DOP-C02 Hard Questions — 25 Difficult Questions

Question 1

During a deployment, a new application version on an ECS service starts failing health checks. The previous version is still running. The deployment is a rolling update with a 200% percent start. Which ECS feature should the engineer use to automatically revert to the previous version?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ECS deployment circuit breaker. (ECS deployment circuit breaker) is correct because it automatically detects failed deployments (e.g., health check failures) and triggers a rollback to the previous version. With a 200% percent start rolling update, the new version starts before the old is stopped; if health checks fail, the circuit breaker initiates a rollback. Option B (ECS service auto recovery) recovers from underlying infrastructure failures, not deployment failures. Option C (ECS managed scaling) adjusts desired count based on load, not deployment health. Option D (CloudWatch alarm actions) can trigger rollback events but is not an ECS built-in feature; it requires custom automation. Therefore, the correct ECS feature for automatic rollback is the deployment circuit breaker.

Answer

ECS service auto recovery

Answer

ECS managed scaling

Answer

CloudWatch alarm actions

Question 2

A company is migrating a monolithic application to a microservices architecture on Amazon EKS. The application uses a relational database. The team wants to ensure that database connections are managed efficiently and that the database can withstand a sudden spike in connections from multiple microservices. Which solution should the DevOps engineer implement? (Choose THREE.)

Accepted Answer

Deploy Amazon RDS Proxy in front of the database.. The correct solutions are C, D, and E. Option C (RDS Proxy) pools and shares database connections, reducing the number of connections and handling spikes efficiently. Option D (increase max_connections and enable Auto Scaling) allows the database to accept more connections and scale dynamically during spikes. Option E (connection pool sidecar like PgBouncer) adds connection pooling at the pod level, further managing connections. Option A (direct connections) would increase the number of connections, potentially overwhelming the database. Option B (ElastiCache) is for caching query results, not for managing database connections, and does not address the spike issue.

Answer

Use direct database connections from each microservice pod.

Answer

Use Amazon ElastiCache for Redis to cache database query results.

Question 3

A DevOps engineer is designing a deployment pipeline for a microservices application on Amazon ECS. The team wants to use blue/green deployments with automatic rollback if CloudWatch alarms are triggered during the deployment. Which combination of services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with a blue/green deployment configuration on the ECS service, and configure automatic rollback when CloudWatch alarms are breached.. AWS CodeDeploy natively supports blue/green deployments on Amazon ECS services, and you can configure automatic rollback when CloudWatch alarms are triggered, meeting the team's requirements. Option B is incorrect because CloudFormation ChangeSets do not provide native blue/green deployment with automatic rollback based on alarms; custom Lambda functions add complexity. Option C is incorrect because CodeBuild is used for building artifacts, not deploying; manually updating the ECS service and using a Lambda for rollback is not a streamlined solution. Option D is incorrect because ECS service auto scaling handles scaling based on demand, not deployment strategies like blue/green.

Answer

Use AWS CloudFormation with a ChangeSet and a custom rollback Lambda function triggered by CloudWatch alarms.

Answer

Use AWS CodeBuild to run a build that creates a new task definition, then update the ECS service manually, and use CloudWatch alarms to trigger a rollback via a Lambda function.

Answer

Use Amazon ECS service auto scaling with step scaling policies based on CloudWatch alarms.

Question 4

A DevOps team is using this IAM policy to allow a CI/CD pipeline to launch EC2 instances and retrieve parameters. However, the pipeline is failing with an 'AccessDenied' error when trying to create an instance. The pipeline uses a role with this policy attached. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on additional resources required for RunInstances, such as images and network interfaces.. The IAM policy likely only grants permissions on the 'ec2:RunInstances' action for the EC2 instance resource (arn:aws:ec2:region:account:instance/*), but creating an EC2 instance also requires permissions on other resources such as Amazon Machine Images (AMI), security groups, network interfaces, subnets, etc. Without explicit permissions on these additional resources, the RunInstances call fails with AccessDenied. Option A is incorrect because the condition syntax does not cause an AccessDenied; it would simply not match if poorly formatted. Option B is incorrect because the ssm:GetParameter action is allowed by the policy if it includes a resource specification, but the failure is on RunInstances, not SSM. Option D is incorrect because DescribeInstances does not require a Resource specification in the policy; the policy syntax is valid.

Answer

The condition StringEquals on InstanceType is incorrectly formatted.

Answer

The pipeline does not have permission to call ssm:GetParameter because the resource is not specified.

Answer

The policy must include a 'Resource' for the 'ec2:DescribeInstances' action to be valid.

Question 5

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application generates logs that are sent to Amazon CloudWatch Logs. The DevOps team needs to configure a metric filter to monitor for error patterns and trigger an alarm when the error rate exceeds 5% of total requests over a 5-minute period. Which TWO steps should the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group to count occurrences of the error pattern.. To achieve the monitoring goal, the team must first create a metric filter on the existing log group (Option B). This filter defines the error pattern to count and emits a custom metric for the error count. Then, they need to create a CloudWatch alarm that uses a math expression to calculate the error rate by dividing the error count metric by a total request count metric (or by using the same log group with another filter for total requests) and triggers when the rate exceeds 5% over 5 minutes (Option E). Option A is not required because the log group already exists. Option C is incorrect because a subscription filter would forward logs to Lambda, but the requirement is to use metric filters and alarms. Option D is incorrect because the metric is automatically created by the metric filter; you do not need to manually create a separate metric.

Answer

Create a CloudWatch Logs log group for the error metric.

Answer

Create a CloudWatch Logs subscription filter to stream errors to a Lambda function that calculates the error rate.

Answer

Create a CloudWatch metric for the error count.

Question 6

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?

Accepted Answer

AWS Config and AWS Systems Manager Automation. AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance. EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Question 7

An AWS account owner (Account A) owns an S3 bucket named my-bucket. The bucket policy shown in the exhibit is attached to the bucket. A user from Account B attempts to upload an object to the bucket without specifying the x-amz-acl header. What will happen?

Accepted Answer

The upload fails because the bucket policy requires the x-amz-acl header to be set to bucket-owner-full-control.. The condition requires the x-amz-acl header to be set to bucket-owner-full-control. If the header is not specified, the condition fails, and the request is denied. Option A is wrong because the condition is not met. Option B is wrong because the policy does not grant permission without the header. Option C is wrong because the bucket policy evaluates before the object ACL.

Answer

The upload fails because the bucket policy requires the object ACL to be set, but the default ACL allows the upload anyway.

Answer

The upload succeeds because the bucket policy does not explicitly deny the request.

Answer

The upload succeeds because the bucket policy allows s3:PutObject for any principal.

Question 8

A company uses CloudFormation to manage infrastructure. They have a nested stack that creates an Amazon RDS instance. When updating the parent stack, the RDS instance is unexpectedly replaced even though no changes were made to its properties. The engineer suspects a 'Drift' detection issue. What is the most likely reason for the replacement?

Accepted Answer

The logical ID of the RDS resource was changed in the nested stack template.. If the logical ID of a resource in the nested stack template is changed, CloudFormation treats it as a new resource and replaces the old one. Option A is incorrect because drift detection does not cause replacement; it only detects changes. Option B is incorrect because a 'Retain' deletion policy prevents deletion but does not prevent replacement. Option D is incorrect because a stack policy may prevent updates but would not cause replacement; it would either allow or block the update.

Answer

The RDS instance has drifted from the template definition.

Answer

The deletion policy is set to 'Retain'.

Answer

The stack policy prevents updates to the RDS instance.

Question 9

An organization runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that all traffic be encrypted in transit. The security team mandates the use of TLS 1.2 or higher and specific ciphers. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Configure the ALB with a security policy that enforces TLS 1.2 and the required ciphers.. The Application Load Balancer (ALB) supports predefined security policies that enforce TLS version and cipher requirements at the load balancer level, providing centralized control. Option D is correct because configuring the ALB with a security policy that mandates TLS 1.2 and specific ciphers meets the requirement efficiently without modifying individual instances. Option A is incorrect because a Network Load Balancer (NLB) with TLS listeners does not offer the same granular security policy options as ALB and is less efficient for this requirement. Option B is incorrect because CloudFront is a CDN service; placing it in front of the ALB does not directly enforce TLS settings on the ALB itself and adds unnecessary complexity. Option C is incorrect because installing self-signed certificates on each EC2 instance is inefficient, not centralized, and does not enforce consistent TLS version and cipher requirements across all traffic.

Answer

Use a Network Load Balancer with TLS listeners and target groups.

Answer

Place a CloudFront distribution in front of the ALB and configure the origin protocol policy.

Answer

Install a self-signed certificate on each EC2 instance and configure the web server.

Question 10

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet that needs to download patches from the internet. Which solution is MOST secure and scalable?

Accepted Answer

Create a NAT Gateway in a public subnet and update the private route table.. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet and receive responses, without allowing inbound traffic. This is the most secure and scalable solution because it is managed by AWS and scales automatically. Option B (a proxy server) is less scalable and requires ongoing management. Option C (assigning an Elastic IP to the private instance) would expose the instance to inbound internet traffic, violating the security of the private subnet. Option D (using a VPC endpoint) is only for accessing AWS services, not general internet patch repositories.

Answer

Launch a proxy server in a public subnet and route traffic through it.

Answer

Assign an Elastic IP to the instance in the private subnet.

Answer

Use a VPC endpoint to the Amazon Linux repository.

Question 11

A company uses RDS Multi-AZ with a read replica. During a failover test, the application experiences a 30-second write outage. The application uses a single DB endpoint. How can the outage be minimized?

Accepted Answer

Use RDS Proxy to handle database connections and failover.. RDS Proxy helps minimize write outages during failover by managing database connections efficiently. It maintains connection pools and automatically routes connections to the new primary after failover, reducing the outage window from seconds to sub-second. Option A (increasing instance class) does not affect failover time because failover duration is dominated by DNS propagation and database recovery, not instance size. Option C (Route 53 weighted record with health checks) is not suitable because Multi-AZ failover already handles DNS updates automatically, and using a weighted record with health checks would require additional complexity and still involve DNS propagation delays. Option D (using read replica endpoint for writes) is invalid because read replicas do not accept write operations; they are read-only.

Answer

Increase the instance class to improve failover performance.

Answer

Use a Route 53 weighted record with health checks to point to both instances.

Answer

Configure the application to use the read replica endpoint for writes.

Question 12

You are a DevOps engineer at a company that runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed using AWS CodeDeploy with an in-place deployment strategy. The deployment group contains 10 EC2 instances in an Auto Scaling group. Recently, a deployment failed with the error 'The overall deployment failed because too many individual instances failed deployment.' You check the CodeDeploy agent logs on one of the failed instances and see the error 'Script at /opt/codedeploy-agent/deployment-root/deployment-logs/scripts/application_start.sh failed with exit code 1.' The application_start.sh script is part of the AppSpec file. The script attempts to restart the web server. You notice that the script uses a path that exists only on some instances. What should you do to resolve this issue and prevent future failures?

Accepted Answer

Modify the application_start.sh script to check for the existence of the path before running the restart command.. The error occurs because the application_start.sh script attempts to restart the web server using a path that does not exist on all instances. This is a script logic issue, not a timeout or agent issue. The best solution is to modify the script to check for the existence of the path before executing the restart command, making the script robust. Option A is incorrect because increasing the timeout does not fix the script failure. Option C is incorrect because removing the script would bypass necessary post-installation steps. Option D is incorrect because reinstalling the agent does not address the script path issue.

Answer

Increase the deployment timeout in CodeDeploy.

Answer

Remove the application_start.sh script from the AppSpec file.

Answer

Reinstall the CodeDeploy agent on all instances.

Question 13

Refer to the exhibit. An IAM policy is attached to an IAM user. Which of the following actions will be allowed by this policy?

Accepted Answer

DescribeInstances on an instance in us-east-1. The Allow statement grants the ec2:DescribeInstances action on all instances. The Deny statement denies all ec2 actions (ec2:*) on instances when the requested region is not us-east-1. Since the request in Option A is for us-east-1, the condition in the Deny statement is false, so the Deny does not apply. Therefore, the Allow stands and DescribeInstances is permitted. Option B (StartInstances) is not explicitly allowed by any statement, and although the Deny does not apply for us-east-1, there is no Allow, so it is implicitly denied. Option C (DescribeInstances in us-west-2) is denied because the region is not us-east-1, triggering the Deny. Option D (StopInstances in us-east-1) is also implicitly denied because no Allow exists for that action.

Answer

StartInstances on an instance in us-east-1

Answer

DescribeInstances on an instance in us-west-2

Answer

StopInstances on an instance in us-east-1

Question 14

A company is using AWS CloudTrail to log API calls across all accounts in AWS Organizations. The security team wants to ensure that CloudTrail logs are not tampered with and are available for forensic analysis. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation.. The correct answers are C (CloudTrail log file validation) and E (server-side encryption with AWS KMS). CloudTrail log file validation provides integrity verification by using a hash of the log file, ensuring logs have not been tampered with. Enabling SSE-KMS protects the log files at rest, adding a layer of security for forensic analysis. Option A (disable public access) is a good security practice but does not directly address tamper resistance or forensic readiness. Option B (MFA delete) adds protection against accidental deletion but is not specifically for log integrity. Option D (AWS Backup) is not supported by CloudTrail for backing up log files.

Answer

Disable public access to the S3 bucket using block public access settings.

Answer

Enable MFA delete on the S3 bucket.

Answer

Use AWS Backup to create backups of the CloudTrail S3 bucket.

Question 15

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

Accepted Answer

The Deny statement's Resource specifies only the objects, not the bucket itself. The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.

Answer

The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'

Answer

The bucket is not versioned, so the policy does not apply to object versions

Answer

The policy uses Deny, but an Allow policy from another statement overrides it

Question 16

An organization uses a multi-account AWS environment with AWS Organizations. During an incident, the security team needs to isolate a compromised account by preventing all API calls from that account's root user and IAM users. Which action should be taken?

Accepted Answer

Apply a service control policy (SCP) that denies all actions to the affected account's root user and all IAM users.. A service control policy (SCP) is a feature of AWS Organizations that allows you to centrally control permissions for all accounts in your organization. An SCP can be applied to the root of the organization, an OU, or a specific account. When an SCP that denies all actions is applied to an affected account, it restricts permissions for all principals, including the root user and IAM users in that account. This effectively isolates the compromised account by preventing any API calls. Option A is incorrect because creating a new IAM group with a deny-all policy and adding all users would affect only IAM users, not the root user. Option C is incorrect because an IAM policy attached to IAM users does not affect the root user. Option D is incorrect because applying an SCP that denies all actions only to the root user would leave IAM users unrestricted, failing to fully isolate the account.

Answer

Create a new IAM group with a deny-all policy and add all users to it.

Answer

Attach an IAM policy denying all actions to all IAM users in that account.

Answer

Apply an SCP that denies all actions to the root user only.

Question 17

An e-commerce application runs on Amazon ECS with Fargate. The operations team notices that the application's latency increases during peak hours. The engineer needs to correlate high CPU usage with increased request latency to identify the root cause. Which approach should be used?

Accepted Answer

Enable Container Insights and ServiceLens to correlate metrics and traces. Container Insights for Amazon ECS with Fargate collects CPU, memory, and other metrics, while ServiceLens integrates CloudWatch metrics with AWS X-Ray traces to provide end-to-end visibility. This correlation allows the engineer to identify high CPU usage and its impact on request latency. Option A is incorrect because CloudWatch Logs Insights only analyzes log data, not metrics or traces. Option C is incorrect because CloudWatch Synthetics canaries monitor endpoint availability and performance from outside, but do not provide internal CPU metrics. Option D is incorrect because setting up a Prometheus server on an EC2 instance adds operational overhead and does not integrate with ECS Fargate natively; Container Insights and ServiceLens are the recommended AWS-native solution.

Answer

Use CloudWatch Logs Insights to query container logs

Answer

Configure CloudWatch Synthetics canaries to measure latency

Answer

Set up a Prometheus server on an EC2 instance to scrape container metrics

Question 18

A company is using AWS Elastic Beanstalk for a production environment. They have observed that during deployments, the environment's health status intermittently becomes 'Severe' even though the application is functioning correctly. The deployment uses rolling updates with a batch size of 50%. Which TWO configuration changes would improve deployment stability without completely redesigning the deployment process? (Select TWO.)

Accepted Answer

Increase the health check interval to allow more time for the application to stabilize.. Increasing the health check interval gives the application more time to stabilize after an update, reducing false 'Severe' health statuses. Option E is correct because decreasing the batch size to 25% reduces the number of instances updated at once, limiting the blast radius of any issues. Option A (switching to immutable updates) changes the deployment strategy, which may not be desired. Option C (increasing batch size to 75%) increases the number of instances updated simultaneously, worsening stability. Option D (decreasing deployment cooldown time) would shorten the wait between batches, not allowing enough time for the application to stabilize, potentially increasing instability.

Answer

Switch from rolling to immutable updates.

Answer

Increase the batch size to 75%.

Answer

Decrease the deployment cooldown time.

Question 19

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline has a Source stage (GitHub), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The deployment fails intermittently with the error: 'Bucket does not allow ACLs'. The S3 bucket is configured to use the 'bucket-owner-enforced' setting for Object Ownership. The team wants to resolve the failure while maintaining security best practices. What should the team do?

Accepted Answer

Update the CodeDeploy deployment action to use a bucket policy and disable ACLs.. The error occurs because the S3 bucket uses the 'bucket-owner-enforced' Object Ownership setting, which disables ACLs. AWS CodeDeploy's default deployment action attempts to set ACLs on deployed objects, causing the failure. The correct solution is option A: configure the CodeDeploy deployment action to use a bucket policy instead of ACLs. This resolves the error while maintaining security best practices by keeping ACLs disabled. Option B (making the bucket public) is insecure. Option C (adding a CodeBuild step) does not address the root cause. Option D (changing Object Ownership to 'ObjectWriter') re-enables ACLs but is not recommended as it weakens ownership control and does not follow current best practices.

Answer

Make the S3 bucket publicly accessible to allow CodeDeploy to write objects.

Answer

Add a step in CodeBuild to copy the artifacts to the S3 bucket using the AWS CLI.

Answer

Change the Object Ownership setting to 'ObjectWriter' to enable ACLs.

Question 20

A company runs a critical application on EC2 instances behind an Application Load Balancer. The application is deployed across three Availability Zones. The DevOps team uses AWS CloudFormation to manage the infrastructure. During a recent deployment, a stack update failed, and the stack entered a ROLLBACK_IN_PROGRESS state. However, the rollback also failed, leaving the stack in UPDATE_ROLLBACK_FAILED state. The engineer needs to restore the application to a working state. The stack includes an Auto Scaling group, an ALB, security groups, and a DynamoDB table. The DynamoDB table is defined with deletion protection enabled. The engineer is considering the following actions: A) ContinueUpdateRollback to retry the rollback, fixing the resource that caused the failure. B) Delete the stack and recreate it from the last known good template. C) Use CloudFormation's 'SignalResource' to manually complete the rollback. D) Manually update the resources to match the previous template, then resume the rollback. Which action should the engineer take?

Accepted Answer

Use ContinueUpdateRollback to retry the rollback after fixing the resource that caused the failure.. ContinueUpdateRollback is the designed CloudFormation operation to retry a failed rollback after fixing the underlying issue, such as DynamoDB deletion protection preventing the table from being deleted during rollback. The engineer can modify the DynamoDB table to disable deletion protection or remove the protection policy, then use ContinueUpdateRollback to complete the rollback. Option A is incorrect because CloudFormation does not support manually updating resources and then resuming rollback; the stack is in a failed state and requires an automated retry. Option C is incorrect because SignalResource is used to signal the creation of resources during a stack operation, not to handle rollback failures. Option D is incorrect because deleting the stack would also attempt to delete the DynamoDB table; despite deletion protection, the deletion may be blocked, causing further failure, and it would also delete other resources, leading to data loss.

Answer

Manually update the resources to match the previous template, then resume the rollback.

Answer

Use CloudFormation's 'SignalResource' to manually complete the rollback.

Answer

Delete the stack and recreate it from the last known good template.