DOP-C02 Practice Test 8 — 10 Questions

Question 1

A company has a multi-region application with an RDS for MySQL database in us-east-1. They want to minimize downtime if the primary region fails. They set up a cross-region read replica in us-west-2. What additional step is needed for automated failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a custom automation to monitor the primary and promote the replica. B is correct because RDS cross-region read replicas do not support automatic failover; you must use custom automation (e.g., AWS Lambda, Amazon Route 53 health checks, or a custom script) to detect primary region failure and promote the read replica to a standalone instance. This promotion breaks the replication link and makes the replica a writable primary, enabling failover.

Answer

Create a second read replica in the secondary region

Answer

Configure automatic backup retention on the replica

Answer

Enable Multi-AZ on the read replica

Question 2

A company uses AWS CodePipeline with a source stage from Amazon S3 and a deploy stage to AWS Elastic Beanstalk. The pipeline has been working for months, but recently the deploy stage started failing with the error 'The S3 object does not exist.' The source artifact is uploaded to the S3 bucket by an external system. Which TWO actions should be taken to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the external system does not overwrite the object after the pipeline execution starts.. The deploy stage fails with 'The S3 object does not exist' when the external system overwrites the source artifact after the pipeline execution starts. CodePipeline references the object by its key at the time the pipeline is triggered; if the object is replaced (i.e., deleted and re-uploaded with the same key), the pipeline may attempt to download a version that no longer exists, especially if the S3 bucket is not versioned. Ensuring the external system does not overwrite the object during execution prevents this race condition.

Answer

Change the source stage to use AWS CodeCommit instead of S3.

Answer

Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Answer

Increase the timeout for the deploy stage in the pipeline.

Question 3

A company runs a stateful application on EC2 instances with instance store volumes. The application requires low-latency access to data. The operations team needs to ensure that instance failure does not result in data loss. Which solution is MOST resilient?

Accepted Answer

Replicate data in real time to an EBS volume and take periodic snapshots.. It combines the low-latency performance of instance store volumes with the durability of EBS snapshots. By replicating data in real time to an EBS volume, the application benefits from the instance store's speed while the EBS volume provides a persistent copy that survives instance failure. Periodic snapshots of the EBS volume add further resilience by enabling point-in-time recovery, ensuring data is not lost even if the instance or its instance store fails.

Answer

Use instance store volumes with RAID 1 across multiple instances.

Answer

Use larger instance types with more instance store capacity.

Answer

Create an AMI of the instance periodically to capture the data.

Question 4

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent 503 errors. The engineer suspects the ALB is returning these errors because the target instances are unhealthy. Which metric should the engineer monitor to confirm this suspicion?

Accepted Answer

HealthyHostCount. The ALB publishes 'HealthyHostCount' metric showing the number of healthy targets. When this count drops to zero, the ALB cannot forward requests and returns 503 errors. Option A (RequestCount) is incorrect because it measures total requests, not health. Option B (UnhealthyHostCount) is a valid metric but does not directly confirm the suspicion that targets are unhealthy; a decreasing HealthyHostCount is more direct. Option D (TargetResponseTime) measures latency, not health status.

Answer

RequestCount

Answer

UnhealthyHostCount

Answer

TargetResponseTime

Question 5

A company runs a containerized application on Amazon ECS with Fargate. The application needs to store session state. Which service provides the MOST resilient and scalable solution?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis provides a highly available, scalable, and low-latency in-memory data store ideal for session state management in a containerized environment. It supports replication and automatic failover, ensuring resilience. Option B (Amazon EFS) is a file storage service with higher latency and not designed for sub-millisecond session retrieval. Option C (ephemeral storage on the container instance) is not durable; data is lost when the container stops or fails. Option D (Amazon S3) is object storage with higher latency and not optimized for frequent read/write operations required for session state.

Answer

Amazon EFS

Answer

Ephemeral storage on the container instance

Answer

Amazon S3

Question 6

A DevOps team wants to monitor the disk space utilization on their EC2 instances. What is the simplest way to achieve this?

Accepted Answer

Install the CloudWatch agent on the EC2 instances and configure the disk metric.. The CloudWatch agent can collect disk space metrics from EC2 instances, which is not available with default CloudWatch metrics. Option A is incorrect because AWS Systems Manager Inventory is used for software inventory and configuration, not real-time disk space monitoring. Option C is incorrect because EC2 detailed monitoring only provides more frequent metrics for standard EC2 metrics (CPU, network, etc.), not disk metrics. Option D is incorrect because EC2 basic monitoring also does not include disk metrics.

Answer

Use AWS Systems Manager Inventory to collect disk space data.

Answer

Enable EC2 detailed monitoring in CloudWatch.

Answer

Use EC2 basic monitoring in CloudWatch.

Question 7

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using customer-managed KMS keys. Additionally, any attempt to upload an unencrypted object must be denied. Which S3 bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: aws:kms. The condition 's3:x-amz-server-side-encryption':'aws:kms' in a Deny statement ensures that only requests with SSE-KMS encryption are allowed, blocking unencrypted uploads or uploads with other encryption types. Option A is wrong because 'true' is not a valid encryption type; the correct value is 'aws:kms'. Option B is wrong because it allows SSE-S3 (AES256), not KMS encryption. Option C is wrong because it checks a KMS encryption context rather than the encryption header, and it does not deny unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes s3:x-amz-server-side-encryption: true

Answer

Allow s3:PutObject with condition s3:x-amz-server-side-encryption: AES256

Answer

Allow s3:PutObject with condition kms:EncryptionContext: department:finance

Question 8

A company uses AWS CodePipeline with multiple stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The build stage runs a series of tests, and if they pass, the pipeline proceeds to deploy. Recently, a developer committed a change that passed all tests but caused a production outage. The team wants to add an approval step before the deploy stage, but they also want to ensure that only changes from specific branches can be deployed. What is the MOST secure and maintainable way to enforce this?

Accepted Answer

Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.. It enforces branch-based deployment at the pipeline level, ensuring that only changes from specific branches trigger the production pipeline with the approval step. This approach is secure and maintainable as it leverages AWS CodePipeline's native ability to trigger on branch events, avoiding custom logic or manual verification. By isolating production deployments to a dedicated pipeline, the team reduces the risk of unauthorized or untested code reaching production.

Answer

Use a Lambda function in the pipeline to check the branch name and fail if not allowed.

Answer

Add a manual approval step in the pipeline and rely on the approver to verify the branch.

Answer

Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.

Question 9

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts. They notice that a stack instance in one account is in a 'FAILED' status because of a permissions issue. After fixing the permissions, what is the most efficient way to retry the stack instance operation?

Accepted Answer

Use the 'Update stack instances' operation for the failed target account.. StackSets allow you to update stack instances individually; you can retry the specific failed instance without affecting others. Option A is wrong because updating the entire stack set would affect all accounts, which is inefficient. Option C is wrong because deleting and recreating the stack instance is disruptive. Option D is wrong because manual stack creation outside StackSets defeats the purpose.

Answer

Manually create the stack in the failed account using the same template.

Answer

Update the entire stack set to retry all stack instances.

Answer

Delete the stack instance from the stack set and add it again.

Question 10

Which THREE actions should a DevOps team take to ensure a CI/CD pipeline using AWS CodePipeline is secure? (Choose three.)

Accepted Answer

Use AWS KMS to encrypt artifacts in the pipeline.. AWS CodePipeline can use AWS KMS customer-managed keys (CMKs) to encrypt artifacts stored in S3 or other supported stores. This ensures that pipeline artifacts are encrypted at rest and in transit, protecting sensitive data from unauthorized access. By default, CodePipeline uses an AWS-managed key, but using a customer-managed KMS key gives the team full control over encryption, key rotation, and access policies.

Answer

Require multi-factor authentication (MFA) for pipeline executions.

Answer

Enable AWS CloudTrail to log pipeline executions.