrect because RDS read replicas in the same Region remain within that Region and would be lost if the entire Region failed.

Answer

Deploy the application across multiple Availability Zones in a single Region

Answer

Use a single CloudFront distribution with multiple origins in the same Region

Answer

Configure RDS read replicas in the same Region

Question 16

Which TWO of the following are benefits of using AWS Certificate Manager (ACM) to manage SSL/TLS certificates? (Choose two.)

Accepted Answer

Automatic renewal of certificates.. Option C is correct because ACM automatically renews certificates that it issued and manages, as long as the certificate is in use and the domain validation remains valid, eliminating manual renewal overhead. Option D is correct because ACM certificates can be directly associated with Elastic Load Balancing (ALB/NLB) and Amazon CloudFront distributions, enabling seamless deployment of TLS termination without exporting private keys. Option A is not a listed benefit because ACM-issued public certificates cannot be exported or installed directly on EC2 instances; you must use services like ELB, CloudFront, or API Gateway. Option B is incorrect because ACM supports both wildcard and non-wildcard (single-domain and multi-domain/SAN) certificates. Option E is incorrect because ACM public certificates are free only for integrated AWS services, not for arbitrary AWS services or exportable use, and ACM Private CA certificates incur cost.

Answer

Ability to use the same certificate on multiple EC2 instances.

Answer

Support for wildcard certificates only.

Answer

Free certificates for use on any AWS service.

Question 17

A company uses AWS CloudFormation to manage infrastructure. The development team wants to promote changes from a development environment to a production environment using change sets. They need to ensure that the production stack is not updated if there are any changes to the stack's IAM policies. Which approach should the team use?

Accepted Answer

Create a ChangeSet from the updated template, review the changes for IAM modifications, and execute only if no IAM changes are present.. AWS CloudFormation change sets allow you to review the proposed changes to a stack before executing them. By creating a change set from the updated template, the team can inspect the list of changes and specifically look for any modifications to IAM resources (e.g., AWS::IAM::Role, AWS::IAM::Policy). If the change set contains IAM-related changes, they can choose not to execute it, thereby preventing unintended updates to the production stack's IAM policies.

Answer

Enable drift detection on the production stack and compare with the development stack.

Answer

Use AWS CloudFormation StackSets to deploy to multiple accounts and use stack instance filters.

Answer

Use a custom resource in the template that checks for IAM changes and fails the update.

Question 18

A DevOps engineer runs the above command and sees that one target is unhealthy with reason 'Target.Timeout'. The target is an EC2 instance running a web server on port 80. The security group for the instance allows inbound traffic on port 80 from the ALB's security group. What is the most likely cause of the health check failure?

Accepted Answer

The web server on the instance is not responding to health check requests on port 80.. The 'Target.Timeout' reason indicates that the health check request timed out, meaning the instance is not responding within the timeout period. The most common cause is that the web server is not running or is not listening on the correct port. Option C is correct because a non-responsive web server on port 80 would cause the timeout. Option A is incorrect because health checks are performed over private IPs, not public IPs. Option B is incorrect because the network ACL applies at the subnet level and would affect all traffic; the ALB's security group is already allowed inbound, and the instance's security group allows inbound from the ALB. Option D is incorrect because the ALB's security group does not need to allow outbound to the instance; traffic flows from the ALB to the instance, and the instance's security group must allow inbound from the ALB.

Answer

The instance does not have a public IP address.

Answer

The instance's network ACL is blocking inbound traffic from the internet.

Answer

The security group for the ALB does not allow outbound traffic to the instance.

Question 19

A DevOps team is designing a disaster recovery plan for a production RDS for PostgreSQL database. The RPO must be less than 5 minutes and the RTO less than 1 hour. The database size is 2 TB. Which solution is MOST cost-effective?

Accepted Answer

Create a cross-Region read replica and promote it during disaster. The most cost-effective solution that meets the RPO < 5 minutes and RTO < 1 hour for a 2 TB RDS PostgreSQL database. A cross-Region read replica uses asynchronous replication, typically with lag of seconds, ensuring RPO well under 5 minutes. Promoting the replica to a standalone instance takes minutes, satisfying the RTO. It leverages existing RDS features without additional services like DMS, and the replica instance can be sized smaller than the primary if not used, minimizing cost. Option A (cross-Region automated backups) only copies daily backups, resulting in RPO up to 24 hours, failing the requirement. Option B (manual snapshots every 5 minutes) is impractical and costly. Option C (DMS continuous replication) meets RPO but incurs extra compute and data transfer costs, making it less cost-effective than a read replica.

Answer

Enable cross-Region automated backups with a retention period of 1 day

Answer

Take manual snapshots every 5 minutes and copy them to another Region

Answer

Use AWS Database Migration Service (DMS) for continuous replication to another Region

Question 20

A company is building a multi-tier web application on AWS. The application must be resilient to the failure of an entire Availability Zone. The architecture includes an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group, and an Amazon RDS for MySQL database. Which TWO actions should be taken to achieve this resilience? (Choose two.)

Accepted Answer

Configure the Auto Scaling group to launch EC2 instances in at least two Availability Zones.. Option D is correct because an Auto Scaling group configured to span at least two Availability Zones ensures that if one AZ fails, the remaining AZ can continue serving traffic behind the ALB, maintaining compute capacity and application availability. Option E is correct because an RDS for MySQL Multi-AZ deployment maintains a synchronous standby replica in a different AZ and automatically fails over to it if the primary AZ becomes unavailable, providing database resilience. Option A is incorrect because a read replica is asynchronous and is intended for read scaling, not automatic failover for high availability. Option B is incorrect because a Single-AZ RDS database has no standby in another AZ and cannot survive an AZ failure. Option C is incorrect because placing all EC2 instances in one AZ concentrates the workload in a single failure domain, defeating the resilience requirement.

Answer

Configure an RDS read replica in a different Availability Zone.

Answer

Use a Single-AZ RDS for MySQL database to keep costs low.

Answer

Place all EC2 instances in the same Availability Zone to reduce cross-AZ data transfer costs.