DOP-C02 Mock Exam 92 — 25 Questions

Question 1

Refer to the exhibit. A security team reviews this CloudTrail log entry. Which finding is most concerning?

Accepted Answer

The user did not authenticate with MFA.. The session was created without MFA (mfaAuthenticated: false). This is a security concern because the role allows console access and the user did not use MFA, increasing risk of unauthorized access. The termination is the action, but the lack of MFA is a security gap.

Answer

The event occurred in us-east-1.

Answer

The instance was terminated by an assumed role.

Answer

The source IP is from a public IP.

Question 2

A company runs a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The function scales up to handle high traffic but sometimes experiences throttling errors (HTTP 429) from Lambda. The company wants to improve the resilience of the application by reducing throttling. The SQS queue is configured as a Lambda event source with a batch size of 10. The Lambda function has a reserved concurrency of 100. Which combination of actions will best reduce throttling? (Choose the single best answer.)

Accepted Answer

Increase the Lambda function's reserved concurrency to 500.. Throttling errors (HTTP 429) occur when Lambda function invocations exceed the account-level concurrency limit or the function's reserved concurrency. By increasing the reserved concurrency from 100 to 500, the function can handle more concurrent invocations, reducing the likelihood of throttling when traffic spikes. This directly addresses the scaling bottleneck without changing the event source or message processing pattern.

Answer

Change the SQS queue to use a FIFO queue to guarantee exactly-once processing.

Answer

Increase the SQS batch size to 50 to process more messages per invocation.

Answer

Use a dead-letter queue (DLQ) for unprocessed messages and set up a CloudWatch alarm to trigger a second Lambda function to reprocess them.

Question 3

A company runs a high-traffic web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. The application uses an Amazon RDS for PostgreSQL database. Recently, during a traffic spike, the application became unresponsive. Investigation revealed that the database CPU utilization reached 100%, causing queries to timeout. The Auto Scaling group added more EC2 instances, which only increased the load on the database. The DevOps team needs to implement a solution that prevents the database from being overwhelmed during traffic spikes while maintaining application availability. The solution must be cost-effective and require minimal changes to the application code. Which solution should the DevOps team implement?

Accepted Answer

Use Amazon RDS Proxy between the application and the database to pool and reuse connections.. RDS Proxy manages database connections efficiently, reducing the number of connections and CPU overhead. It also provides connection pooling, which helps handle spikes without overwhelming the database.

Answer

Implement read replicas for the RDS database and modify the application to use read replicas for read queries.

Answer

Increase the instance size of the RDS database to a larger instance type to handle more connections.

Answer

Configure Auto Scaling to launch EC2 instances based on a custom metric that tracks database CPU utilization, and throttle the number of instances.

Question 4

A startup runs a web application on EC2 instances behind an Application Load Balancer. They want to improve resilience by distributing instances across multiple Availability Zones. Currently, all instances are in us-east-1a. They create a launch template and an Auto Scaling group with a desired capacity of 2. They configure the Auto Scaling group to use two subnets: one in us-east-1a and one in us-east-1b. However, after updating, all instances remain in us-east-1a. What is the most likely reason?

Accepted Answer

The Auto Scaling group's subnet configuration was not updated to include the new subnet.. Auto Scaling group distributes instances across subnets specified. If only one subnet is used, it may be because the launch template specifies only one subnet or the Auto Scaling group's subnets were not updated. The most common cause is that the Auto Scaling group's subnet list still contains only the original subnet.

Answer

The instance type is not available in us-east-1b.

Answer

The new subnet in us-east-1b has no route to the internet.

Answer

The launch template specifies a single subnet in us-east-1a.

Question 5

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance with automated backups enabled. The DevOps team needs to modify the DB instance to use a larger instance type. They update the CloudFormation template and execute a stack update. The update fails with the error: 'Cannot modify DB instance class because the instance is in a state that does not allow modification.' The DB instance is in the 'available' state. The team needs to successfully update the instance type without data loss. What should the team do?

Accepted Answer

Modify the CloudFormation template to change the 'DBInstanceClass' property and set 'UpdateReplacePolicy' to 'Snapshot', then update the stack. This will create a new DB instance and delete the old one after taking a snapshot.. Option C is correct because modifying the DB instance class for RDS often requires a replacement (not just modification) when using CloudFormation, and a snapshot ensures data is preserved. Option A is wrong because stopping the instance is not allowed for RDS. Option B is wrong because deleting the stack would cause data loss. Option D is wrong because the error is not about lack of permissions.

Answer

Stop the RDS instance, then update the stack, then start it.

Answer

Add the 'AllowMajorVersionUpgrade' property to the DB instance in the template and update the stack.

Answer

Delete the CloudFormation stack, create a new stack with the new instance type, and restore from the automated backup.

Question 6

A company runs a high-traffic e-commerce application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an in-memory cache on the EC2 instances. During a recent deployment, the Auto Scaling group terminated an instance that had active user sessions, causing users to lose their cart data and leading to a poor customer experience. The company wants to prevent this in future deployments. They need a solution that allows existing sessions to complete before instance termination, without manual intervention. Which solution should they use?

Accepted Answer

Implement an Auto Scaling lifecycle hook that puts the instance in a 'terminating:wait' state, and have a script on the instance that signals completion after draining sessions.. Option C is correct because lifecycle hooks allow the Auto Scaling group to wait for a specified timeout before terminating an instance, giving the application time to drain sessions. Option A is incorrect because connection draining on the ALB only handles HTTP connections, not application-level session state. Option B is incorrect because increasing cooldown does not delay termination. Option D is incorrect because updating the health check type does not prevent immediate termination.

Answer

Increase the Auto Scaling group's cooldown period and health check grace period.

Answer

Enable connection draining on the ALB target group and increase the deregistration delay.

Answer

Change the health check type to ELB and mark instances unhealthy before deployment.

Question 7

A large enterprise uses a multi-account AWS strategy with a centralized DevOps account. The DevOps account hosts an AWS CodePipeline that deploys a critical application to production account (111111111111) using AWS CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy). The deploy stage uses a cross-account role (arn:aws:iam::111111111111:role/CrossAccountDeployRole) to perform the deployment. The trust policy on that role allows the DevOps account's CodePipeline service role (arn:aws:iam::222222222222:role/CodePipelineServiceRole) to assume it. The pipeline has been working for months, but after a recent security audit, the security team tightened permissions. Now the deploy stage fails with the error: 'User: arn:aws:sts::222222222222:assumed-role/CodePipelineServiceRole/AWS-CodePipeline-xxx is not authorized to perform: codedeploy:CreateDeployment on resource: arn:aws:codedeploy:us-east-1:111111111111:deploymentgroup:MyApp/MyDG'. The DevOps team has verified that the CrossAccountDeployRole has a permissions policy that allows 'codedeploy:*' on all resources. The CodePipelineServiceRole has a permissions policy that allows 'sts:AssumeRole' on the CrossAccountDeployRole. What is the most likely cause and what action should be taken to resolve the issue?

Accepted Answer

Check the permissions boundary on CrossAccountDeployRole and add a boundary that allows CodeDeploy actions.. Option C is correct because the error indicates that the assumed role (CrossAccountDeployRole) is not authorized to perform codedeploy:CreateDeployment, despite having a permissions policy that allows codedeploy:* on all resources. This typically occurs when a permissions boundary is attached to the role that restricts the effective permissions, overriding the permissions policy. Adding a permissions boundary that allows CodeDeploy actions resolves the issue by ensuring the role's effective permissions include the necessary CodeDeploy operations.

Answer

Add 'sts:AssumeRole' to the permissions policy of CodePipelineServiceRole.

Answer

Create the deployment group in the production account again to reset permissions.

Answer

Update the trust policy of CrossAccountDeployRole to include the DevOps account ID.

Question 8

A company runs a multi-account environment using AWS Organizations. The security team has implemented a service control policy (SCP) that denies all actions on DynamoDB tables unless the request includes a specific tag "Environment": "Production". The development team has an IAM role with full DynamoDB access in their account. When they try to create a DynamoDB table using the AWS CLI, they receive an access denied error. They are certain they included the tag. The DevOps engineer reviews the SCP and finds that it uses the condition key "aws:RequestTag". However, the engineer notices that the SCP also denies access if the request does not include the tag for tagging actions. What is the most likely reason for the access denied error?

Accepted Answer

The CreateTable API does not accept tags in the request; tags must be added after creation using the TagResource API.. Option C is correct because the `CreateTable` API in DynamoDB does not accept tags as part of the request parameters when creating a table. Tags can only be added after the table is created using the `TagResource` API or the `aws dynamodb tag-resource` CLI command. Since the SCP uses `aws:RequestTag` to require the tag on the initial request, and the `CreateTable` call cannot include tags, the request is denied regardless of whether the developer intended to include the tag.

Answer

The SCP requires an explicit allow statement in the IAM policy to override the deny.

Answer

The IAM role does not have permission to tag resources.

Answer

The SCP is not applied to the development account because it is in a different OU.

Question 9

A company manages its infrastructure using AWS CloudFormation. They have a production stack that includes an Amazon RDS Multi-AZ DB instance. The stack was created using the 'aws cloudformation create-stack' command with default settings. The DB instance uses a custom DB parameter group. A DevOps engineer needs to modify a parameter in the DB parameter group and update the stack. The engineer updates the template to change the parameter value and runs 'aws cloudformation update-stack'. The update fails with a 'ROLLBACK_IN_PROGRESS' status. The engineer checks the CloudFormation console and sees that the DB instance was successfully modified, but the stack is rolling back. The rollback fails because the DB instance cannot be reverted to the original parameter value. The stack is now in 'UPDATE_ROLLBACK_FAILED' state. What should the engineer do to resolve this situation and apply the desired parameter change?

Accepted Answer

Use the 'aws cloudformation continue-update-rollback' command with the '--resources-to-skip' parameter to skip the DB instance, allowing the stack to reach 'UPDATE_ROLLBACK_COMPLETE'. Then apply a change set with the desired parameter change.. Option B is correct because when a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the `continue-update-rollback` command with `--resources-to-skip` allows you to skip the resource that cannot be rolled back (the RDS DB instance with the custom parameter group). This moves the stack to UPDATE_ROLLBACK_COMPLETE, after which you can apply a change set with the desired parameter change. This approach avoids manual intervention or stack deletion while preserving the modified DB instance.

Answer

Run 'aws cloudformation update-stack' again with the original template to revert the changes.

Answer

Revert the parameter value manually in the RDS console and then resume the rollback.

Answer

Delete the stack and recreate it with the updated template.

Question 10

A media company runs a video processing pipeline on AWS. Raw videos are uploaded to an S3 bucket, which triggers a Lambda function to start an AWS Batch job for transcoding. The Batch job reads the source video from S3, processes it, and writes the output to another S3 bucket. Recently, the company has seen an increase in processing failures. Investigation shows that the Batch jobs are being terminated with a 'TIMEOUT' status after running for exactly 30 minutes. The video files are large, and some jobs legitimately take up to 45 minutes. The Batch job definition has a 'timeout' setting configured. Which action should be taken to resolve this issue?

Accepted Answer

Modify the Batch job definition to increase the 'timeout' value to 3600 seconds (60 minutes).. The timeout configured in the job definition is causing jobs that exceed 30 minutes to be terminated. Increasing the timeout to 60 minutes allows longer-running jobs to complete.

Answer

Increase the S3 bucket lifecycle policy to retain videos longer.

Answer

Increase the Lambda function timeout to 60 minutes.

Answer

Change the Batch job queue to a different compute environment.

Question 11

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group across three Availability Zones. The instances run a Java application that connects to an Amazon RDS Multi-AZ MySQL database. The application also uses Amazon ElastiCache for Redis for session caching. The company recently experienced a severe outage where the ALB's 5xx error rate spiked to 100% for 45 minutes. The root cause was a combination of a slow-running query on the RDS primary instance and a subsequent failover that caused the application to lose connections to the database. The failover happened because the slow query caused the primary to become unresponsive, triggering a Multi-AZ failover. During the failover, the application's connection pool exhausted, and new connections failed. The application logs show a high rate of 'java.sql.SQLTimeoutException' and 'com.mysql.cj.exceptions.CJCommunicationsException'. The DevOps team needs to implement a long-term solution that minimizes the impact of similar incidents. The solution must be cost-effective and require minimal application changes. Which combination of actions should the DevOps team take?

Accepted Answer

Implement Amazon RDS Proxy to manage database connections and add read replicas to offload read traffic.. Amazon RDS Proxy is the correct solution because it efficiently manages database connection pooling, reducing the likelihood of connection exhaustion during failovers. By maintaining a warm connection pool and automatically reconnecting to the new primary after a Multi-AZ failover, RDS Proxy minimizes application-side connection timeouts and errors like SQLTimeoutException and CJCommunicationsException. Adding read replicas offloads read traffic, reducing the load on the primary and mitigating the risk of slow queries causing unresponsiveness. This combination requires minimal application changes and is cost-effective compared to scaling the primary instance.

Answer

Use an Auto Scaling policy for EC2 based on RDS connection count and implement a read replica for the primary.

Answer

Configure Multi-AZ RDS with a synchronous standby and use Amazon RDS for MySQL with enhanced monitoring.

Answer

Increase the instance size of the RDS primary and enable Performance Insights to identify slow queries.

Question 12

A company runs a production e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances running in an Auto Scaling group across three Availability Zones (AZs). The application stores session state in Amazon ElastiCache for Redis (cluster mode disabled) with a single node. The database is an Amazon Aurora MySQL DB cluster with one writer and two reader instances in different AZs. The platform experiences intermittent slowdowns and occasional timeouts during peak traffic hours. The CloudWatch metrics show that the ALB's TargetResponseTime is elevated, and the Redis CPU utilization is consistently above 80% during these periods. The Auto Scaling group is scaling out, but new instances take several minutes to become healthy. The DevOps team has been asked to improve the resilience and performance of the application with minimal changes to the application code. Which solution should the team implement?

Accepted Answer

Migrate ElastiCache for Redis to a cluster mode enabled configuration with multiple shards and enable Multi-AZ with automatic failover. Also, use an ElastiCache replication group with read replicas in different AZs.. Option D is correct because the primary bottleneck is the single-node Redis instance (CPU > 80%), which cannot scale reads or handle failover. Migrating to cluster mode enabled with multiple shards distributes the CPU load across shards, while Multi-AZ with automatic failover and read replicas in different AZs provides high availability and read scaling. This directly addresses the elevated ALB TargetResponseTime caused by Redis latency without requiring application code changes.

Answer

Replace the ALB with a Network Load Balancer (NLB) to reduce latency, and use an Auto Scaling group with a step scaling policy based on Redis CPU utilization.

Answer

Increase the instance size of the ElastiCache for Redis node and the size of the Aurora writer instance. Also, increase the cooldown period for the Auto Scaling group to allow new instances to warm up.

Answer

Implement Amazon RDS Proxy in front of the Aurora cluster to reduce database connection overhead, and increase the size of the Redis instance to handle more connections.

Question 13

A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes messages from an Amazon SQS queue. Recently, the processing time has increased, and the SQS queue depth is growing. The CloudWatch metrics show that the ECS service's CPU utilization is consistently around 70%, memory utilization is 80%, and the number of running tasks is at the maximum allowed (10). The service is configured with a target tracking scaling policy based on CPU utilization with a target value of 50%. However, the auto scaling does not seem to be adding tasks. The engineer checks the ECS service events and finds no scaling activity. What is the MOST likely reason the auto scaling is not working, and what action should be taken to resolve the issue?

Accepted Answer

The service has reached the maximum number of tasks defined in the auto scaling configuration; increase the maximum tasks.. The auto scaling is not adding tasks because the ECS service has already reached the maximum number of tasks defined in the auto scaling configuration (10). With CPU utilization at 70% and the target tracking policy set to 50%, the policy would normally trigger scale-out actions, but since the maximum task count is already hit, no scaling activity occurs. The engineer must increase the maximum tasks in the auto scaling configuration to allow further scale-out.

Answer

The scaling policy is not properly configured; recreate it with a lower target value.

Answer

The CloudWatch metric is not being emitted correctly; check the metric namespace.

Answer

The ECS service is using Fargate, which does not support target tracking scaling policies.

Question 14

A company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group of EC2 instances, and an Amazon RDS Multi-AZ database. The DevOps team has configured the EC2 instances to send application logs to CloudWatch Logs using the CloudWatch agent. They also set up a CloudWatch alarm on the ALB's 5xx error count. During a recent deployment, the team noticed that the alarm did not trigger even though the application was returning 5xx errors. The team verified that the CloudWatch agent is running on the instances and logs are appearing in CloudWatch Logs. What should the team do to ensure the alarm triggers correctly?

Accepted Answer

Verify that the CloudWatch alarm is using the correct metric 'HTTPCode_Target_5XX_Count' and that the threshold is appropriate.. Option D is correct. The ALB's 5xx metric is based on requests that the ALB itself generates, not the backend responses. If the backend returns a 5xx, the ALB forwards it, but the metric may be 'HTTPCode_Target_5XX_Count'. The team may have confused the metrics. Option A is incorrect because the agent is already working. Option B is incorrect because the alarm is on ALB, not EC2. Option C is incorrect because log groups do not affect alarms.

Answer

Create a metric filter on the EC2 instance's log group to count 5xx errors and create an alarm on that.

Answer

Change the CloudWatch alarm to use the 'HTTPCode_ELB_5XX_Count' metric instead.

Answer

Restart the CloudWatch agent on the EC2 instances.

Question 15

A company runs a production web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application is deployed across three Availability Zones. The DevOps team recently noticed that the application's error rate is spiking periodically, but they cannot correlate the spikes with any known deployments or changes. The team has enabled detailed CloudWatch metrics for the ALB and EC2, and they are using CloudWatch Logs for application logs. They also have AWS X-Ray enabled for tracing.

The team observes that during error spikes, the ALB's 5XX count increases, but the EC2 instance-level CPU and memory metrics remain normal. The application logs show 'Connection timed out' errors. The team suspects the issue is related to network connectivity but is not sure.

Which course of action should the DevOps team take to identify the root cause of the periodic error spikes?

Accepted Answer

Enable VPC Flow Logs for the subnets and analyze the logs to identify dropped connections during the error spikes.. VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in a VPC, including whether the traffic was accepted or rejected. Since the application logs show 'Connection timed out' errors and instance-level metrics are normal, the issue likely lies in the network path (e.g., security groups, NACLs, or subnet routing) rather than the application or compute layer. Analyzing VPC Flow Logs during the error spikes will reveal if connections are being dropped or rejected, pinpointing the root cause of the timeouts.

Answer

Increase the EC2 instance size to handle higher traffic and reduce timeouts.

Answer

Configure a step scaling policy for the Auto Scaling group based on ALB 5XX count.

Answer

Enable ALB access logs and analyze the 5xx response patterns.

Question 16

A company runs a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads to an S3 bucket. The operations team uses CloudWatch Logs for monitoring, but they are finding it difficult to correlate logs across multiple Lambda functions that handle different parts of the workflow. The team wants to trace requests as they flow through the application and identify bottlenecks or errors. The team has already enabled CloudWatch Logs for all Lambda functions. What should the team do to achieve end-to-end request tracing?

Accepted Answer

Enable AWS X-Ray on the Lambda functions and API Gateway to trace requests end-to-end.. Option C is correct because AWS X-Ray provides end-to-end tracing and integrates with Lambda and API Gateway. Option A is wrong because CloudWatch Contributor Insights analyzes top contributors but does not trace requests across services. Option B is wrong because CloudWatch ServiceLens provides service maps but relies on X-Ray for tracing. Option D is wrong because CloudTrail logs API calls, not application-level tracing.

Answer

Use CloudWatch Contributor Insights to analyze the log data and identify the top contributors to latency.

Answer

Use AWS CloudTrail to log all API calls and correlate them with CloudWatch Logs.

Answer

Create a CloudWatch ServiceLens service map to visualize the application components.

Question 17

A company runs a critical web application on AWS. The application is deployed across multiple Availability Zones using an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The Auto Scaling group uses a launch template that specifies an Amazon Linux 2 AMI. The application stores session state in an ElastiCache Redis cluster. Recently, the operations team received alerts that the application is returning 503 errors intermittently. Investigation shows that the ALB target group health checks are failing for some instances, but those instances are still in service. The CloudWatch logs from the instances show that the application is running, but the health check endpoint is timing out after 5 seconds. The health check is configured with a 5-second timeout, 10-second interval, and 2 consecutive successes required to mark healthy. The DevOps engineer suspects that the issue is due to high CPU utilization on the instances causing the health check to respond slowly. The engineer wants to implement a solution that prevents the ALB from routing traffic to instances that are experiencing high CPU, and also automatically scales out to handle the increased load. What should the engineer do?

Accepted Answer

Create a CloudWatch alarm on CPU utilization and use it to perform an EC2 action to stop the instance, and configure the Auto Scaling group to use a target tracking scaling policy based on CPU utilization.. Option B is correct because it addresses both the immediate issue (high CPU causing health check timeouts) and the scaling requirement. Stopping the instance via a CloudWatch alarm removes it from the ALB target group, preventing traffic routing to unhealthy instances. The target tracking scaling policy based on CPU utilization automatically adds instances when CPU is high, ensuring capacity matches demand.

Answer

Configure the Auto Scaling group to use ELB health checks and set the health check grace period to 600 seconds.

Answer

Create a scheduled scaling action to add more instances during peak hours.

Answer

Increase the health check timeout to 10 seconds and the interval to 20 seconds to give instances more time to respond.

Question 18

Your company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances running a web server. The web servers write access logs to a shared Amazon EFS filesystem. The operations team needs to monitor the web server logs in real-time to detect and alert on 5xx error spikes. Currently, the team manually SSHes into instances to tail logs, which is inefficient and doesn't provide real-time alerting. The team wants a centralized, near-real-time logging solution with minimal operational overhead. They have asked you to design a solution that ingests logs from the EFS filesystem into a centralized log analytics platform. Which solution would you recommend?

Accepted Answer

Install and configure the Amazon CloudWatch Logs agent on each EC2 instance to tail the log files from the EFS mount and send them to CloudWatch Logs. Create a metric filter and alarm for 5xx errors.. Option D is correct because installing the CloudWatch Logs agent on each EC2 instance allows it to tail the log files from the shared EFS mount point and stream them to CloudWatch Logs in near real-time. This provides centralized log ingestion with minimal operational overhead, and you can create a metric filter and alarm to detect and alert on 5xx error spikes without manual SSH access.

Answer

Enable AWS CloudTrail data events for the EC2 instances to capture log file modifications.

Answer

Configure an Amazon EventBridge scheduled rule to invoke an AWS Lambda function that reads new log lines from EFS and publishes them to Amazon CloudWatch Logs.

Answer

Stream the log files to Amazon Kinesis Data Streams using a custom producer, then use a Lambda function to analyze and alert on 5xx errors.

Question 19

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group (ASG) for web servers, and an Amazon RDS Multi-AZ DB instance. The ASG uses a launch template with Amazon Linux 2 and a user data script that installs the web application and connects to the RDS database using a static password stored in the user data. Recently, the security team discovered that the user data script is exposed in the EC2 console and could be viewed by anyone with EC2 describe-instances permissions. The team wants to remediate this immediately without causing downtime. The ASG is configured with a min size of 2, max size of 6, and desired capacity of 4. The application is currently under load. Which option describes the best course of action?

Accepted Answer

Create a new launch template version that retrieves the password from AWS Secrets Manager. Update the ASG to use the new template version and perform an instance refresh with a minimum healthy percentage of 100%.. Option A is correct because it uses an instance refresh with a minimum healthy percentage of 100% to replace instances without downtime, while the new launch template version retrieves the password from AWS Secrets Manager, eliminating the static password exposure. This approach ensures that the security vulnerability is remediated immediately without disrupting the running application under load.

Answer

Immediately modify the user data on each running EC2 instance to remove the password, then update the launch template to reference AWS Secrets Manager.

Answer

Update the existing launch template to use AWS Secrets Manager for the database password. The ASG will automatically apply the change to existing instances.

Answer

Delete the existing launch template and create a new one with secrets from AWS Secrets Manager. Then terminate all running instances and let the ASG launch new ones.

Question 20

A company runs a critical web application on EC2 instances in an Auto Scaling group. The application uses an Application Load Balancer (ALB) with health checks pointing to /health. Recently, the application experienced intermittent failures where the ALB would mark instances as unhealthy and route traffic away, causing a reduction in capacity. The development team noticed that the /health endpoint occasionally returns HTTP 503 when the application is under heavy load, but the application can recover quickly. The team wants to avoid unnecessary instance replacements while ensuring availability. Which solution should the DevOps engineer implement?

Accepted Answer

Increase the health check interval and increase the unhealthy threshold. Option B is correct because increasing the health check interval and unhealthy threshold reduces sensitivity to transient errors, avoiding unnecessary instance replacements. Option A is wrong because decreasing the interval makes the health check more sensitive, worsening the issue. Option C is wrong because reducing the unhealthy threshold makes it easier to mark instances unhealthy. Option D is wrong because custom actions are not necessary; the health check configuration can be tuned.

Answer

Implement a custom health check using Lambda that ignores 503 responses

Answer

Decrease the unhealthy threshold to mark instances unhealthy faster

Answer

Decrease the health check interval and decrease the healthy threshold

DOP-C02 Mock Exam 92 — 25 Questions

Exhibit

DOP-C02 Mock Exam 92 — 25 Questions

Exhibit