DOP-C02 Practice Test 8 — 10 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team needs to automatically isolate a compromised EC2 instance by removing it from its security group and attaching a quarantine security group that only allows traffic to a forensic instance. Which combination of actions should be implemented?

Accepted Answer

Use AWS Config rules with AWS Systems Manager Automation documents to automatically remove the instance from the security group and attach the quarantine group when non-compliant.. Option D is correct because AWS Config rules can evaluate security group membership compliance, and when a non-compliant EC2 instance is detected, an AWS Systems Manager Automation document can be triggered via a remediation action. This automation document can execute the steps to remove the instance from its current security group and attach a quarantine security group, providing a fully automated, event-driven isolation workflow without requiring custom code for orchestration.

Answer

Use Amazon GuardDuty to automatically modify the security group membership of the instance.

Answer

Use AWS Shield Advanced to automatically apply the quarantine security group to the instance.

Answer

Use AWS Lambda functions triggered by Amazon EventBridge to remove the instance from the security group and attach the quarantine group.

Question 2

A DevOps engineer is investigating why an Amazon ECS service is not scaling out as expected. The service has a target tracking scaling policy based on average CPU utilization. The CloudWatch alarm shows that CPU utilization has exceeded the target for several minutes, but no scaling activity has occurred. What is the most likely cause?

Accepted Answer

The scaling policy has a cooldown period that is still in effect from a previous scaling activity.. Option D is correct because target tracking scaling policies in Amazon ECS have a cooldown period (default 300 seconds) that prevents the policy from initiating additional scaling activities immediately after a previous scaling action. If a recent scaling activity occurred, the cooldown period would still be in effect, causing the policy to ignore the alarm even though CPU utilization has exceeded the target. This is the most likely reason no scaling activity is observed despite the alarm being triggered.

Answer

The ECS service is configured with a minimum healthy percent that prevents scaling out.

Answer

The ECS service does not have an IAM role that allows it to call CloudWatch.

Answer

The CloudWatch alarm is configured with a period that is too long.

Question 3

A company has a legacy application running on an EC2 instance that is not part of an Auto Scaling group. The instance is experiencing a memory leak. The DevOps engineer needs to collect memory metrics to analyze the issue without modifying the application. What should the engineer do?

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect memory metrics.. The CloudWatch agent is required to collect custom metrics like memory utilization from an EC2 instance because the standard EC2 monitoring only captures hypervisor-level metrics (CPU, network, disk I/O). By installing and configuring the CloudWatch agent, the engineer can collect memory metrics without modifying the application code, directly addressing the memory leak analysis requirement.

Answer

Use the AWS Management Console to view memory metrics from the EC2 monitoring tab.

Answer

Use EC2Rescue to generate a memory dump and analyze it.

Answer

Enable CloudWatch detailed monitoring on the instance.

Question 4

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover due to an availability zone outage. After the failover, the application team reports that the database endpoint is not resolving to the new primary. What is the most likely reason?

Accepted Answer

The application is using a cached DNS resolution that points to the old primary.. Option D is correct because after an RDS Multi-AZ failover, the DNS CNAME record for the DB instance is updated to point to the new primary in the standby AZ. However, if the application or its DNS resolver has cached the previous DNS resolution, it will continue to use the old IP address, which is no longer reachable. This is a common issue that can be resolved by reducing the TTL on the DNS record or implementing retry logic with DNS re-resolution in the application.

Answer

The RDS CNAME record was not updated by AWS after the failover.

Answer

The application is using the read replica endpoint instead of the primary endpoint.

Answer

The application is using a Route 53 health check that failed and redirected traffic away from the endpoint.

Question 5

A company runs a critical application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) in front. During a load test, the team notices a sudden increase in 5xx errors from the ALB, and some tasks become unhealthy. The task logs show occasional 'OutOfMemoryError' exceptions. The task definition currently has 512 CPU units and 1024 MiB memory. What should the team do to mitigate the issue while maintaining a cost-effective approach?

Accepted Answer

Increase the task definition memory to 2048 MiB while keeping CPU at 512 units.. Option B is correct because the application is experiencing OutOfMemoryError, indicating the current 1024 MiB memory allocation is insufficient. Increasing memory to 2048 MiB while keeping CPU at 512 units directly resolves the memory constraint without unnecessary CPU cost. ECS Fargate allows independent scaling of CPU and memory within valid combinations, and this change maintains a cost-effective approach by only increasing the resource that is actually constrained.

Answer

Increase the task definition CPU to 1024 units and memory to 2048 MiB.

Answer

Configure the ECS service to use a rolling update with a longer health check grace period.

Answer

Decrease the task definition memory to 512 MiB to force garbage collection more frequently.

Question 6

An organization uses AWS Elastic Beanstalk for application deployments. They want to implement immutable updates to minimize downtime and ensure that if the new environment fails health checks, the old environment remains intact. Which deployment policy should they choose?

Accepted Answer

Immutable update.. Immutable updates in AWS Elastic Beanstalk launch a completely new environment with the new application version. If the new environment fails health checks, Elastic Beanstalk automatically terminates it, leaving the original environment untouched. This ensures zero downtime and a safe rollback, which matches the requirement to keep the old environment intact if health checks fail.

Answer

Traffic splitting.

Answer

All at once.

Answer

Rolling update based on health.

Question 7

A company is experiencing a DDoS attack on its application hosted on AWS. The application uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The security team needs to mitigate the attack with minimal latency impact on legitimate users. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Enable AWS Shield Advanced on the ALB.. AWS Shield Advanced provides enhanced DDoS mitigation for ALBs, including access to the DDoS Response Team (DRT) and financial protection against scaling costs. It operates at the network and transport layers with minimal latency, as it inspects traffic inline without introducing significant processing delay. This makes it a critical first line of defense for high-availability applications under attack.

Answer

Disable cross-zone load balancing on the ALB to limit the number of instances receiving traffic.

Answer

Configure the Auto Scaling group to scale based on the NetworkIn metric to handle the increased traffic.

Question 8

A DevOps engineer updates an ECS service via CloudFormation. The stack update fails with the message 'Resource update cancelled'. The engineer notices that the ECS service's desired count was temporarily reduced during the update. What is the most likely cause of the failure?

Accepted Answer

The ECS service's minimum healthy percent was set to 100, causing the desired count reduction to zero to be rejected.. The error 'Resource update cancelled' occurs because CloudFormation detected that the ECS service update was not progressing as expected. When the minimum healthy percent is set to 100, the deployment process cannot reduce the desired count to zero (or below the current running count) without violating the requirement that 100% of the tasks remain healthy. This causes the update to be cancelled as CloudFormation waits indefinitely for the deployment to complete, eventually timing out and rolling back.

Answer

The ECS service's target group had an unhealthy instance that prevented the deregistration.

Answer

The ECS service deployment circuit breaker was triggered due to a timeout.

Answer

The ECS service did not have the required IAM role to call ecs:UpdateService.

Question 9

A company uses AWS CloudTrail to log API activity. The security team wants to be alerted when an IAM user creates a new access key. Which TWO steps should be taken to accomplish this? (Choose TWO.)

Accepted Answer

Configure the CloudWatch Events rule to send a notification to an Amazon SNS topic.. Option B is correct because Amazon CloudWatch Events (now Events) can be configured to match specific API calls logged by CloudTrail, such as CreateAccessKey. When the rule triggers, it can invoke an SNS topic to send an alert, enabling real-time notification. This approach directly monitors the API activity without additional overhead.

Answer

Enable CloudTrail Insights to detect unusual activity in the account.

Answer

Create an AWS Config rule that checks for access key creation and sends an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query on the CloudTrail logs and set an alarm.

Question 10

A company uses an Auto Scaling group with a dynamic scaling policy based on a custom CloudWatch metric. After a recent deployment, the metric spikes unexpectedly, causing the Auto Scaling group to launch several EC2 instances. The operations team wants to quickly determine whether the spike was caused by a real load increase or a deployment issue. What is the MOST efficient way to investigate this?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns or deployment markers that coincide with the metric spike.. Option B is correct because CloudWatch Logs Insights allows you to query application logs for error patterns or deployment markers (e.g., new version tags, exception stack traces) that coincide with the metric spike. This directly correlates the scaling event with application-level evidence, enabling rapid root-cause analysis without altering infrastructure or relying on indirect notifications.

Answer

Check the SNS topic that the scaling policy publishes to for notifications.

Answer

Use AWS CloudTrail to review API calls that modified the scaling policy.

Answer

Temporarily disable the scaling policy and manually increase the desired capacity to handle the load.