DOP-C02 Mock Exam 86 — 25 Questions

Question 1

A company has a multi-account AWS environment using AWS Organizations. They want to centrally manage user access to all accounts using single sign-on (SSO) and enforce multi-factor authentication (MFA). Which service should they use?

Accepted Answer

Use AWS IAM Identity Center (AWS SSO) to manage access and enforce MFA.. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user access and permissions across all AWS accounts in an AWS Organization. It natively supports enforcing multi-factor authentication (MFA) through an identity source (e.g., the built-in identity store or an external IdP) and integrates directly with AWS Organizations to grant single sign-on access without needing to create IAM users in each account.

Answer

Use AWS Secrets Manager to store and rotate IAM user credentials.

Answer

Create IAM users in each account and share the credentials securely.

Answer

Use Amazon Cognito user pools with an identity broker.

Question 2

A company is deploying a web application on Amazon ECS with Fargate. The application consists of a frontend service and a backend service. The DevOps team needs to ensure that the frontend service can communicate with the backend service securely without exposing the backend to the internet. Which THREE steps should the team take? (Choose THREE.)

Accepted Answer

Deploy the backend service in a private subnet with no internet access.. Option A is correct because deploying the backend service in a private subnet with no internet access ensures that the backend is not reachable from the internet, which is a fundamental security requirement. In Amazon ECS with Fargate, tasks in a private subnet use an elastic network interface (ENI) with no public IP address, and outbound traffic can be routed through a NAT gateway if needed, but inbound traffic from the internet is blocked. This isolates the backend from direct external exposure while still allowing communication from the frontend service within the same VPC.

Answer

Deploy the backend service in a public subnet with an internet-facing Application Load Balancer.

Answer

Use an internet-facing Network Load Balancer for the backend service.

Question 3

A company is using AWS CloudFormation to deploy infrastructure. They need to ensure that all resources created by CloudFormation are tagged with a 'CostCenter' tag. The tag must be applied automatically to all resources in the stack. What should they do?

Accepted Answer

Specify the tag in the CloudFormation stack's Tags parameter, which applies the tag to all resources in the stack.. Option C is correct because CloudFormation allows you to specify stack-level tags in the Tags parameter when creating or updating a stack. These tags are automatically propagated to all resources that support tagging within the stack, ensuring consistent cost allocation without additional custom logic or post-creation remediation.

Answer

Use AWS Service Catalog to enforce tagging on all products.

Answer

Create an AWS Config rule to detect untagged resources and trigger auto-remediation.

Answer

Use a custom Lambda function as a CloudFormation hook to tag resources after creation.

Question 4

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is expected to have unpredictable traffic patterns. The DevOps team needs to ensure that the application can handle sudden spikes in traffic without throttling. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. Option A is correct because DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes without requiring capacity planning or throttling. This mode charges per request and can accommodate sudden bursts of traffic up to the table's previous peak, making it ideal for serverless applications with variable workloads.

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.

Answer

Increase the Lambda function timeout to the maximum (15 minutes).

Answer

Set API Gateway throttling limits to a high value to prevent throttling.

Question 5

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM user or role in any account can create or modify VPCs. Which SCP should be applied to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}. Option C is correct because it denies both the ec2:CreateVpc and ec2:ModifyVpc actions, which covers all operations that could create or modify VPCs. A service control policy (SCP) with a Deny effect overrides any Allow permissions, ensuring that no IAM user or role in any account under the root OU can perform these actions, even if attached IAM policies grant them.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifyVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}

Question 6

A company wants to monitor and detect anomalous API calls in their AWS account. Which THREE AWS services should they use together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API calls made in the AWS account, providing the raw data needed to detect anomalous activity. By enabling CloudTrail on all regions and logging to a centralized S3 bucket, you capture the identity, source IP, and request parameters for every API call, which is essential for anomaly detection.

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A DevOps engineer ran the above command and saw this output. What is the MOST likely cause of the stack creation failure?

Accepted Answer

The launch template name specified in the CloudFormation template is incorrect or does not exist.. The error message indicates that the launch template name specified in the CloudFormation template does not match any existing launch template in the account and Region. CloudFormation resolves the launch template name at stack creation time; if the name is incorrect or the template does not exist, the Auto Scaling group creation fails with a validation error. This is the most direct cause because the launch template name is a required parameter that must reference a pre-existing resource.

Answer

The key pair specified in the launch template does not exist.

Answer

The IAM role does not have permission to create the Auto Scaling group.

Answer

The AMI ID specified in the launch template is not available in this Region.

Question 8

A company runs a stateless web application on Amazon ECS with Fargate launch type. The application experiences intermittent traffic spikes. The company wants to ensure that the application can scale automatically and remain resilient to underlying infrastructure failures. Which combination of actions should the DevOps engineer take?

Accepted Answer

Configure an Application Auto Scaling target tracking policy based on memory utilization and enable Amazon ECS service auto-recovery.. Option D is correct because it combines Application Auto Scaling target tracking based on memory utilization, which is a relevant metric for a stateless web application to handle traffic spikes, with Amazon ECS service auto-recovery, which automatically replaces unhealthy tasks to ensure resilience against underlying infrastructure failures. This approach provides both automatic scaling and fault tolerance without manual intervention.

Answer

Configure a scheduled scaling policy for the Amazon ECS service to add tasks during known peak hours.

Answer

Launch tasks in a single Availability Zone and use an Application Auto Scaling target tracking policy based on CPU utilization.

Answer

Configure a step scaling policy for the Amazon ECS service and increase the task memory size.

Question 9

A security engineer is designing a secure VPC architecture for a web application. The application must be isolated from the internet and only accessible through a load balancer. Which TWO actions should the engineer take?

Accepted Answer

Place the EC2 instances in a private subnet with no internet gateway attachment.. Option A is correct because placing EC2 instances in a private subnet without an internet gateway ensures they have no direct path to the internet, meeting the isolation requirement. This forces all traffic to and from the instances to go through the load balancer, which is the only entry point for the application.

Answer

Attach an Internet Gateway to the VPC and route the private subnet to it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic on all ephemeral ports.

Answer

Set up an AWS Direct Connect connection for the instances to access the internet.

Question 10

A company requires that all access to their S3 buckets be encrypted in transit. Which configuration achieves this?

Accepted Answer

Use a bucket policy that denies requests when aws:SecureTransport is false.. Option C is correct because using a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` explicitly enforces encryption in transit for all access to the S3 bucket. This policy ensures that any HTTP (non-TLS) request is denied, while HTTPS requests are allowed, meeting the requirement that all access be encrypted in transit.

Answer

Use CloudFront with the bucket as origin and enforce HTTPS only between viewer and CloudFront.

Answer

Enable default encryption on the bucket.

Answer

Set the bucket policy to require SSE-KMS.

Question 11

A DevOps engineer applies this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All objects uploaded must use server-side encryption with Amazon S3 managed keys (SSE-S3).. The S3 bucket policy in question denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which is the value for SSE-S3 (Amazon S3 managed keys). This ensures that all objects uploaded to the bucket must be encrypted using server-side encryption with S3-managed keys (SSE-S3). Option C correctly identifies this requirement.

Answer

All objects uploaded must be encrypted with SSE-C.

Answer

All uploads to the bucket are blocked.

Answer

All objects uploaded must be encrypted with SSE-KMS.

Question 12

A company uses Amazon DynamoDB as the database for a mobile application. The application requires single-digit millisecond read and write latency and must be resilient to the failure of an entire AWS Region. Which DynamoDB feature should the company use?

Accepted Answer

DynamoDB global tables. DynamoDB global tables provide multi-Region, multi-active replication, ensuring the application can withstand an entire AWS Region failure while maintaining single-digit millisecond read and write latency in each Region. This is achieved through DynamoDB Streams and a last-writer-wins conflict resolution mechanism, making it the correct choice for cross-Region resilience.

Answer

DynamoDB point-in-time recovery (PITR)

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB on-demand capacity mode

Question 13

A company runs a critical application on Amazon ECS with Fargate. The application emits structured logs in JSON format. The DevOps team wants to monitor for specific error codes and receive near-real-time alerts. The team also needs to retain logs for 5 years for compliance. Which TWO steps should the team implement?

Accepted Answer

Create a CloudWatch Logs metric filter to count occurrences of specific error codes and create an alarm. Option A is correct because CloudWatch Logs metric filters can parse JSON-structured logs to count occurrences of specific error codes, and you can create a CloudWatch alarm on that metric to trigger near-real-time notifications via SNS. This is a native, low-latency solution for monitoring specific patterns in ECS Fargate logs without additional infrastructure.

Answer

Use Amazon Kinesis Data Analytics to analyze logs in real-time and send alerts

Answer

Enable AWS CloudTrail to log the application's API calls

Answer

Stream logs to Amazon S3 via Amazon Kinesis Data Firehose and use S3 event notifications to trigger alerts

Question 14

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can make changes to Amazon CloudWatch Logs configurations. Which approach should be used?

Accepted Answer

Create an SCP that denies cloudwatch:Put* and cloudwatch:Delete* actions and attach it to the root OU. Option B is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By attaching an SCP that denies cloudwatch:Put* and cloudwatch:Delete* actions to the root OU, you ensure that no IAM user or role in any account can modify or delete CloudWatch Logs configurations, regardless of any IAM policies attached directly to users or roles. This approach provides a guardrail that cannot be overridden by account administrators.

Answer

Use AWS Config rules to automatically revert changes to CloudWatch Logs

Answer

Create an IAM policy that denies changes to CloudWatch Logs and apply it to all IAM users

Answer

Use AWS CloudTrail to monitor and alert on changes to CloudWatch Logs

Question 15

A DevOps team receives a CloudWatch alarm that an RDS DB instance's CPU utilization has exceeded 90% for 5 minutes. The application is experiencing latency. What is the best immediate step to mitigate the issue?

Accepted Answer

Modify the RDS instance to a larger instance class.. Option C is correct because when an RDS instance's CPU utilization exceeds 90% for 5 minutes and the application is experiencing latency, the immediate step is to scale up the instance to a larger class to provide more CPU capacity. This directly addresses the resource bottleneck without requiring time-consuming analysis or architectural changes, making it the fastest mitigation for an ongoing incident.

Answer

Analyze slow query logs and optimize queries.

Answer

Enable Multi-AZ deployment for failover.

Answer

Add a read replica to offload read traffic.

Question 16

A company runs a critical microservice on Amazon ECS with AWS Fargate. The service must be highly available across multiple Availability Zones. The DevOps engineer configured the service with a desired count of 4 tasks spread across 2 Availability Zones. During a deployment, a new task fails to start due to a missing environment variable. The deployment fails, but the old tasks continue to run. What is the most likely cause of the deployment failure and how can the engineer ensure future deployments are resilient?

Accepted Answer

The deployment failed because the ECS service did not have the deployment circuit breaker enabled. Enable the circuit breaker with rollback.. The deployment failed because the new task could not start due to a missing environment variable, and the ECS service did not have the deployment circuit breaker enabled. Without the circuit breaker, ECS continues to attempt the deployment indefinitely or until a timeout, but it does not automatically roll back to the previous stable task set. Enabling the deployment circuit breaker with rollback ensures that if a specified number of tasks fail to start (e.g., due to health checks or runtime errors), ECS automatically rolls back to the last successful deployment, maintaining service availability.

Answer

The deployment failed because the ECS service was using the rolling update deployment controller. Change to blue/green deployment.

Answer

The deployment failed because the desired count was too low. Increase the desired count to 6.

Answer

The deployment failed because the health check grace period was too short. Increase the grace period.

Question 17

A DevOps engineer is troubleshooting a Lambda function that times out after 3 seconds. The function makes an HTTP request to an external API. The function's timeout setting is 10 seconds. What is the most likely cause of the timeout?

Accepted Answer

The HTTP client's timeout is set to a low value.. The Lambda function times out after exactly 3 seconds, which is a common default HTTP client timeout (e.g., 3 seconds in the Node.js `http` module or Python `requests` library). Even though the Lambda function's configured timeout is 10 seconds, the HTTP client's internal timeout fires first, causing the function to fail before the Lambda timeout is reached. This is the most likely cause because the symptom matches a client-side timeout rather than a server-side or infrastructure issue.

Answer

The external API is throttling the request.

Answer

The Lambda function is not in a VPC.

Answer

The Lambda function's memory is insufficient.

Question 18

Which TWO AWS services can be used to monitor and detect unauthorized access to AWS resources? (Choose two.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing VPC Flow Logs, DNS logs, and AWS CloudTrail management and data events. It uses machine learning and integrated threat intelligence to detect anomalies such as unusual API calls, crypto-mining activity, or compromised credentials, making it a correct choice for detecting unauthorized access.

Answer

AWS Shield

Answer

Amazon Inspector

Answer

AWS Config

Question 19

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an S3 bucket. The Security team requires that the application never uses long-term credentials and that access is scoped to the specific ECS task. Which approach should be used?

Accepted Answer

Create an IAM role for the ECS task and reference it in the task definition. Option D is correct because ECS tasks using the Fargate launch type can assume an IAM role that is specified in the task definition. This IAM role provides temporary credentials via the ECS task metadata endpoint, ensuring that the application never uses long-term credentials and that permissions are scoped precisely to that task. The Security team's requirements are fully met by this approach.

Answer

Embed the IAM user credentials in the container image

Answer

Store AWS access keys in AWS Secrets Manager and retrieve them at runtime

Answer

Use an IAM role for the EC2 instance if using EC2 launch type

Question 20

A company wants to monitor and detect suspicious API activity across all AWS accounts in an organization. Which TWO services should be used together?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can centrally aggregate and store API activity logs from all AWS accounts in an organization. When combined with AWS CloudTrail, which records API calls, CloudWatch Logs enables real-time monitoring and alerting on suspicious API patterns using metric filters and alarms.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty