DOP-C02 Mock Exam 85 — 25 Questions

Question 1

A company uses AWS CloudFormation to deploy a multi-tier application. The network team manages the VPC and subnets using a separate CloudFormation stack. The application team needs to reference the VPC ID and subnet IDs from the network stack. Which approach should the application team use to obtain these values?

Accepted Answer

Export the VPC ID and subnet IDs from the network stack using the 'Export' field and import them in the application stack using Fn::ImportValue.. Option B is correct because CloudFormation's Export and Fn::ImportValue mechanism allows cross-stack references without hardcoding or duplicating values. The network stack exports the VPC ID and subnet IDs using the Export field, and the application stack imports them via Fn::ImportValue, ensuring that changes in the network stack propagate automatically to dependent stacks.

Answer

Hardcode the VPC and subnet IDs in the application template.

Answer

Create the network stack as a nested stack inside the application stack.

Answer

Store the VPC and subnet IDs in AWS Systems Manager Parameter Store and retrieve them using dynamic references.

Question 2

A company uses AWS CodeBuild to build and test their application. They want to integrate Infrastructure as Code (IaC) scanning into their build pipeline to detect security misconfigurations in CloudFormation templates before deployment. Which TWO tools or services can be used for this purpose? (Choose TWO.)

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to enforce compliance and security best practices on CloudFormation templates. It can be integrated into a CodeBuild pipeline to scan templates for misconfigurations before deployment, making it a correct choice for IaC security scanning.

Answer

AWS Security Hub

Answer

AWS Config

Answer

HashiCorp Terraform

Question 3

An organization has a compliance requirement to automatically detect and alert on any IAM user creation in all AWS accounts. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail captures all IAM user creation events as `CreateUser` API calls. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a rule that matches this specific event pattern and triggers an alert via Amazon SNS. This combination provides real-time detection and notification without custom code.

Answer

Amazon GuardDuty and Amazon SNS

Answer

Amazon S3 server access logs and Amazon Athena

Answer

AWS Config and AWS Lambda

Question 4

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must be resilient to regional outages. Which THREE steps should the company take to achieve multi-Region resilience? (Choose THREE.)

Accepted Answer

Configure Route 53 with a failover routing policy to direct traffic to the secondary Region if the primary fails.. Option B is correct because Amazon Route 53 with a failover routing policy allows the company to route traffic to a secondary Region when health checks detect a failure in the primary Region. This provides DNS-level failover, which is a fundamental component of multi-Region resilience for HTTP-based applications.

Answer

Use Amazon CloudFront with multiple origins pointing to each Region's API Gateway.

Answer

Deploy Lambda@Edge functions to handle requests at edge locations.

Question 5

A company uses AWS CodeCommit to store source code. The development team wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created or updated. Which TWO resources must be configured to accomplish this? (Select TWO.)

Accepted Answer

An Amazon CloudWatch Events rule that listens for CodeCommit pull request events.. Option C is correct because Amazon CloudWatch Events (now Amazon EventBridge) can capture CodeCommit pull request state changes (e.g., created, updated) and route them to targets like AWS CodeBuild. This allows you to automatically trigger a build when a pull request event occurs, without needing a separate polling mechanism.

Answer

An AWS Lambda function to process the pull request event.

Answer

An AWS CodePipeline pipeline with a source stage for CodeCommit.

Answer

An Amazon Simple Notification Service (SNS) topic to send notifications.

Question 6

A company is designing a disaster recovery plan for a MySQL database running on Amazon RDS. The database is critical and must have an RPO of 5 minutes and an RTO of 1 hour. The primary Region is us-east-1, and the DR Region is us-west-2. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Create a cross-Region read replica in us-west-2.. A cross-Region read replica in us-west-2 provides a near-real-time copy of the primary database, with replication lag typically measured in seconds, easily meeting the 5-minute RPO. During a disaster, promoting this read replica to a standalone instance in us-west-2 can be completed in minutes, satisfying the 1-hour RTO. This approach avoids the recovery time needed to restore from a snapshot or backup.

Answer

Enable automated backups with a 5-minute backup window.

Answer

Configure cross-Region automated snapshot copy to us-west-2.

Answer

Enable Multi-AZ deployment in us-east-1.

Question 7

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. What is the most likely cause?

Accepted Answer

The Lambda function is not configured to access the VPC where the RDS instance resides.. The most likely cause of the timeout error is that the Lambda function is not configured to access the VPC where the RDS instance resides. When Secrets Manager rotates a secret for an RDS database, the rotation Lambda function must connect to the database to update the credentials. If the Lambda function is not attached to the same VPC (or a VPC with proper routing and security group rules), it cannot reach the RDS instance, causing network connection attempts to hang until the function times out.

Answer

The Lambda function's execution role lacks the required IAM permissions.

Answer

The secret rotation schedule is set to less than 24 hours.

Answer

The Lambda function does not have permission to access the S3 bucket.

Question 8

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the destination account is 222222222222. Which policy should be attached to the S3 bucket?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. Option C is correct because it uses a bucket policy to grant cross-account access to the S3 bucket. The policy specifies the destination account (222222222222) as the principal, allowing s3:GetObject on the bucket's objects. This is the standard AWS approach for cross-account S3 access, as bucket policies can grant permissions to principals in other AWS accounts.

Answer

Attach an IAM policy to the user in account 111111111111 allowing s3:GetObject.

Answer

Set the bucket ACL to grant full control to account 222222222222.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 9

A company uses AWS CloudFormation to deploy a microservices architecture. The Operations team needs to update a stack that contains a Lambda function and an API Gateway REST API. They want to ensure that the Lambda function code is updated without downtime. Which update policy should be used for the Lambda function in the CloudFormation template?

Accepted Answer

Use an UpdateReplacePolicy of 'Replace'. The correct answer is B because the `UpdateReplacePolicy` attribute in CloudFormation is used to specify the behavior when a resource must be replaced during a stack update. Setting it to `Replace` ensures that the Lambda function is recreated with the new code, and because CloudFormation creates the new function before deleting the old one (for Lambda), there is no downtime. This policy directly addresses the requirement for a zero-downtime code update.

Answer

Use an UpdateReplacePolicy of 'Snapshot'

Answer

Use an UpdateReplacePolicy of 'Retain'

Answer

Use an UpdateReplacePolicy of 'Rollback'

Question 10

A DevOps engineer is designing a CI/CD pipeline for an application that runs on Amazon ECS. The pipeline should automatically build a Docker image from source code, push it to Amazon ECR, and deploy it to the ECS service. The engineer wants to use AWS CodePipeline with Amazon ECR as a source. Which action provider should be used for the deploy stage?

Accepted Answer

Amazon ECS. Amazon ECS is the correct action provider for the deploy stage when using AWS CodePipeline because it directly integrates with ECS to update an existing ECS service with a new task definition. When Amazon ECR is configured as a source, CodePipeline detects image pushes, and the ECS deploy action automatically triggers a rolling update of the ECS service using the new image, without requiring additional deployment tools.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 11

An organization uses AWS OpsWorks for configuration management. They have a stack with multiple layers, including a PHP application layer and a MySQL database layer. The operations team needs to deploy a custom configuration file to all PHP application instances. How should this be accomplished using OpsWorks?

Accepted Answer

Create a custom cookbook with a recipe that deploys the configuration file, and assign it to the Deploy lifecycle event of the PHP layer.. Option C is correct because OpsWorks uses Chef cookbooks to manage configuration. By creating a custom cookbook with a recipe that deploys the configuration file and assigning it to the Deploy lifecycle event of the PHP layer, the recipe runs on all PHP application instances during deployment, ensuring the file is placed correctly. This approach leverages OpsWorks' built-in lifecycle events and Chef's idempotent execution model.

Answer

Use the OpsWorks agent to directly copy the file to each instance via SSH.

Answer

Add the configuration file as a stack-level custom cookbook and assign it to all layers.

Answer

Use a custom JSON attribute in the stack settings to define the file content, and then use a built-in recipe to apply it.

Question 12

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance and an EC2 instance that connects to it. The DB instance has a deletion policy of 'Retain'. The stack fails to delete because the DB instance is retained and still exists. Which TWO actions would allow the stack to be deleted successfully? (Select TWO.)

Accepted Answer

Manually delete the DB instance using the RDS console.. Option B is correct because manually deleting the retained DB instance removes the resource that is blocking the stack deletion. CloudFormation cannot delete a stack that contains a resource with a 'Retain' deletion policy until that resource is manually removed, as the stack expects the resource to no longer exist for the deletion to complete.

Answer

Use the AWS CLI to force delete the stack with the --force option.

Answer

Disable termination protection on the EC2 instance.

Answer

Modify the DB instance to allow deletion by setting DeletionProtection to false.

Question 13

A company's security team suspects that an attacker has compromised an IAM user's access keys. The keys were used to launch instances in an unauthorized region. What is the FASTEST way to mitigate the threat?

Accepted Answer

Rotate the access keys immediately.. Rotating the access keys immediately invalidates the compromised keys, preventing further unauthorized use without disrupting the IAM user's other permissions or requiring a full user recreation. This is the fastest mitigation because it directly revokes the attacker's access while allowing the legitimate user to continue using new keys after rotation.

Answer

Delete the IAM user.

Answer

Change the IAM user's password.

Answer

Attach an AWS WAF to block the attacker's IP address.

Question 14

A company uses AWS Lambda functions to process events from an Amazon SQS queue. The Lambda function occasionally fails due to a transient downstream service error. The DevOps team wants to ensure that failed messages are not lost and can be retried later. The team also wants to reduce the number of invocations on the downstream service. Which configuration should the team use?

Accepted Answer

Configure a dead-letter queue (DLQ) on the SQS queue and set the Lambda function's reserved concurrency to 1.. Option A is correct because configuring a dead-letter queue (DLQ) on the SQS queue ensures that messages that exhaust their retries (due to Lambda failures) are preserved for later reprocessing, preventing data loss. Setting the Lambda function's reserved concurrency to 1 throttles the function to a single concurrent invocation, which naturally reduces the rate of downstream service calls and allows the SQS queue's visibility timeout and redrive policy to manage retry timing, thereby reducing pressure on the downstream service.

Answer

Configure an Amazon SNS topic as a Lambda destination for failure events and subscribe the SQS queue to it.

Answer

Configure a dead-letter queue (DLQ) on the Lambda function and set the function's maximum retry attempts to 2.

Answer

Configure the Lambda function to write failed messages to an Amazon DynamoDB table and set up a scheduled Lambda to retry.

Question 15

A company runs a microservices application on Amazon EKS. The application's frontend service needs to communicate with the backend service. The DevOps team wants to implement service-to-service authentication using AWS IAM. Which method should the team use?

Accepted Answer

Use IAM roles for service accounts (IRSA) to associate an IAM role with each service's Kubernetes service account.. IAM roles for service accounts (IRSA) allows each Kubernetes service account to assume an IAM role with fine-grained permissions, enabling secure service-to-service authentication without managing long-lived credentials. The frontend service can use its associated IAM role to sign AWS API requests (e.g., STS AssumeRole) to authenticate to the backend service, which validates the role via IAM policies. This approach integrates natively with EKS and follows AWS best practices for workload identity.

Answer

Configure the backend service as an Amazon RDS database with IAM database authentication.

Answer

Use AWS App Mesh with mTLS for authentication between services.

Answer

Create an IAM user with access keys and store them as Kubernetes secrets.

Question 16

A company has an Amazon S3 bucket that stores critical data. The company wants to protect the data from accidental deletion and ensure that even the root user cannot delete the bucket. Which S3 feature should the company enable?

Accepted Answer

S3 Object Lock with compliance retention mode.. Option C is correct because S3 Object Lock with compliance retention mode prevents any user, including the root user, from deleting or overwriting objects until the retention period expires. Compliance mode applies a strict, immutable lock that cannot be removed or shortened by any user, including the AWS account root user, ensuring the data is protected against accidental or malicious deletion.

Answer

S3 bucket policy that denies s3:DeleteBucket for all principals.

Answer

S3 bucket versioning with MFA delete.

Answer

S3 bucket versioning with lifecycle policy to expire noncurrent versions.

Question 17

A company runs a web application on EC2 behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting (XSS) attacks. Which AWS service should they use?

Accepted Answer

Deploy AWS WAF in front of the ALB and create rules to block SQL injection and XSS.. AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS requests for common attack patterns. It provides managed rule sets specifically designed to block SQL injection and cross-site scripting (XSS) attacks at the application layer, which is exactly what this scenario requires.

Answer

Configure security groups to allow only HTTP/HTTPS traffic.

Answer

Configure network ACLs to block common attack patterns based on IP ranges.

Answer

Enable AWS Shield Advanced to protect the ALB.

Question 18

A DevOps team is designing a disaster recovery solution for an Amazon RDS for MySQL database. The primary database is in us-east-1, and the recovery point objective (RPO) is 5 minutes, recovery time objective (RTO) is 1 hour. Which solution meets these requirements?

Accepted Answer

Create a cross-Region read replica in the secondary Region.. A cross-Region read replica in the secondary Region meets the RPO of 5 minutes because replication from the primary RDS instance to the read replica is asynchronous but typically completes within seconds to a few minutes, well under the 5-minute threshold. In a disaster, promoting the read replica to a standalone instance can be done manually or automated, and the RTO of 1 hour is achievable because promotion takes only a few minutes, leaving ample time for DNS and application failover. This solution provides a continuous replication stream without manual intervention, unlike snapshot-based approaches.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Take manual snapshots and copy them to the secondary Region daily.

Answer

Configure automated backups with a retention period of 35 days.

Question 19

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during business hours and low traffic at night. The company wants to configure automatic scaling based on CPU utilization. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Set the minimum and maximum number of instances for the auto scaling group.. Option B is correct because Elastic Beanstalk uses Auto Scaling groups to manage the EC2 instances for the application. Setting the minimum and maximum number of instances defines the boundaries within which the Auto Scaling group can scale, ensuring the application can handle high traffic during business hours and scale down during low traffic at night.

Answer

Create a CloudWatch alarm that triggers a scaling policy.

Answer

Configure the load balancer health check interval.

Question 20

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that failed. Which TWO resources should the engineer examine to identify the cause of the failure? (Choose two.)

Accepted Answer

CloudWatch Logs for CodeDeploy. Option B is correct because AWS CodeDeploy emits detailed logs about deployment lifecycle events (e.g., BeforeInstall, ApplicationStop) to CloudWatch Logs. These logs contain error messages, script output, and status codes that directly indicate why a deployment step failed, such as a permission issue or a script syntax error. Examining CloudWatch Logs for CodeDeploy is the primary method to diagnose deployment failures.

Answer

EC2 instance system logs

Answer

S3 access logs

Answer

CloudTrail logs