DOP-C02 Multiple Select — 10 Questions

Question 1

A company is migrating a monolithic application to a microservices architecture on Amazon EKS. The application uses a relational database. The team wants to ensure that database connections are managed efficiently and that the database can withstand a sudden spike in connections from multiple microservices. Which solution should the DevOps engineer implement? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy Amazon RDS Proxy in front of the database.. The correct solutions are C, D, and E. Option C (RDS Proxy) pools and shares database connections, reducing the number of connections and handling spikes efficiently. Option D (increase max_connections and enable Auto Scaling) allows the database to accept more connections and scale dynamically during spikes. Option E (connection pool sidecar like PgBouncer) adds connection pooling at the pod level, further managing connections. Option A (direct connections) would increase the number of connections, potentially overwhelming the database. Option B (ElastiCache) is for caching query results, not for managing database connections, and does not address the spike issue.

Answer

Use direct database connections from each microservice pod.

Answer

Use Amazon ElastiCache for Redis to cache database query results.

Question 2

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application generates logs that are sent to Amazon CloudWatch Logs. The DevOps team needs to configure a metric filter to monitor for error patterns and trigger an alarm when the error rate exceeds 5% of total requests over a 5-minute period. Which TWO steps should the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group to count occurrences of the error pattern.. To achieve the monitoring goal, the team must first create a metric filter on the existing log group (Option B). This filter defines the error pattern to count and emits a custom metric for the error count. Then, they need to create a CloudWatch alarm that uses a math expression to calculate the error rate by dividing the error count metric by a total request count metric (or by using the same log group with another filter for total requests) and triggers when the rate exceeds 5% over 5 minutes (Option E). Option A is not required because the log group already exists. Option C is incorrect because a subscription filter would forward logs to Lambda, but the requirement is to use metric filters and alarms. Option D is incorrect because the metric is automatically created by the metric filter; you do not need to manually create a separate metric.

Answer

Create a CloudWatch Logs log group for the error metric.

Answer

Create a CloudWatch Logs subscription filter to stream errors to a Lambda function that calculates the error rate.

Answer

Create a CloudWatch metric for the error count.

Question 3

A company is using AWS CloudTrail to log API calls across all accounts in AWS Organizations. The security team wants to ensure that CloudTrail logs are not tampered with and are available for forensic analysis. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation.. The correct answers are C (CloudTrail log file validation) and E (server-side encryption with AWS KMS). CloudTrail log file validation provides integrity verification by using a hash of the log file, ensuring logs have not been tampered with. Enabling SSE-KMS protects the log files at rest, adding a layer of security for forensic analysis. Option A (disable public access) is a good security practice but does not directly address tamper resistance or forensic readiness. Option B (MFA delete) adds protection against accidental deletion but is not specifically for log integrity. Option D (AWS Backup) is not supported by CloudTrail for backing up log files.

Answer

Disable public access to the S3 bucket using block public access settings.

Answer

Enable MFA delete on the S3 bucket.

Answer

Use AWS Backup to create backups of the CloudTrail S3 bucket.

Question 4

A company's DevOps team is designing an automated incident response workflow using AWS Systems Manager Incident Manager and AWS Lambda. The workflow should automatically acknowledge incidents and send notifications to the appropriate response team. Which TWO actions should the team take to achieve this?

Accepted Answer

Have the Lambda function publish a message to an SNS topic that the response team subscribes to.. The Lambda function can publish a message to an SNS topic, which sends notifications to the response team. Option E is correct because an Amazon EventBridge rule can match Incident Manager events (e.g., incident creation) and trigger the Lambda function to acknowledge the incident and initiate notifications. Option B is incorrect because CloudWatch alarms do not directly invoke Incident Manager; incidents are created through response plans or EventBridge. Option C is incorrect because Incident Manager's built-in 'Acknowledge' and 'Notify' actions are not independent actions; they are part of a response plan, and the question asks for actions to implement the workflow using Lambda. Option D is incorrect because AWS Step Functions is unnecessary overhead for this simple workflow; a direct integration between EventBridge, Lambda, and SNS suffices.

Answer

Configure the CloudWatch alarm to directly invoke the Lambda function for incident creation.

Answer

Use Incident Manager's built-in 'Acknowledge' and 'Notify' actions in a response plan.

Answer

Use AWS Step Functions to orchestrate the Lambda function and SNS topic.

Question 5

A company uses AWS CodeBuild to run tests as part of their CI/CD pipeline. They want to store build artifacts in an S3 bucket and ensure that only the latest successful build artifacts are retained. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure CodeBuild to output artifacts to a specific S3 bucket.. CodeBuild can be configured to output artifacts directly to a specified S3 bucket. Option B is correct because an S3 lifecycle policy can be used to automatically delete old artifacts, ensuring only the latest successful build is retained. Option D is incorrect because enabling versioning would keep all versions, contrary to the requirement of retaining only the latest. Option C is incorrect because CodeCommit is for source code, not build artifacts. Option E is incorrect because CloudWatch Logs store logs, not artifacts.

Answer

Store artifacts in an AWS CodeCommit repository.

Answer

Enable versioning on the S3 bucket to keep all versions.

Answer

Use CloudWatch Logs to store build logs.

Question 6

A company wants to implement a configuration management strategy for their EC2 instances that are part of an Auto Scaling group. They need to ensure that new instances are automatically configured with the latest software packages and settings without manual intervention. Which TWO approaches meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS CodeDeploy with an Auto Scaling lifecycle hook to deploy applications to new instances.. Options B and C are correct. Option B uses AWS CodeDeploy with an Auto Scaling lifecycle hook to automatically deploy applications to new instances as they launch. Option C uses EC2 user data scripts to install software and apply configurations during instance launch. Option A is incorrect because AWS OpsWorks is a configuration management service, but it does not automatically integrate with Auto Scaling groups without additional configuration; it is not the simplest automated approach. Option D is incorrect because AWS Config is used for compliance and auditing, not for proactively configuring instances. Option E is incorrect because AWS Systems Manager Run Command requires manual or scheduled execution and does not automatically run on instance launch.

Answer

Use AWS OpsWorks to manage configurations and associate with the Auto Scaling group.

Answer

Use AWS Config rules to enforce configuration settings.

Answer

Use AWS Systems Manager Run Command on a schedule to apply configurations.

Question 7

Which TWO actions can help protect against accidental deletion of an Amazon S3 bucket? (Select TWO.)

Accepted Answer

Enable MFA Delete on the bucket.. Options C (MFA Delete) and E (bucket policy denying s3:DeleteBucket) are correct. MFA Delete adds an extra layer of protection by requiring multi-factor authentication to permanently delete object versions and change the versioning state, which helps prevent accidental deletions. A bucket policy that explicitly denies the s3:DeleteBucket action directly prevents accidental bucket deletion. Option A is incorrect because versioning alone does not prevent bucket deletion; it protects object versions. Option B is incorrect because CloudTrail provides auditing of delete events but does not prevent them. Option D is incorrect because a lifecycle policy automatically deletes objects, increasing the risk of accidental deletion rather than protecting against it.

Answer

Enable versioning on the bucket.

Answer

Enable AWS CloudTrail to log delete events.

Answer

Configure a lifecycle policy to expire objects.

Question 8

A DevOps engineer is troubleshooting a Lambda function that is timing out. Which TWO actions should the engineer take to diagnose the issue?

Accepted Answer

Increase the function timeout in the Lambda configuration.. Increasing the function timeout allows more time for the function to complete before timing out. Option E is correct because reviewing CloudWatch Logs helps identify timeout errors and execution details. Option A is wrong because setting reserved concurrency to 1 isolates the function but does not diagnose timeout issues. Option C is wrong because VPC configuration can cause network delays but is not a direct diagnostic step for timeout. Option D is wrong because increasing memory allocation may improve performance but does not directly resolve timeouts.

Answer

Set reserved concurrency to 1 to isolate the function.

Answer

Check the VPC configuration for the Lambda function.

Answer

Increase the function memory allocation.

Question 9

A company wants to set up centralized logging for its multi-account AWS environment. The logs include CloudTrail, VPC Flow Logs, and Amazon Route 53 resolver query logs. Which TWO services should they use to achieve this with minimal operational overhead? (Select TWO.)

Accepted Answer

Amazon CloudWatch Logs. (CloudWatch Logs) and Option B (S3) are correct. CloudWatch Logs can aggregate logs from multiple AWS accounts using subscription filters or cross-account log grouping. S3 can serve as a central archive for all log types, including CloudTrail, VPC Flow Logs, and Route 53 resolver query logs, with minimal operational overhead. Option C (Kinesis Data Streams) is unnecessary because it adds complexity as an intermediate stream for this use case. Option D (OpenSearch Service) would require additional setup and management for indexing and visualization, increasing overhead. Option E (CloudTrail) only captures API activity and cannot centralize VPC Flow Logs or Route 53 resolver query logs.

Answer

Amazon Kinesis Data Streams

Answer

Amazon OpenSearch Service

Answer

AWS CloudTrail

Question 10

A company is using AWS Secrets Manager to rotate database credentials automatically. The DevOps engineer needs to ensure that the rotation process is secure and does not cause downtime. Which THREE steps should the engineer take?

Accepted Answer

Set up CloudWatch alarms to monitor rotation failures.. CloudWatch alarms can monitor rotation failures and trigger alerts, ensuring issues are detected promptly. Option C is correct because using a separate database user for rotation allows the old credentials to remain valid while the new ones are being set, preventing downtime during the rotation process. Option E is correct because the Lambda rotation function needs IAM permissions to read and update the secret in Secrets Manager. Option A is incorrect: disabling automatic rotation for the old secret version is unnecessary; Secrets Manager automatically manages version staging during rotation. Option D is incorrect: while the Lambda function must reach Secrets Manager, using a VPC endpoint is not mandatory; the function can access Secrets Manager via the internet or a VPC endpoint, but this is not a required step for secure rotation.

Answer

Disable automatic rotation for the old secret version.

Answer

Configure the Lambda rotation function to use a VPC endpoint for Secrets Manager.