DOP-C02 Multiple Select — 10 Questions

Question 1

A security audit reveals that an S3 bucket contains objects that are publicly accessible. The DevOps engineer must prevent any future public access to the bucket and all objects within it. Which THREE actions should the engineer take? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Block Public Access settings on the bucket.. Enabling block public access settings on the bucket prevents any future public access, including through ACLs or bucket policies. Option C is correct because removing any bucket policy that grants public read access eliminates one potential vector for public access. Option D is correct because applying an SCP that denies s3:PutBucketPolicy actions that would make objects public ensures that no account in the organization can create a policy that grants public access. Option B is incorrect because disabling object ACLs only removes one method of granting public access; bucket policies can still allow public access. Option E is incorrect because enabling server access logging helps with auditing but does not prevent public access.

Answer

Disable object ACLs on the bucket.

Answer

Enable S3 server access logging.

Question 2

A company uses Amazon CloudWatch Logs to store application logs. The DevOps team wants to search across multiple log groups for a specific error pattern. Which TWO options can be used to achieve this? (Choose TWO.)

Accepted Answer

Use CloudWatch Logs Insights to run queries across multiple log groups.. CloudWatch Logs Insights is purpose-built for querying log data across multiple log groups. It uses a query language to search, filter, and aggregate log events, making it ideal for identifying error patterns across different sources. This option is correct because it directly supports cross-log-group queries without additional data movement or infrastructure.

Answer

Install the CloudWatch Logs agent on an EC2 instance and tail the logs.

Answer

Create a Lambda function that reads logs from each log group and searches for the pattern.

Answer

Use Amazon Kinesis Data Analytics to process the log streams.

Question 3

A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)

Accepted Answer

Run Command. Run Command (A) is correct because it allows you to remotely and securely execute scripts or commands across EC2 instances without needing SSH or RDP, using an SSM document (SSM Document) that defines the desired configuration actions. This capability directly enforces a desired state by running idempotent scripts on demand or on a schedule.

Answer

OpsCenter

Answer

Parameter Store

Question 4

A DevOps engineer needs to set up a monitoring solution for an application running on Amazon EKS. The application emits custom metrics that need to be stored in Amazon CloudWatch and visualized on a dashboard. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch agent to emit custom metrics to CloudWatch.. The CloudWatch agent can be configured to emit custom application metrics to Amazon CloudWatch, which is the required destination for storing the metrics. The agent uses the CloudWatch PutMetricData API to send these metrics, enabling centralized monitoring and alerting within CloudWatch.

Answer

Use CloudWatch Logs Insights to analyze the custom metrics.

Answer

Use Amazon Managed Service for Prometheus to scrape the metrics.

Question 5

A company is using Amazon CloudWatch Logs to store application logs. The security team requires that logs are encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Use the CloudWatch Logs console or API to associate the KMS key with the log group. Options A and E are correct. To encrypt CloudWatch Logs with a customer-managed KMS key, you must first create a customer-managed KMS key with a key policy that grants CloudWatch Logs permission to use the key (option E). Then, you associate the key with the log group using the CloudWatch Logs console or API (option A). Option B is wrong because CloudWatch Logs does not support default encryption at the account level. Option C is wrong because you do not update the log group's resource policy; the key policy is set on the KMS key itself. Option D is wrong because encryption is at the log group level, not per log stream.

Answer

Enable default encryption for CloudWatch Logs in the AWS account settings

Answer

Update the log group's resource policy to reference the KMS key

Answer

Associate the KMS key with each log stream individually

Question 6

A company uses Amazon CloudWatch Logs to store application logs. They have a requirement to retain logs for 90 days for operational analysis and then archive them to Amazon S3 for compliance purposes for an additional 5 years. Which of the following steps are necessary to meet this requirement? (Select TWO.)

Accepted Answer

Set the CloudWatch Logs retention policy on the log group to 90 days.. Setting the CloudWatch Logs retention policy on the log group to 90 days ensures logs are retained for operational analysis and then automatically expire (deleted) after 90 days. Option E is correct because to archive logs to Amazon S3 for compliance, you must use a CloudWatch Logs export task to export logs to S3 before the retention period expires. Option B is incorrect because an S3 lifecycle policy applies to objects already in S3, not to logs in CloudWatch. Option C is incorrect because subscription filters can stream logs in real time to destinations like Lambda or Kinesis, but not directly to S3 for archival. Option D is incorrect because CloudWatch Logs does not have a lifecycle policy to transition logs directly to S3; export is required.

Answer

Set an S3 lifecycle policy on the destination bucket to transition objects to Glacier after 90 days.

Answer

Create a CloudWatch Logs subscription filter to stream logs to Amazon S3 in real time.

Answer

Configure a CloudWatch Logs lifecycle policy to transition logs to Amazon S3 after 90 days.

Question 7

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Accepted Answer

Launch the RDS instance in a private subnet.. (launch RDS in a private subnet) and Option D (enable encryption at rest using AWS KMS) are correct best practices for securing an Amazon RDS database. Launching in a private subnet ensures the database is not directly accessible from the internet, enhancing security. Encryption at rest protects data stored on disk. Option A is incorrect because enabling public accessibility increases exposure to attacks. Option B is incorrect because using a single Availability Zone does not enhance security and may reduce availability. Option E is incorrect because direct IAM user access to the database is not a standard practice; RDS uses database authentication, though IAM database authentication can be used, it's not a direct IAM user access and is not a best practice for all scenarios.

Answer

Enable public accessibility for easy management.

Answer

Use a single Availability Zone to reduce complexity.

Answer

Grant direct IAM user access to the database.

Question 8

A company uses Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with 'ClientError' status codes. Which TWO actions should the engineer take to diagnose the issue? (Choose two.)

Accepted Answer

Review the canary's CloudWatch Logs for error details.. CloudWatch Synthetics canaries automatically log execution details, including errors, to CloudWatch Logs. Reviewing these logs provides specific error information, such as 'ClientError' details. Option C is correct because each canary runs as an AWS Lambda function, and the Lambda function's CloudWatch Logs contain runtime logs, including any exceptions or errors thrown during execution. Option A is incorrect because while adding logging could be a long-term improvement, the question asks for diagnostic actions; the canary already logs to CloudWatch Logs, so modifying the script is not necessary for diagnosis. Option D is incorrect because CloudWatch metrics provide aggregate statistics (e.g., success/failure rates) but not detailed error codes or messages. Option E is incorrect because CloudTrail records API calls to create, start, or stop canaries, not the execution details of individual canary runs.

Answer

Modify the canary script to add more logging.

Answer

Examine CloudWatch metrics for the canary.

Answer

Check CloudTrail for CanaryRun API calls.

Question 9

Which TWO AWS services can be used to manage and rotate database credentials automatically? (Select TWO.)

Accepted Answer

AWS Systems Manager Parameter Store. Options A and B are correct. AWS Systems Manager Parameter Store can store database credentials as SecureString parameters, and you can implement automatic rotation using a custom AWS Lambda function. AWS Secrets Manager provides built-in automatic rotation for supported databases (e.g., Amazon RDS, Amazon Redshift) without requiring custom code. Option C (AWS CloudFormation) is an infrastructure-as-code service and does not manage or rotate credentials. Option D (AWS KMS) is a key management service that encrypts data but does not handle credential rotation. Option E (AWS IAM) manages access permissions and roles, not database credentials.

Answer

AWS CloudFormation

Answer

AWS KMS

Answer

AWS IAM

Question 10

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is expected to have unpredictable traffic patterns. The DevOps team needs to ensure that the application can handle sudden spikes in traffic without throttling. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes without requiring capacity planning or throttling. This mode charges per request and can accommodate sudden bursts of traffic up to the table's previous peak, making it ideal for serverless applications with variable workloads.

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.

Answer

Increase the Lambda function timeout to the maximum (15 minutes).

Answer

Set API Gateway throttling limits to a high value to prevent throttling.