DOP-C02 Practice Test 9 — 10 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.. AWS CloudFormation StackSets can deploy a stack containing the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, new accounts automatically receive the stack. This centrally manages the rule with minimal operational overhead. Option B is incorrect because SCPs only deny API actions and cannot deploy a Config rule; they would need a separate mechanism to deploy the rule initially.

Answer

Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.

Answer

Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.

Answer

Use an AWS Config aggregator in the management account to monitor compliance across accounts.

Question 2

A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?

Accepted Answer

Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.. The UpdatePolicy attribute with AutoScalingReplacingUpdate is only supported for AWS::AutoScaling::AutoScalingGroup resources, not for AWS::RDS::DBInstance. Therefore, option D is incorrect. Options A and C are also invalid (CreationPolicy is for signal-based creation, and AutoScalingRollingUpdate is for rolling updates on Auto Scaling groups). Option B, Stack Policy, can protect resources from being updated but does not control how a replacement occurs to minimize downtime or prevent data loss. Thus, none of the provided options are correct for ensuring minimal downtime and data safety during an RDS instance class change that requires replacement.

Answer

Set the CreationPolicy attribute on the database resource.

Answer

Configure a Stack Policy to protect the database resource.

Answer

Set the UpdatePolicy to AutoScalingRollingUpdate.

Question 3

An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.. The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed. This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.

Answer

The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.

Answer

The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.

Answer

The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.

Question 4

A company is using Amazon RDS for MySQL and wants to monitor database connections. They need to set up an alarm when the number of connections exceeds 80% of the maximum connections for more than 5 minutes. Which CloudWatch metric and statistic should be used?

Accepted Answer

DatabaseConnections metric with Average statistic. The Average statistic of the DatabaseConnections metric over a 5-minute period provides a smoothed representation of connection usage, which is appropriate for detecting sustained breaches of the 80% threshold. Using Average reduces sensitivity to transient spikes, ensuring the alarm triggers only when the average number of connections remains above the threshold for the entire evaluation period, aligning with the requirement of 'more than 5 minutes'.

Answer

DatabaseConnections metric with Maximum statistic

Answer

DatabaseConnections metric with Sum and then divide by the number of data points

Answer

DatabaseConnections metric with Sum statistic

Question 5

A DevOps engineer is setting up a CI/CD pipeline for a Node.js application. The application must be built, tested, and deployed to an Amazon ECS cluster. The team wants to use AWS CodeBuild to run unit tests and package the application as a Docker image, and AWS CodePipeline to orchestrate the workflow. Which artifact type should CodeBuild output to be used by a subsequent CodePipeline action?

Accepted Answer

A JSON file with the image details.. CodePipeline's ECS deploy action requires an input artifact containing an imagedefinitions.json file that specifies the image URI. CodeBuild should produce this JSON file as its output artifact, not merely push the image to ECR. The subsequent deploy action reads the JSON file to determine which image to use, so the correct artifact type is a JSON file with image details.

Answer

A Docker image pushed to Amazon ECR.

Answer

A zip file containing the application source code.

Answer

A tarball stored in Amazon S3.

Question 6

A DevOps team uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild that generates the website files, and a deploy stage that copies files to an S3 bucket. The team wants to add a manual approval step before the deploy stage. What should the engineer do?

Accepted Answer

Add an approval action in the pipeline stage before deploy. AWS CodePipeline natively supports a manual approval action that can be added as a stage gate. By inserting an approval action in a stage immediately before the deploy stage, the pipeline will pause and require a designated approver to manually approve or reject the deployment, ensuring human oversight before files are copied to the S3 bucket.

Answer

Use Amazon SNS to send a notification and rely on a Lambda function to resume

Answer

Add a CodeBuild action that waits for an SNS confirmation

Answer

Configure the S3 bucket to send an event to the pipeline after upload

Question 7

A DevOps engineer is designing a resilient architecture for a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences occasional spikes in traffic that cause Lambda function throttling and increased error rates. What is the MOST effective way to improve resilience and reduce throttling?

Accepted Answer

Reserve concurrency for the Lambda function to ensure it always has available capacity.. The stem specifies that traffic spikes cause Lambda function throttling. Reserving concurrency for the Lambda function (Option D) guarantees a dedicated portion of the account-level concurrency limit, preventing other functions from exhausting capacity and directly mitigating throttling. Option B (DynamoDB auto scaling) would only help if the throttling were caused by DynamoDB capacity issues, but the stem makes no mention of database errors. Option A (increasing memory) does not address concurrency limits, and Option C (API Gateway throttling) can limit incoming requests but does not guarantee that Lambda has capacity to process them.

Answer

Increase the Lambda function memory to the maximum allowed.

Answer

Enable DynamoDB auto scaling for the table to handle traffic spikes.

Answer

Set API Gateway throttling limits to match the expected peak traffic.

Question 8

A company has a multi-account AWS environment using AWS Organizations. The security team needs to centrally monitor and analyze VPC Flow Logs from all accounts. The solution must be cost-effective and allow querying across accounts. Which approach should they take?

Accepted Answer

Send VPC Flow Logs from each account to a centralized Amazon S3 bucket, then use Amazon Athena to query the logs.. It uses a centralized Amazon S3 bucket to aggregate VPC Flow Logs from all accounts, which is cost-effective (S3 storage costs are low) and enables cross-account querying via Amazon Athena using standard SQL. This approach avoids per-ingestion costs of services like CloudWatch Logs or Kinesis and provides a serverless, scalable query engine for analyzing logs across accounts.

Answer

Use Amazon Elasticsearch Service (Amazon OpenSearch Service) with a cross-account ingestion pipeline.

Answer

Stream VPC Flow Logs from each account to Amazon Kinesis Data Analytics for real-time analysis.

Answer

Configure each account to send VPC Flow Logs to a central CloudWatch Logs group using cross-account subscription.

Question 9

A company runs a production web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application is deployed across three Availability Zones. The DevOps team recently noticed that the application's error rate is spiking periodically, but they cannot correlate the spikes with any known deployments or changes. The team has enabled detailed CloudWatch metrics for the ALB and EC2, and they are using CloudWatch Logs for application logs. They also have AWS X-Ray enabled for tracing.

The team observes that during error spikes, the ALB's 5XX count increases, but the EC2 instance-level CPU and memory metrics remain normal. The application logs show 'Connection timed out' errors. The team suspects the issue is related to network connectivity but is not sure.

Which course of action should the DevOps team take to identify the root cause of the periodic error spikes?

Accepted Answer

Enable VPC Flow Logs for the subnets and analyze the logs to identify dropped connections during the error spikes.. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including whether the traffic was accepted or rejected. Since the application logs show 'Connection timed out' errors and instance-level metrics are normal, the issue likely lies in the network path (e.g., security groups, NACLs, or subnet routing) rather than the application or compute layer. Analyzing VPC Flow Logs during the error spikes will reveal if connections are being dropped or rejected, pinpointing the root cause of the timeouts.

Answer

Increase the EC2 instance size to handle higher traffic and reduce timeouts.

Answer

Configure a step scaling policy for the Auto Scaling group based on ALB 5XX count.

Answer

Enable ALB access logs and analyze the 5xx response patterns.

Question 10

Refer to the exhibit. A CodeBuild project uses this buildspec. The build fails with the error: 'The runtime version specified is not supported in this environment.' What change should be made?

Accepted Answer

Update the runtime-versions to nodejs: 14.. The CodeBuild managed image for the specified environment (likely Ubuntu Standard 5.0 or similar) only supports Node.js runtime versions 14 and above. The error indicates that Node.js 12 is not available in the runtime-versions section of the buildspec for that environment. Updating to nodejs: 14 aligns with the supported runtime versions in the managed image, resolving the error without requiring custom images or manual installation.

Answer

Add an install command to install Node.js 12 from source.

Answer

Remove the runtime-versions section and install Node.js manually.

Answer

Change the build environment to use a custom image that includes Node.js 12.