DOP-C02 Hard Questions — 25 Difficult Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment fails with a '502 Bad Gateway' error. The developer checks the logs and sees that the application is running but returns errors. The environment uses a load balancer. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application is not binding to the correct port or is crashing under load.. A 502 Bad Gateway error from an Elastic Beanstalk environment with a load balancer typically indicates that the reverse proxy (nginx or Apache) is unable to communicate with the application process. Since the logs show the application is running but returning errors, the most likely cause is that the application is not binding to the correct port (expected port 8080 by default) or is crashing under load, causing the proxy to receive no valid response and return a 502.

Answer

The application source bundle is missing a required file.

Answer

The security group of the environment does not allow inbound HTTP traffic.

Answer

The environment's environment variables are misconfigured.

Question 2

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. During an incident, the API returns 502 Bad Gateway errors. The Lambda function logs show no errors. What is the most likely cause?

Accepted Answer

The Lambda function is returning a response that exceeds the API Gateway payload size limit. When an API Gateway REST API returns 502 Bad Gateway errors but the Lambda function logs show no errors, the most likely cause is that the Lambda function is returning a response that exceeds the API Gateway payload size limit. API Gateway has a maximum payload size of 10 MB for REST APIs, and if the Lambda function returns a response larger than this, API Gateway will reject it and return a 502 error without the Lambda function itself throwing an exception or logging an error.

Answer

The Lambda function is throwing an unhandled exception

Answer

The API Gateway has reached its maximum concurrency limit

Answer

The Lambda function is timing out and API Gateway is not handling the timeout correctly

Question 3

A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?

Accepted Answer

CloudFormation Change Sets. CloudFormation Change Sets allow the DevOps team to preview how proposed changes to a stack will impact running resources before they are executed. This enables a review-and-approval workflow because the change set can be created, reviewed, and then executed only after approval, satisfying the requirement for a change management process.

Answer

CloudFormation StackSets

Answer

CloudFormation Stack Policies

Answer

CloudFormation Drift Detection

Question 4

A company has a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build stage runs unit tests and produces a JUnit report. The pipeline includes a test action that publishes results to an S3 bucket. Recently, the pipeline started failing with the error: 'The action could not be started because the artifact bucket policy is misconfigured.' What is the most likely cause?

Accepted Answer

The artifact bucket's bucket policy does not grant the necessary permissions to the CodePipeline service role.. AWS CodePipeline requires the artifact bucket's bucket policy to grant the CodePipeline service role (or the pipeline's assumed role) permissions to perform actions like s3:GetObject, s3:PutObject, and s3:GetBucketVersioning. When the bucket policy is misconfigured—for example, missing a principal or action—the pipeline's test action cannot start, resulting in the specific error message. This is a common IAM/permissions issue rather than a regional or encryption key problem.

Answer

The S3 bucket has Amazon S3 Transfer Acceleration enabled, which is not supported by CodePipeline.

Answer

The KMS key used to encrypt the bucket objects has been rotated, causing the pipeline to lose access.

Answer

The artifact bucket is in a different AWS Region than the pipeline, and cross-region replication is not enabled.

Question 5

A company is using AWS CodePipeline for CI/CD with CloudFormation as the deployment action. The pipeline fails intermittently with the error 'Rate exceeded' when creating or updating stacks. What is the most likely cause and solution?

Accepted Answer

The CloudFormation API rate limit is being hit; request a limit increase from AWS Support.. The 'Rate exceeded' error is a standard AWS API throttling error, indicating that CloudFormation API requests are being made faster than the account-level or region-level rate limit allows. CodePipeline can trigger multiple concurrent stack operations, especially during parallel stage executions or frequent commits, which can exceed the default CloudFormation API rate limit (e.g., 0.5 requests per second per account per region for CreateStack/UpdateStack). Requesting a limit increase from AWS Support is the correct solution to accommodate higher throughput.

Answer

The stack has a stack policy that prevents updates; modify the stack policy.

Answer

The IAM role used by CloudFormation does not have sufficient permissions; update the role policy.

Answer

The pipeline is exceeding the CodePipeline execution frequency limit; reduce the number of pipeline executions.

Question 6

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting attacks. Which AWS service should be integrated with the ALB?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS traffic. It uses managed rule groups to block common attack patterns like SQL injection (e.g., detecting malicious SQL keywords in query strings) and cross-site scripting (e.g., identifying script tags in user input). This makes it the correct choice for protecting web applications at Layer 7.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Question 7

A company runs a critical batch processing workload on Amazon EMR that must complete within a 2-hour window each night. The workload is fault-tolerant but must be resilient to instance failures. Currently, the EMR cluster uses instance fleets with Spot Instances. Recently, Spot Instance interruptions caused the cluster to take over 3 hours to complete. Which change will MOST effectively ensure the workload completes within the 2-hour window despite Spot interruptions?

Accepted Answer

Use a mixed instances policy that includes multiple instance types across different Availability Zones.. A mixed instances policy across multiple Availability Zones increases the diversity of Spot capacity pools. When one instance type or zone experiences interruptions, the cluster can fall back to other pools, reducing the likelihood of prolonged delays. This approach directly addresses Spot interruption risk without sacrificing cost efficiency, as On-Demand instances would.

Answer

Increase the number of core nodes to 20 to improve parallelism.

Answer

Switch to using On-Demand instances for all nodes.

Answer

Configure the cluster to terminate idle nodes after 5 minutes to reduce costs.

Question 8

A company has a Lambda function that processes sensitive data and needs to access an RDS database. The security team requires that the database credentials are automatically rotated every 30 days. Which service should be used to store and rotate the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like RDS. It supports native, built-in rotation for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) without requiring custom Lambda functions. The automatic rotation can be scheduled at a desired interval (e.g., every 30 days) using a rotation schedule defined in the secret's configuration, and it integrates directly with RDS to update the credentials on both the secret and the database.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS IAM roles

Question 9

Which THREE actions should a DevOps engineer take to ensure that AWS CloudFormation stacks are securely managed? (Choose three.)

Accepted Answer

Use a service role with least privilege when creating the stack.. Using a service role with least privilege ensures that CloudFormation operates with only the permissions necessary to create, update, and delete resources, rather than inheriting the user's broader permissions. This decouples the user's IAM permissions from the stack's runtime actions, reducing the risk of privilege escalation and unintended resource modifications.

Answer

Set a DeletionPolicy on the stack to retain resources when the stack is deleted.

Answer

Define a StackSetPolicy to control permissions across accounts.

Question 10

Which TWO metrics should be monitored in Amazon CloudWatch to detect a potential memory leak in an EC2 instance? (Choose two.)

Accepted Answer

MemoryUtilization (custom metric published via CloudWatch Agent).. MemoryUtilization is a custom metric that must be published via the CloudWatch Agent because EC2 does not expose memory metrics by default. Monitoring this metric over time can reveal a steady upward trend in memory usage that does not drop after processes complete, which is a classic symptom of a memory leak.

Answer

DiskReadOps

Answer

NetworkIn

Answer

CPUUtilization

Question 11

A company uses AWS CodePipeline with a cross-account action where the source account (Account A) triggers a deploy action in a target account (Account B). The pipeline is failing with an 'Access Denied' error when trying to assume the deployment role. What is the MOST likely cause?

Accepted Answer

The KMS key used to encrypt artifacts is not shared with Account B.. In a cross-account CodePipeline setup, if the source account (Account A) uses a KMS key to encrypt artifacts in the S3 bucket, the target account (Account B) must have access to that KMS key to decrypt the artifacts during the deploy action. Without the KMS key being shared via a cross-account key policy that grants the deployment role in Account B the `kms:Decrypt` permission, the pipeline fails with an 'Access Denied' error when attempting to assume the deployment role, because the role assumption process itself may require decrypting pipeline metadata or artifacts.

Answer

The S3 artifact bucket in Account A does not have a bucket policy allowing Account B.

Answer

The deployment role in Account B does not exist.

Answer

The CloudFormation service role in Account B is missing.

Question 12

A company runs a fleet of EC2 instances behind an Auto Scaling group. The DevOps team wants to detect and respond to memory leaks in their application. They have configured CloudWatch agent to collect memory metrics. However, the metric shows unpredictable spikes. The team needs to correlate these spikes with application logs to identify the root cause. Which solution provides the BEST correlation?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns around the time of memory spikes. CloudWatch Logs Insights allows you to query application logs directly in CloudWatch Logs using a purpose-built query language. By filtering logs around the timestamps of memory spikes, you can correlate specific error patterns or log entries with the metric data, enabling root cause analysis without moving data or adding complexity.

Answer

Export the memory metric and application logs to Amazon S3 and use Amazon Athena to join them

Answer

Enable AWS X-Ray on the application to trace requests and identify memory-heavy requests

Answer

Use Amazon EventBridge to capture EC2 instance state changes and correlate with memory spikes

Question 13

A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?

Accepted Answer

The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).. CodeBuild's security group outbound rules must explicitly allow traffic to the RDS security group on the database port (e.g., 3306 for MySQL). Even though CodeBuild runs in a VPC, if the outbound rules are too restrictive, the build agent cannot establish a TCP connection to the RDS instance, causing a timeout. The security group acts as a virtual firewall for the CodeBuild ENI, and without a matching outbound rule, packets are dropped.

Answer

CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.

Answer

The CodeBuild service role does not have rds:Connect permission.

Answer

The RDS instance is in a different subnet CIDR than CodeBuild's subnet.

Question 14

Refer to the exhibit. A CloudFormation template deploys a Lambda function with X-Ray tracing enabled. However, traces are not appearing in the X-Ray console. What is the most likely missing configuration?

Accepted Answer

The Lambda execution role does not have permissions to upload trace data to X-Ray.. For Lambda to send trace data to X-Ray, the function's execution role must include IAM permissions for the X-Ray daemon API calls (xray:PutTraceSegments and xray:PutTelemetryRecords). Even with TracingConfig set to Active and the X-Ray SDK in code, traces won't appear if the execution role lacks these permissions. This is the most common cause of 'tracing enabled but no traces' in Lambda.

Answer

The Lambda runtime (nodejs18.x) does not support X-Ray tracing.

Answer

The TracingConfig mode is set to 'Active' but should be 'PassThrough'.

Answer

The Lambda function code does not use the AWS X-Ray SDK.

Question 15

A company is migrating from Jenkins to AWS CodeBuild. They have hundreds of Jenkins jobs that run on a schedule. Some jobs take hours and must not overlap. What is the most efficient way to migrate these jobs to CodeBuild while ensuring no overlapping builds?

Accepted Answer

Configure the CodeBuild project with a concurrent build limit of 1.. It provides a robust, event-driven mechanism to prevent overlapping builds. By using Amazon CloudWatch Events to trigger a Lambda function that checks the current build status of the CodeBuild project before starting a new build, you can ensure that a new build is only initiated when no other build is running. This approach directly addresses the requirement that some jobs take hours and must not overlap, without relying on fragile timing or configuration limits that may not apply across multiple projects.

Answer

Create a buildspec file that includes a sleep command to stagger start times.

Answer

Set up a separate CodeBuild project for each job and use a custom retry policy.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that checks the build status before starting a new build.

Question 16

A company runs a critical microservices architecture on Amazon ECS with Fargate. They want to ensure that if a task fails, it is automatically restarted, and the service remains available across multiple Availability Zones. How should they configure the ECS service?

Accepted Answer

Define an ECS service with a task definition, set desired count across multiple Availability Zones, and use Service Auto Scaling. An ECS service configured with a task definition, desired count across multiple Availability Zones, and Service Auto Scaling ensures resilience. The ECS service scheduler automatically restarts failed tasks, and distributing tasks across AZs provides high availability. Option A is wrong because placing all tasks in a single AZ creates a single point of failure. Option B is wrong because a standalone Fargate task does not have automatic restart; a CloudWatch alarm can restart it but lacks the built-in resilience of an ECS service. Option C is wrong because using a single EC2 instance is a single point of failure and does not provide multi-AZ resilience.

Answer

Place all tasks in the same Availability Zone to reduce latency

Answer

Run a standalone Fargate task and use a CloudWatch alarm to restart it

Answer

Use an EC2 launch type with a single instance to reduce complexity

Question 17

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline has a source stage from CodeCommit, a build stage that runs 'sam build', and a deploy stage that runs 'sam deploy --no-confirm-changeset'. The deploy stage fails with the error 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used by CodeBuild has expired credentials or insufficient permissions to call AWS CloudFormation.. The error 'The security token included in the request is invalid' indicates that the AWS credentials used by CodeBuild to call the CloudFormation API are either expired or lack the necessary permissions. In a CodePipeline with a CodeBuild action, the build project assumes an IAM role to perform actions such as 'sam deploy', which internally calls CloudFormation. If that IAM role's temporary credentials have expired (e.g., due to a long-running build) or the role does not have the required CloudFormation permissions (e.g., cloudformation:CreateChangeSet, cloudformation:ExecuteChangeSet), the API call will fail with this exact error.

Answer

The CloudFormation stack is in a 'ROLLBACK_COMPLETE' state and cannot be updated.

Answer

The CodeBuild project does not have access to the CodeCommit repository.

Answer

The SAM template is invalid and contains syntax errors.

Question 18

A company has a multi-account strategy using AWS Organizations. The security team needs to respond to incidents across all accounts. They want to ensure that all CloudTrail trails are enabled and logging to a central S3 bucket in the management account. What is the MOST efficient way to monitor compliance?

Accepted Answer

Use AWS Config conformance packs with a managed rule to check CloudTrail is enabled.. AWS Config conformance packs with managed rules can be deployed across multiple accounts using StackSets or directly via AWS Organizations to check that CloudTrail trails are enabled and logging to a central S3 bucket. This provides centralized, automated compliance monitoring without manual per-account setup. Option A is wrong because CloudTrail Insights detects unusual API activity, not configuration compliance. Option C is wrong because setting up CloudWatch Events rules in each account is less efficient and harder to maintain than Config conformance packs. Option D is wrong because Trusted Advisor checks are per-account and cannot be centrally enforced across an organization.

Answer

Create a CloudTrail organization trail and use CloudTrail Insights to detect configuration changes.

Answer

Set up CloudWatch Events rules in each account to detect trail disabling.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration in each account.

Question 19

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

Accepted Answer

You can use AWS Organizations to centrally manage accounts and use StackSets with trusted access.. AWS Organizations can centrally manage accounts, and StackSets can be enabled with trusted access to deploy stacks across accounts. Option D is correct because AWS CloudFormation StackSets allow deploying stacks across multiple accounts. Option B is incorrect because CloudFormation cannot automatically create new AWS accounts. Option C is incorrect because nested stacks operate within a single stack and cannot deploy resources across different accounts from a single template. Option E is incorrect because cross-stack references only work within the same account and region.

Answer

CloudFormation can automatically create new AWS accounts using a template.

Answer

Nested stacks can be used to deploy resources in different accounts from a single template.

Answer

You can use cross-stack references to share resources between accounts.

Question 20

A team uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The deployment fails with an error: 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used in the deploy stage does not have permission to assume the CloudFormation execution role.. The error 'The security token included in the request is invalid' typically occurs when the IAM role used by CodePipeline in the deploy stage lacks the necessary trust relationship or permissions to assume the CloudFormation execution role. In AWS SAM deployments via CodePipeline, the deploy action uses a specified IAM role to call CloudFormation, and if that role cannot assume the CloudFormation service role (or the CloudFormation role itself is misconfigured), the security token becomes invalid. This is a common misconfiguration when the pipeline's IAM role does not include the 'sts:AssumeRole' permission for the CloudFormation execution role ARN.

Answer

The build stage did not produce the correct output artifact.

Answer

The SAM template has a syntax error.

Answer

The 'sam deploy' command is missing the '--capabilities' parameter.