DOP-C02 Mock Exam 77 — 25 Questions

Question 1

A company uses Amazon RDS Multi-AZ for disaster recovery. The primary DB instance in us-east-1a fails. What happens next?

Accepted Answer

The standby DB instance in us-east-1b is promoted automatically and the CNAME record is updated. RDS Multi-AZ maintains a synchronous standby replica in a different AZ and performs automatic failover by promoting the standby and updating the DB instance's DNS CNAME to point to the new primary. The failover is triggered by the primary's failure and typically completes in 60–120 seconds, with no manual intervention required. Applications using the endpoint hostname reconnect transparently once DNS TTL expires.

Answer

The administrator must manually promote the standby instance

Answer

The primary instance is automatically rebuilt in the same AZ

Answer

A read replica in us-east-1b is automatically promoted to primary

Question 2

A company runs a stateless web application on EC2 instances behind an Application Load Balancer. To improve resilience, which configuration should be used for the EC2 instances?

Accepted Answer

Use multiple EC2 instances across two or more Availability Zones. D is correct because deploying multiple EC2 instances across two or more Availability Zones (AZs) ensures high availability and fault tolerance. If one AZ fails, the Application Load Balancer (ALB) automatically routes traffic to healthy instances in other AZs, maintaining service continuity. This aligns with the AWS Well-Architected Framework's resilience best practices for stateless applications.

Answer

Use one EC2 instance with a larger instance type

Answer

Use a single, large EC2 instance in one Availability Zone

Answer

Use multiple EC2 instances in one Availability Zone with health checks disabled

Question 3

A DevOps engineer is setting up a CI/CD pipeline for a microservices application using AWS CodePipeline. The pipeline includes a Test stage that runs integration tests against a staging environment. The engineer wants to ensure that manual approval is required before deploying to production. Which action should be taken?

Accepted Answer

Add a manual approval action in the pipeline stage before production deployment.. AWS CodePipeline supports a manual approval action that can be added to any stage. By placing this action in the stage immediately before the production deployment, the pipeline will pause and require an authorized user to manually approve the transition, ensuring that integration tests have passed before any production release occurs.

Answer

Configure a CodeCommit approval rule template to block the merge.

Answer

Use CloudWatch Events to send a notification and wait for a custom signal.

Answer

Set the pipeline to only run on manual invocation.

Question 4

A DevOps engineer manages a build account where CodeBuild projects run in a VPC to reach an internal artifact repository. The projects must pull a database password from AWS Secrets Manager at build time. The build role's IAM policy already grants secretsmanager:GetSecretValue on the secret ARN, but every build fails with a connection timeout when the AWS CLI attempts the call. The VPC has private subnets, a NAT gateway, and a VPC endpoint for Amazon S3 only. What is the MOST operationally efficient change that lets the builds retrieve the secret while keeping the traffic off the public internet?

Accepted Answer

Create an interface VPC endpoint for secretsmanager in the build VPC, and attach a security group that allows HTTPS from the build subnet CIDR.. Interface VPC endpoints use AWS PrivateLink to create private ENIs in the subnet, letting CodeBuild reach Secrets Manager without NAT or internet egress. Because the endpoint is an ENI, its security group must allow inbound HTTPS from the build subnets, and the private DNS name for secretsmanager is resolved locally. Gateway endpoints only serve S3 and DynamoDB, so the existing S3 endpoint cannot cover this call.

Answer

Modify the build role's trust policy to allow secretsmanager.amazonaws.com to assume it, so the CLI call is authorized inside the VPC.

Answer

Enable public access on the secret and add an internet gateway route to the private subnet route tables so the CLI can reach the regional endpoint.

Answer

Add a gateway VPC endpoint for secretsmanager to the route tables of the private subnets so the CLI calls resolve to the endpoint.

Question 5

A company manages a large AWS CloudFormation template that defines a VPC, subnets, an Application Load Balancer, and an Auto Scaling group. The template has grown to over 2,000 lines and is difficult to maintain. The DevOps team wants to break the template into smaller, reusable components that can be versioned and shared across multiple teams. The components must be able to be included in other templates and must support parameters to customize values. Which CloudFormation feature should the team use?

Accepted Answer

CloudFormation modules. CloudFormation modules allow teams to package resource configurations into reusable, versioned components that can be included in multiple templates. They support parameters, enabling customization, and are ideal for breaking down monolithic templates. Unlike nested stacks, modules are lightweight and designed for sharing, making them the best fit for this scenario.

Answer

CloudFormation nested stacks

Answer

CloudFormation change sets

Answer

CloudFormation stack policies

Question 6

A company runs a critical batch processing workload on a fleet of EC2 instances in a single AWS Region. The workload can tolerate interruptions but must complete within 4 hours and must not lose progress if an instance is terminated. The company wants to minimize cost and operational overhead while ensuring resilience against a single Availability Zone failure. Which solution meets these requirements?

Accepted Answer

Use Spot Instances with a diversified allocation strategy across multiple Availability Zones, and store intermediate results in Amazon S3.. The workload is interruptible, so Spot Instances are the most cost-effective choice. A diversified allocation strategy across multiple Availability Zones reduces correlated interruptions and provides AZ resilience. Storing intermediate results in Amazon S3 ensures progress is preserved because any instance can retrieve the latest checkpoint. This solution satisfies cost, availability, and durability requirements with minimal operational overhead.

Answer

Use Reserved Instances in a single Availability Zone, and store intermediate results on instance store volumes.

Answer

Use On-Demand instances spread across multiple Availability Zones, and store intermediate results in an Amazon S3 bucket.

Answer

Use Spot Instances in a single Availability Zone, and store intermediate results on Amazon EBS volumes attached to each instance.

Question 7

A company uses AWS CodeBuild to build a Java application. The buildspec.yml file includes a post_build phase that runs a script to package the application and upload it to an Amazon S3 bucket. The build is failing with an error indicating that the S3 bucket is not accessible. The CodeBuild service role has the AmazonS3FullAccess managed policy attached. The S3 bucket is in a different AWS account. Which action should the DevOps engineer take to resolve the issue?

Accepted Answer

Add a bucket policy to the S3 bucket that grants the CodeBuild service role permissions to PutObject.. Cross-account access to S3 requires a bucket policy that explicitly grants permissions to the external IAM role. The CodeBuild service role already has S3 permissions in its own account, but the bucket policy in the target account must allow the role to perform PutObject. Therefore, adding a bucket policy is the correct resolution.

Answer

Configure the S3 bucket to allow public write access.

Answer

Enable cross-account access in the CodeBuild project settings.

Answer

Modify the CodeBuild service role to include the s3:PutObject permission for the specific bucket ARN.

Question 8

A company runs a containerized order-processing service on Amazon EKS. The DevOps team wants to detect when the service's CPU utilization exceeds 80% for 5 consecutive minutes and then automatically notify an on-call engineer. They also need to see both application logs and CPU metrics side-by-side in a single dashboard for troubleshooting. Which combination of AWS services should the team use to meet these requirements with the LEAST operational overhead?

Accepted Answer

Amazon CloudWatch Container Insights with CloudWatch alarms and CloudWatch dashboards. Container Insights provides native EKS monitoring with automatic metric and log collection, and CloudWatch alarms and dashboards integrate directly to alert on CPU thresholds and visualize logs and metrics together. The other options either lack CPU metric collection or require substantial additional tooling and management, making them less suitable for a low-overhead solution.

Answer

AWS X-Ray with CloudWatch Logs Insights and CloudWatch alarms

Answer

AWS CloudTrail with Amazon EventBridge rules and Amazon SNS topics

Answer

Amazon Managed Service for Prometheus with AWS Distro for OpenTelemetry and Grafana dashboards

Question 9

A DevOps engineer manages a fleet of EC2 instances in a private subnet. The instances must access an Amazon S3 bucket to read configuration files. The security team requires that all traffic to S3 be encrypted in transit and that the EC2 instances do not use the public internet. The engineer has already created an S3 gateway endpoint and attached it to the VPC route table. Which additional step should the engineer take to meet these requirements?

Accepted Answer

Modify the S3 bucket policy to deny requests where aws:SecureTransport is false.. The gateway endpoint provides private network routing, but encryption in transit must be enforced separately. A bucket policy that denies requests when aws:SecureTransport is false ensures that only HTTPS requests are allowed, satisfying the encryption requirement. IAM roles handle authorization, interface endpoints are an alternative connectivity method, and default encryption addresses data at rest, not in transit.

Answer

Configure the EC2 instances to use an S3 interface endpoint instead of the gateway endpoint.

Answer

Attach an IAM role to the EC2 instances that allows s3:GetObject on the bucket.

Answer

Enable default encryption on the S3 bucket using AES-256.

Question 10

A company uses AWS Systems Manager Parameter Store to manage configuration data for its applications. The DevOps team wants to ensure that sensitive parameters, such as database passwords, are automatically rotated every 30 days. The parameters are currently stored as `SecureString` and are referenced by AWS Lambda functions. Which solution will meet these requirements with the LEAST development effort?

Accepted Answer

Use AWS Secrets Manager to store the sensitive parameters and configure automatic rotation using a Lambda rotation function.. AWS Secrets Manager is designed for secret rotation and integrates with Lambda for automatic rotation. It supports scheduled rotation, reducing development effort compared to custom solutions. Storing secrets in Secrets Manager and enabling rotation every 30 days meets the requirement efficiently, while Parameter Store would require custom rotation logic.

Answer

Store the parameters in AWS Key Management Service (KMS) encrypted S3 buckets and use S3 Lifecycle policies to rotate the encryption keys every 30 days.

Answer

Create a custom AWS Lambda function that generates new passwords and updates the Parameter Store parameters on a schedule using Amazon EventBridge.

Answer

Use AWS Systems Manager Automation to run a document that rotates the parameters and updates the Lambda functions' environment variables.

Question 11

A platform team runs Amazon EKS clusters across three AWS accounts and wants centralized observability. They need (1) container-level CPU and memory metrics with custom dimensions for namespace and workload, and (2) application logs from all pods shipped to a single destination, queryable with a structured query language. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Configure Fluent Bit on each node to send pod logs to a CloudWatch Logs log group, and use CloudWatch Logs Insights for structured queries.. Container Insights via the CloudWatch Observability EKS add-on supplies the CPU and memory metrics with namespace and workload dimensions, while Fluent Bit log shipping to CloudWatch Logs provides the centralized, queryable log destination. Together they satisfy both the metric-dimension and structured-log-query requirements across the three accounts using native AWS observability services.

Answer

Enable AWS CloudTrail data events on the EKS cluster to capture pod-level container metrics from the Kubernetes API server.

Answer

Deploy Prometheus with the CloudWatch agent's Prometheus scraping feature and rely on CloudWatch Logs for log aggregation without Fluent Bit.

Answer

Use AWS Config conformance packs to aggregate pod logs from all three accounts into a single queryable destination.

Question 12

A DevOps engineer is using AWS CodeBuild to build a container image and push it to Amazon ECR. The buildspec.yml file includes a post_build phase that runs `docker push`. The build fails with an error indicating that the Docker daemon is not available. The CodeBuild project uses the `aws/codebuild/standard:5.0` image and has privileged mode disabled. Which action should the engineer take to resolve the issue?

Accepted Answer

Enable privileged mode in the CodeBuild project configuration.. Docker requires privileged mode in CodeBuild to run the Docker daemon. Enabling privileged mode in the project configuration allows Docker commands to execute, resolving the error. Other options do not address the underlying permission issue and would not allow Docker to run.

Answer

Add a pre_build phase to start the Docker daemon manually using `sudo service docker start`.

Answer

Use the `docker buildx` command instead of `docker build` to avoid needing privileged mode.

Answer

Switch to a custom build image that includes Docker pre-installed and configured.

Question 13

A company runs a critical REST API on Amazon ECS Fargate behind an Application Load Balancer. The operations team wants the service to automatically recover from a failed task without manual intervention. They have configured a target group health check, but the ECS service still does not replace unhealthy tasks. What should the DevOps engineer do to ensure automatic task replacement?

Accepted Answer

Enable the ECS service to use the load balancer target group health check by specifying the target group ARN in the service definition.. For ECS services with a load balancer, ECS uses the target group health check to determine if a task is healthy. When a task fails the health check, ECS automatically stops it and starts a new one. This behavior requires that the service definition includes the load balancer configuration with the target group ARN. Without this, ECS does not monitor task health via the load balancer and will not replace unhealthy tasks.

Answer

Create an Amazon CloudWatch alarm based on the UnhealthyHostCount metric and configure it to invoke an AWS Lambda function that calls the ECS StopTask API.

Answer

Set the deployment configuration to use the rolling update strategy with a minimum healthy percent of 100 and a maximum percent of 200.

Answer

Configure the ECS service to use a container health check with the HEALTHCHECK instruction in the Dockerfile.

Question 14

A company uses AWS CodeDeploy to deploy a new version of an application to an Auto Scaling group of EC2 instances. During a deployment, the DevOps engineer notices that the deployment is stuck in the 'In Progress' state and some instances are failing to receive the new revision. The engineer needs to troubleshoot the issue. Which TWO actions should the engineer take to identify the cause of the failure? (Choose two.)

Accepted Answer

Review the deployment details in the CodeDeploy console to see which lifecycle events failed.. The most direct troubleshooting steps are to check the CodeDeploy agent logs on the affected instances and to review the deployment details in the CodeDeploy console. The agent logs provide detailed error messages specific to each instance, while the console shows the overall deployment status and which lifecycle events failed. Together, they help identify whether the issue is due to script failures, network problems, or missing dependencies.

Answer

Verify that the instances have the necessary IAM permissions to access the CodeDeploy service and S3 bucket.

Answer

Restart the CodeDeploy agent service on all instances in the Auto Scaling group.

Answer

Increase the deployment configuration to deploy to more instances at once.

Question 15

A DevOps engineer is configuring an AWS Lambda function that processes messages from an Amazon SQS queue. The function must handle transient failures gracefully and avoid reprocessing the same message multiple times. The engineer sets the maximum receives to 3 and configures a dead-letter queue (DLQ) for the source queue. After several days, the engineer notices that some messages are being processed more than once, even though they were successfully processed. What is the MOST likely cause of this issue?

Accepted Answer

The SQS queue's visibility timeout is shorter than the Lambda function's execution time.. The most likely cause is that the SQS queue's visibility timeout is shorter than the Lambda function's execution time. When a Lambda function polls an SQS queue, it receives a batch of messages and each message becomes invisible for the duration of the visibility timeout. If the function takes longer than that timeout to process a message, the message becomes visible again and can be picked up by another Lambda invocation. This results in duplicate processing. To resolve this, set the visibility timeout to at least the function's timeout plus a buffer, and ensure the function is idempotent.

Answer

The dead-letter queue is misconfigured, causing messages to be sent back to the source queue.

Answer

The Lambda function is not idempotent, so it processes the same message differently each time.

Answer

The Lambda function's timeout is set too low, causing it to fail and retry messages.

Question 16

A DevOps engineer manages a DynamoDB table that serves a high-traffic ordering API. During a flash sale, ProvisionedThroughputExceededException errors spike and the on-call engineer must reduce customer impact quickly. The table currently uses provisioned capacity and the workload is expected to surge unpredictably for the next several hours. Which action should the engineer take FIRST to mitigate the incident?

Accepted Answer

Enable DynamoDB on-demand capacity mode for the table to absorb the unpredictable traffic without throughput errors.. The scenario describes unpredictable burst traffic against a provisioned DynamoDB table producing throttling errors. Switching to on-demand capacity mode immediately removes the provisioned throughput limit and lets the table scale with the surge while still serving requests, making it the fastest and most reliable mitigation. Approaches that tune provisioned values or cache reads do not remove the write bottleneck during an unpredictable spike.

Answer

Enable DynamoDB Accelerator (DAX) in front of the table to absorb the surge.

Answer

Increase the table's provisioned read and write capacity units manually to a value matching the observed peak.

Answer

Create a global secondary index with higher capacity and redirect all API reads to it.

Question 17

A company runs an internal REST API on Amazon API Gateway backed by AWS Lambda. The operations team wants a single CloudWatch alarm that fires when the API's overall error rate exceeds 5% during any 5-minute period, without creating one alarm per resource. The API is deployed as a REST API (not HTTP API). Which approach should a DevOps engineer take?

Accepted Answer

Create a CloudWatch metric math alarm using the expression m1/m2 where m1 is the sum of the 4XXError and 5XXError metrics and m2 is the Count metric for the stage, all with period 300 and statistic Sum.. API Gateway publishes 4XXError, 5XXError, and Count per stage. A metric math alarm can sum the error metrics and divide by Count at a five-minute period, producing a single stage-level error-rate alarm. Per-method alarms, X-Ray metrics, and log metric filters either fragment the view or do not directly yield a percentage.

Answer

Enable AWS X-Ray tracing on the stage and create a CloudWatch alarm on the X-Ray ErrorRate metric for the API.

Answer

Create one CloudWatch alarm per method with a 5% threshold and combine them into a composite alarm using an OR rule.

Answer

Create a CloudWatch Logs metric filter on the API Gateway access logs and alarm on the resulting custom metric with a 5% threshold.

Question 18

A company uses AWS CloudFormation to deploy a complex application that includes an Amazon RDS database. The database must be created with a specific master password that is stored in AWS Secrets Manager. The DevOps team wants to avoid hardcoding the password in the CloudFormation template. They need to reference the secret in the template so that the RDS instance uses the password from Secrets Manager. Which approach should they take?

Accepted Answer

Use the `resolve:secretsmanager` dynamic reference to retrieve the secret value and assign it to the RDS `MasterUserPassword` property.. The `resolve:secretsmanager` dynamic reference allows CloudFormation to retrieve a secret from AWS Secrets Manager during stack operations. This enables secure injection of the secret into the RDS `MasterUserPassword` property without hardcoding. Other options either use the wrong service (Parameter Store) or introduce unnecessary complexity with custom resources or insecure storage.

Answer

Store the secret in an Amazon S3 bucket and use the `Fn::GetAtt` function to reference it in the RDS `MasterUserPassword` property.

Answer

Use the `resolve:ssm-secure` dynamic reference to retrieve the secret from Secrets Manager and pass it to the RDS `MasterUserPassword` property.

Answer

Create a custom CloudFormation resource using AWS Lambda that retrieves the secret from Secrets Manager and returns it to the template.

Question 19

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The DevOps team wants to receive an alert when the number of HTTP 5xx errors from the load balancer exceeds 100 in a 5-minute period. The team wants to use the most direct and least complex method. What should they do?

Accepted Answer

Create a CloudWatch alarm on the HTTPCode_ELB_5XX_Count metric for the load balancer with a threshold of 100 over 5 minutes, and configure an Amazon SNS topic for notifications.. Application Load Balancers automatically publish the HTTPCode_ELB_5XX_Count metric to CloudWatch, so creating an alarm on that metric with an SNS notification is the most direct and least complex solution. The other options involve unnecessary complexity or use services that do not monitor HTTP errors.

Answer

Install the CloudWatch agent on the EC2 instances to collect web server logs, and create a custom metric for 5xx errors with an alarm.

Answer

Configure AWS CloudTrail to log load balancer API calls and create an EventBridge rule to trigger an SNS notification when 5xx errors occur.

Answer

Enable access logs on the load balancer, then use CloudWatch Logs metric filters to count 5xx errors and create an alarm on the resulting metric.

Question 20

A company runs an Auto Scaling group of EC2 instances that publish custom application metrics to CloudWatch using the PutMetricData API. During a traffic spike, the operations team reports that alarms based on these metrics did not trigger even though application error rates rose sharply. The metrics are published with a one-minute resolution. Which action should a DevOps engineer take to make the alarms respond reliably during spikes?

Accepted Answer

Publish the custom metrics as high-resolution metrics and configure the alarm with a shorter evaluation period and M-out-of-N datapoints to alarm.. Custom metrics published at standard one-minute resolution can lag behind a fast spike, and a long evaluation window dilutes the signal. Publishing high-resolution metrics and configuring the alarm with a short evaluation period plus M-out-of-N datapoints to alarm lets the alarm react quickly to a genuine error-rate increase.

Answer

Change the alarm statistic to SampleCount and set the period to 60 seconds.

Answer

Configure the alarm to treat missing data as breaching and shorten the evaluation period.

Answer

Increase the alarm's evaluation period to five minutes so more data points are averaged together.