DOP-C02 Mock Exam 87 — 25 Questions

Question 1

A company is implementing a disaster recovery strategy for its Amazon Aurora MySQL database. The primary database is in us-west-2. The company requires an RPO of less than 1 minute and an RTO of less than 5 minutes. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with a secondary Region cluster.. Amazon Aurora Global Database is designed for low-latency cross-Region replication with a typical RPO of 1 second and RTO of 1 minute or less, meeting the <1 minute RPO and <5 minute RTO requirements. It uses a dedicated storage-level replication channel that keeps the secondary cluster fully synchronized without impacting primary performance, and failover involves promoting the secondary cluster to primary in under a minute.

Answer

Create a cross-Region read replica in the secondary Region and promote it during failover.

Answer

Use automated backups and restore to a new DB instance in the secondary Region.

Answer

Take manual snapshots of the DB instance and copy them to the secondary Region every hour.

Question 2

A company is designing a highly available architecture for a web application that uses Amazon EC2 instances. The application must be resilient to the failure of a single instance and a single Availability Zone. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Use an Auto Scaling group with a minimum of two instances spread across two Availability Zones.. Option A is correct because an Auto Scaling group with a minimum of two instances spread across two Availability Zones ensures that if one instance or one entire AZ fails, the remaining instance(s) in the other AZ can continue serving traffic, and Auto Scaling will automatically launch a replacement instance in the healthy AZ to restore the desired count. Option B is correct because distributing EC2 instances across at least two Availability Zones is the fundamental requirement for AZ-level resilience, as it eliminates a single point of failure at the AZ boundary.

Answer

Place all EC2 instances in a single Availability Zone and use a Network Load Balancer.

Answer

Use a single Application Load Balancer in one Availability Zone.

Answer

Use a single large EC2 instance in one Availability Zone.

Question 3

A company is using AWS CloudFormation to deploy a critical application stack. The company wants to ensure that the stack can be recovered quickly in case of a failure. Which THREE strategies should the company implement? (Choose THREE.)

Accepted Answer

Use StackSets to deploy the stack across multiple Regions.. Option B is correct because AWS CloudFormation StackSets allow you to deploy stacks across multiple AWS Regions and accounts from a single template, enabling multi-Region disaster recovery. By deploying the critical application stack in multiple Regions, you can quickly fail over to a secondary Region if the primary fails, meeting the requirement for rapid recovery.

Answer

Disable rollback on stack creation failure to preserve resources for debugging.

Answer

Define the entire application in a single CloudFormation template.

Question 4

A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)

Accepted Answer

Use CloudWatch Logs Insights to run queries across multiple log groups.. CloudWatch Logs Insights is purpose-built for querying log data across multiple log groups. It uses a query language to search, filter, and aggregate log events, making it ideal for identifying error patterns across different sources. This option is correct because it directly supports cross-log-group queries without additional data movement or infrastructure.

Answer

Install the CloudWatch Logs agent on an EC2 instance and tail the logs.

Answer

Create a Lambda function that reads logs from each log group and searches for the pattern.

Answer

Use Amazon Kinesis Data Analytics to process the log streams.

Question 5

A DevOps engineer is setting up an alarm to notify the team when the average CPU utilization of an EC2 instance exceeds 80% for 5 consecutive minutes. Which CloudWatch alarm configuration should be used?

Accepted Answer

Metric: CPUUtilization, Statistic: Average, Period: 300 seconds, Threshold: 80, Evaluation Periods: 1. Option A is correct because it configures a CloudWatch alarm with a 300-second (5-minute) period and 1 evaluation period, meaning the alarm triggers when the average CPU utilization exceeds 80% for a single 5-minute data point. This directly matches the requirement of 'exceeds 80% for 5 consecutive minutes' since the metric is evaluated over a 5-minute window.

Answer

Metric: CPUUtilization, Statistic: Average, Period: 300 seconds, Threshold: 80, Evaluation Periods: 1, Comparison: LessThanThreshold

Answer

Metric: CPUUtilization, Statistic: Average, Period: 60 seconds, Threshold: 80, Evaluation Periods: 5

Answer

Metric: CPUUtilization, Statistic: Sum, Period: 60 seconds, Threshold: 80, Evaluation Periods: 5

Question 6

A company is designing a disaster recovery plan for an Amazon S3 data lake. The data lake stores sensitive data that must be replicated to a secondary Region with an RPO of 15 minutes. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Enable S3 Versioning on both the source and destination buckets.. Option A is correct because enabling S3 Versioning on both the source and destination buckets is a prerequisite for S3 Replication. Without versioning, replication cannot track object versions, which is essential for meeting the 15-minute RPO with consistency guarantees.

Answer

Configure S3 Event Notifications to trigger a Lambda function that copies objects to the secondary Region.

Answer

Enable S3 Transfer Acceleration on the source bucket.

Question 7

Refer to the exhibit. A DevOps engineer applies the IAM policy shown to an S3 bucket to enforce server-side encryption. However, users report that some uploads succeed without encryption. What is the most likely reason?

Accepted Answer

The policy only allows the action but does not deny actions that do not meet the condition.. Option B is correct because the IAM policy only allows the s3:PutObject action when the encryption condition is met, but it does not include an explicit Deny statement to block uploads that do not satisfy the condition. In IAM, an Allow statement with a condition does not automatically deny requests that fail the condition; it simply does not apply the Allow. If there is another policy (e.g., a bucket policy or an identity-based policy) that grants s3:PutObject without the encryption condition, or if the default S3 behavior permits unencrypted uploads (since S3 does not require encryption by default), then unencrypted uploads can still succeed. To enforce encryption, you must add a Deny statement with a condition like `StringNotEquals` on `s3:x-amz-server-side-encryption` to explicitly reject requests that lack the required encryption header.

Answer

The policy uses StringEquals instead of StringNotEquals.

Answer

The resource ARN is incorrect; it should be the bucket ARN.

Answer

The action should be s3:PutEncryptedObject instead of s3:PutObject.

Question 8

Refer to the exhibit. A DevOps engineer applies the IAM policy shown to an S3 bucket to enforce server-side encryption. However, users report that some uploads succeed without encryption. What is the most likely reason?

Accepted Answer

The policy only allows the action but does not deny actions that do not meet the condition.. Option B is correct because the IAM policy shown only allows the s3:PutObject action when the encryption condition is met, but it does not include a Deny statement to explicitly block uploads that do not satisfy the condition. In AWS IAM, an Allow statement alone does not prevent actions that fail the condition; it simply grants permission when the condition is true. Without a corresponding Deny, users with other permissions (e.g., from a broader policy) can still upload objects without encryption, as the Allow does not override other effective allows.

Answer

The resource ARN is incorrect; it should be the bucket ARN.

Answer

The action should be s3:PutEncryptedObject instead of s3:PutObject.

Answer

The policy uses StringEquals instead of StringNotEquals.

Question 9

A DevOps engineer needs to centralize logs from multiple AWS accounts into a single CloudWatch Logs account. Which feature should be used?

Accepted Answer

CloudWatch Logs cross-account subscription. CloudWatch Logs cross-account subscription (Option D) allows you to stream log data from multiple source AWS accounts to a single destination account's CloudWatch Logs log group. This is the native, managed feature designed specifically for centralizing logs across accounts without needing additional infrastructure or data transformation.

Answer

CloudWatch Logs Insights

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 10

A company runs a stateless web application on EC2 instances behind an Application Load Balancer. To improve resilience, which configuration should be used for the EC2 instances?

Accepted Answer

Use multiple EC2 instances across two or more Availability Zones. D is correct because deploying multiple EC2 instances across two or more Availability Zones (AZs) ensures high availability and fault tolerance. If one AZ fails, the Application Load Balancer (ALB) automatically routes traffic to healthy instances in other AZs, maintaining service continuity. This aligns with the AWS Well-Architected Framework's resilience best practices for stateless applications.

Answer

Use one EC2 instance with a larger instance type

Answer

Use a single, large EC2 instance in one Availability Zone

Answer

Use multiple EC2 instances in one Availability Zone with health checks disabled

Question 11

A company is designing a disaster recovery strategy for a critical application that requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 hour. The application runs on EC2 with data stored in Amazon RDS Multi-AZ. Which approach meets these requirements?

Accepted Answer

Use a pilot light strategy with RDS cross-Region read replicas and automated backups. Option A is correct because a pilot light strategy with RDS cross-Region read replicas and automated backups meets the RTO of 15 minutes and RPO of 1 hour. The cross-Region read replica provides near-synchronous replication with an RPO typically under 5 seconds, and automated backups enable point-in-time recovery within the 1-hour RPO. The pilot light approach allows rapid promotion of the replica to a primary instance, achieving the 15-minute RTO by keeping minimal core services running in the DR Region.

Answer

Use backup and restore with daily snapshots to another Region

Answer

Use a warm standby with a scaled-down production environment in another Region

Answer

Use a Multi-AZ deployment in the same Region for DR

Question 12

A company runs a critical application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Amazon RDS Multi-AZ DB instance. During a recent incident, one Availability Zone experienced a complete failure. The application remained available, but performance degraded significantly. What is the most likely cause of the degradation?

Accepted Answer

The Auto Scaling group was configured to span only two Availability Zones, and the failed AZ contained a majority of the running instances. Option C is correct because if the Auto Scaling group is configured to span only two Availability Zones, the failure of one AZ would result in a disproportionate loss of capacity. Since the failed AZ contained a majority of the running instances, the remaining instances in the surviving AZ would be overloaded, causing significant performance degradation. The application remained available because the surviving instances and the Multi-AZ RDS instance continued to operate, but the reduced compute capacity led to degraded performance.

Answer

The Route 53 health checks failed and directed traffic to another Region, increasing latency

Answer

The RDS DB instance failed over to a read replica in a different Region

Answer

The EBS volumes in the failed AZ were not available, causing data loss

Question 13

A company is using Amazon CloudWatch Logs to store application logs. The DevOps engineer needs to ensure that log data is encrypted at rest using a customer-managed KMS key. What step must be taken?

Accepted Answer

Create a new KMS customer-managed key and associate it with the CloudWatch Logs log group.. Option C is correct because CloudWatch Logs supports encryption at rest using a customer-managed KMS key, which must be explicitly associated with the log group. When you create or update a log group, you can specify a KMS key ID (via the AWS CLI, SDK, or console) to encrypt all log data stored in that group. This ensures that the log data is encrypted using a key you control, not the default AWS-managed key.

Answer

Use AWS CloudTrail to encrypt the log data before it is sent to CloudWatch Logs.

Answer

Create a KMS key and apply it to the IAM role used by the application.

Answer

Enable server-side encryption on the log group using the default CloudWatch Logs key.

Question 14

Which THREE steps should a DevOps engineer take to troubleshoot an EC2 instance that cannot be reached via SSH? (Choose three.)

Accepted Answer

Check the network ACL inbound rules for the subnet.. Option A is correct because network ACLs (NACLs) are stateless firewall rules applied at the subnet level. If the inbound rule for ephemeral ports or port 22 is not explicitly allowed, SSH traffic will be dropped even if the security group permits it. Checking NACL inbound rules is a fundamental step in troubleshooting connectivity issues.

Answer

Verify that the corporate firewall allows SSH to the instance.

Answer

Create an AMI from the instance and launch a new one.

Question 15

A company is using AWS Lambda to process streaming data from Amazon Kinesis. The processing rate is slower than expected, and the engineer needs to monitor the number of records that are failing processing. Which metric should be used to create a CloudWatch alarm?

Accepted Answer

IteratorAge. The IteratorAge metric measures the age of the last record in the Lambda function's iterator, indicating how far behind real-time the processing is. A high or increasing IteratorAge suggests that records are being retried or stuck due to processing failures, making it the correct metric to monitor for records failing processing in a Kinesis-triggered Lambda.

Answer

Invocations

Answer

Errors

Answer

Throttles

Question 16

A company uses AWS X-Ray to trace requests through its microservices application. The DevOps engineer notices that some traces are incomplete. What is a possible reason?

Accepted Answer

The X-Ray SDK sampling rate is configured too low, causing many requests to be skipped.. Option C is correct because the X-Ray SDK uses a sampling rate to decide which requests to record. If the sampling rate is set too low, a large percentage of requests are skipped, leading to incomplete traces. The DevOps engineer would observe missing segments for requests that were not sampled, even though the daemon and SDK are functioning correctly.

Answer

The X-Ray daemon is not running on the application servers.

Answer

X-Ray cannot trace requests that cross multiple AWS services.

Answer

X-Ray requires the CloudWatch agent to be installed on all EC2 instances.

Question 17

A DevOps engineer is troubleshooting a production issue where an application's response time has increased. The application is deployed on Amazon ECS with Fargate. The engineer wants to identify which microservice is causing the latency. Which AWS service should be used?

Accepted Answer

AWS X-Ray to trace requests and analyze service latency.. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, allowing the engineer to pinpoint which service is introducing latency. By analyzing trace segments and subsegments, X-Ray can break down response times for each component in the application, directly addressing the need to identify the specific microservice causing the delay.

Answer

Amazon CloudWatch Synthetics canary to monitor the application endpoint.

Answer

Amazon CloudWatch Logs Insights to query application logs for errors.

Answer

Amazon CloudWatch ServiceLens to visualize service maps and traces.

Question 18

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in a specific region report slow load times. The DevOps team checks CloudFront metrics and sees a high error rate (5xx) for that region. The S3 bucket is healthy. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant access to the CloudFront origin access identity (OAI).. A high 5xx error rate from CloudFront combined with a healthy S3 bucket strongly indicates that CloudFront cannot fetch objects from the origin. If the S3 bucket policy does not grant access to the CloudFront origin access identity (OAI), CloudFront receives an access denied (403) response from S3, which CloudFront translates into a 5xx error for the user. This is the most common cause of regional 5xx errors when the origin is otherwise healthy.

Answer

The AWS WAF web ACL is blocking requests from that region.

Answer

The CloudFront distribution's default TTL is too short.

Answer

The CloudFront origin shield is misconfigured.

Question 19

Which THREE measures can be taken to ensure that EC2 instances are compliant with a security policy that requires all instances to be in a VPC with specific tags? (Select THREE.)

Accepted Answer

Use AWS Config rules to detect non-compliant instances.. AWS Config rules can evaluate EC2 instances against a desired configuration, such as being in a VPC with specific tags. By using a custom or managed rule (e.g., 'required-tags' or 'ec2-instance-in-vpc'), you can detect non-compliant instances and trigger remediation actions. This provides continuous monitoring and reporting of compliance status without blocking the launch itself.

Answer

Use EC2 Auto Scaling to launch instances only in the correct VPC.

Answer

Use CloudWatch alarms to monitor instance launches.

Question 20

A company wants to ensure that its application can recover from an Amazon S3 service disruption. The application reads and writes data to S3. Which strategy should the application implement to achieve resilience?

Accepted Answer

Implement application logic to fall back to an S3 bucket in a different Region if the primary bucket is unavailable. Option B is correct because implementing application logic to fall back to an S3 bucket in a different Region provides resilience against a regional S3 service disruption. S3 buckets are regional resources, so if one Region experiences an outage, the application can redirect reads and writes to a bucket in another Region. This approach requires the application to handle errors from the primary bucket and switch to the secondary bucket, ensuring continued availability without relying on automatic failover mechanisms that may not be instantaneous.

Answer

Store all data in a single S3 bucket with versioning enabled

Answer

Enable S3 Cross-Region Replication with automatic failover

Answer

Use S3 Transfer Acceleration to improve data transfer speed