DOP-C02 Multiple Select — 40 Questions

Question 1

A DevOps engineer is writing an AWS CloudFormation template to create a VPC with public and private subnets. The engineer wants to ensure that the private subnets can access the internet through a NAT gateway. Which resources must be included in the template? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS::EC2::RouteTable. A is correct because an AWS::EC2::RouteTable resource is required to define the routing rules for the private subnets. Specifically, you must create a route table for the private subnets and add a default route (0.0.0.0/0) that points to the NAT gateway, enabling outbound internet traffic from instances in the private subnets while blocking inbound traffic from the internet.

Answer

AWS::EC2::VPNGateway

Answer

AWS::EC2::InternetGateway

Answer

AWS::EC2::VPCEndpoint

Question 2

Which THREE actions should a DevOps engineer take to ensure that AWS CloudFormation stacks are securely managed? (Choose three.)

Accepted Answer

Use a service role with least privilege when creating the stack.. Using a service role with least privilege ensures that CloudFormation operates with only the permissions necessary to create, update, and delete resources, rather than inheriting the user's broader permissions. This decouples the user's IAM permissions from the stack's runtime actions, reducing the risk of privilege escalation and unintended resource modifications.

Answer

Set a DeletionPolicy on the stack to retain resources when the stack is deleted.

Answer

Define a StackSetPolicy to control permissions across accounts.

Question 3

Which TWO metrics should be monitored in Amazon CloudWatch to detect a potential memory leak in an EC2 instance? (Choose two.)

Accepted Answer

MemoryUtilization (custom metric published via CloudWatch Agent).. MemoryUtilization is a custom metric that must be published via the CloudWatch Agent because EC2 does not expose memory metrics by default. Monitoring this metric over time can reveal a steady upward trend in memory usage that does not drop after processes complete, which is a classic symptom of a memory leak.

Answer

DiskReadOps

Answer

NetworkIn

Answer

CPUUtilization

Question 4

A company is designing a highly available architecture for a web application that uses Amazon EC2 instances. The application must be resilient to the failure of a single instance and a single Availability Zone. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Use an Auto Scaling group with a minimum of two instances spread across two Availability Zones.. An Auto Scaling group with a minimum of two instances spread across two Availability Zones ensures that if one instance or one entire AZ fails, the remaining instance(s) in the other AZ can continue serving traffic, and Auto Scaling will automatically launch a replacement instance in the healthy AZ to restore the desired count. Option B is correct because distributing EC2 instances across at least two Availability Zones is the fundamental requirement for AZ-level resilience, as it eliminates a single point of failure at the AZ boundary.

Answer

Place all EC2 instances in a single Availability Zone and use a Network Load Balancer.

Answer

Use a single Application Load Balancer in one Availability Zone.

Answer

Use a single large EC2 instance in one Availability Zone.

Question 5

A DevOps engineer is designing an AWS CloudFormation template to deploy a three-tier web application. The application must be highly available across multiple Availability Zones. The engineer needs to ensure that the database layer uses a Multi-AZ deployment. Which TWO options should the engineer implement to meet these requirements? (Choose TWO.)

Accepted Answer

Select a database engine that supports Multi-AZ deployments.. Not all AWS RDS database engines support Multi-AZ deployments; for example, Amazon Aurora uses a different high-availability mechanism (cluster volume) and does not use the standard Multi-AZ feature. The engineer must verify that the chosen engine (e.g., MySQL, PostgreSQL, Oracle, SQL Server) explicitly supports Multi-AZ to enable synchronous standby replication across Availability Zones. Option E is correct because setting the 'MultiAZ' property to 'true' on the 'AWS::RDS::DBInstance' resource directly instructs CloudFormation to provision a primary DB instance in one AZ and a standby in another AZ, with automatic failover.

Answer

Define a separate 'AWS::RDS::DBSubnetGroup' resource with subnets from at least two Availability Zones.

Answer

Deploy the database with multiple read replicas in different Availability Zones.

Answer

Configure the database to use a DB subnet group with subnets in a single Availability Zone.

Question 6

Which TWO tools can be used to manage configuration drift detection for AWS resources? (Choose two.)

Accepted Answer

AWS Config. AWS Config continuously monitors and records AWS resource configurations and can detect changes against desired baselines, enabling drift detection through rules and compliance checks. AWS CloudFormation Drift Detection directly compares the current state of a stack's resources with the expected template-defined state to identify configuration drift. Both tools provide native mechanisms to detect when resources deviate from their intended configuration.

Answer

AWS Systems Manager Inventory

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 7

Which TWO approaches can be used to manage configuration files (e.g., application.properties) across multiple AWS accounts and regions using AWS Systems Manager? (Select TWO.)

Accepted Answer

Use AWS AppConfig to create, manage, and deploy application configurations across accounts and regions.. AWS AppConfig is a feature of AWS Systems Manager that allows you to create, manage, and deploy application configurations across accounts and regions. It supports staged rollouts, validation, and monitoring, making it suitable for managing configuration files like application.properties in multi-account, multi-region environments.

Answer

Use AWS OpsWorks for Chef Automate to store configuration data in Chef data bags.

Answer

Store configuration files in AWS Secrets Manager and retrieve them using the Secrets Manager API.

Answer

Use AWS Systems Manager Run Command to push configuration files to EC2 instances on demand.

Question 8

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

Accepted Answer

You can use AWS Organizations to centrally manage accounts and use StackSets with trusted access.. AWS Organizations can centrally manage accounts, and StackSets can be enabled with trusted access to deploy stacks across accounts. Option D is correct because AWS CloudFormation StackSets allow deploying stacks across multiple accounts. Option B is incorrect because CloudFormation cannot automatically create new AWS accounts. Option C is incorrect because nested stacks operate within a single stack and cannot deploy resources across different accounts from a single template. Option E is incorrect because cross-stack references only work within the same account and region.

Answer

CloudFormation can automatically create new AWS accounts using a template.

Answer

Nested stacks can be used to deploy resources in different accounts from a single template.

Answer

You can use cross-stack references to share resources between accounts.

Question 9

A company uses AWS CodePipeline with a source stage from Amazon S3 and a deploy stage to AWS Elastic Beanstalk. The pipeline has been working for months, but recently the deploy stage started failing with the error 'The S3 object does not exist.' The source artifact is uploaded to the S3 bucket by an external system. Which TWO actions should be taken to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the external system does not overwrite the object after the pipeline execution starts.. The deploy stage fails with 'The S3 object does not exist' when the external system overwrites the source artifact after the pipeline execution starts. CodePipeline references the object by its key at the time the pipeline is triggered; if the object is replaced (i.e., deleted and re-uploaded with the same key), the pipeline may attempt to download a version that no longer exists, especially if the S3 bucket is not versioned. Ensuring the external system does not overwrite the object during execution prevents this race condition.

Answer

Change the source stage to use AWS CodeCommit instead of S3.

Answer

Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Answer

Increase the timeout for the deploy stage in the pipeline.

Question 10

Which THREE actions should a DevOps team take to ensure a CI/CD pipeline using AWS CodePipeline is secure? (Choose three.)

Accepted Answer

Use AWS KMS to encrypt artifacts in the pipeline.. AWS CodePipeline can use AWS KMS customer-managed keys (CMKs) to encrypt artifacts stored in S3 or other supported stores. This ensures that pipeline artifacts are encrypted at rest and in transit, protecting sensitive data from unauthorized access. By default, CodePipeline uses an AWS-managed key, but using a customer-managed KMS key gives the team full control over encryption, key rotation, and access policies.

Answer

Require multi-factor authentication (MFA) for pipeline executions.

Answer

Enable AWS CloudTrail to log pipeline executions.

Question 11

A security engineer is designing a secure VPC architecture for a web application. The application must be isolated from the internet and only accessible through a load balancer. Which TWO actions should the engineer take?

Accepted Answer

Place the EC2 instances in a private subnet with no internet gateway attachment.. Placing EC2 instances in a private subnet without an internet gateway ensures they have no direct path to the internet, meeting the isolation requirement. This forces all traffic to and from the instances to go through the load balancer, which is the only entry point for the application.

Answer

Attach an Internet Gateway to the VPC and route the private subnet to it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic on all ephemeral ports.

Answer

Set up an AWS Direct Connect connection for the instances to access the internet.

Question 12

A DevOps team manages hundreds of EC2 instances using AWS Systems Manager State Manager. They need to ensure that a specific configuration (e.g., a custom firewall rule) is applied to all instances and remains enforced. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Ensure the instances have an IAM role that allows Systems Manager to perform actions.. AWS Systems Manager requires instances to have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) for the SSM Agent to communicate with the Systems Manager service. Without this role, State Manager cannot apply or enforce any configuration, including custom firewall rules.

Answer

Use AWS Config rules to detect non-compliance.

Answer

Use Run Command to execute the configuration once.

Question 13

A DevOps engineer is setting up monitoring for an Amazon DynamoDB table that experiences high read traffic. They want to monitor the read capacity consumption and be alerted when the consumed read capacity exceeds 80% of the provisioned capacity for 5 consecutive minutes. Which TWO steps should they take? (Select TWO.)

Accepted Answer

Use CloudWatch to monitor the ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits metrics.. CloudWatch directly exposes the ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits metrics for DynamoDB, which are the exact metrics needed to calculate read capacity utilization. Monitoring these metrics allows the engineer to track how much of the provisioned capacity is being consumed over time, which is the foundation for setting up the desired alert.

Answer

Enable AWS CloudTrail to log DynamoDB read requests.

Answer

Set up an AWS Lambda function to monitor the DynamoDB ReadThrottleEvents metric.

Answer

Configure DynamoDB to stream all read events to CloudWatch Logs.

Question 14

A company is using AWS Elastic Beanstalk with a custom platform. The DevOps team wants to automate the creation of a new platform version whenever changes are pushed to a Git repository. The pipeline should run tests, build the platform, and then update the Elastic Beanstalk environment to use the new platform version. Which services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can run the tests and build the custom platform artifact. In this scenario, CodeBuild executes the buildspec to compile code, run unit tests, and produce the platform version (e.g., an AMI or Packer image). It integrates directly with CodePipeline to receive source changes and pass artifacts downstream for environment updates.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 15

A company uses AWS CodePipeline to deploy a critical application. The pipeline has a manual approval step before deployment. Which TWO actions should be taken to improve security and auditability? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all approval actions.. Enabling AWS CloudTrail to log all approval actions provides a detailed, immutable audit trail of who approved or rejected a pipeline stage, when it happened, and from which IP address. This is essential for compliance and forensic analysis, as CloudTrail captures the `Approval` API calls made by CodePipeline, including the `approve` and `reject` actions, along with the IAM user or role identity. Without CloudTrail, there is no native logging of manual approval events, making it impossible to prove accountability.

Answer

Remove the approval step and rely on post-deployment monitoring.

Answer

Replace the manual approval with an automated approval based on test results.

Answer

Use a shared IAM user for all approvers to simplify management.

Question 16

A DevOps engineer is designing a secure CI/CD pipeline. Which TWO of the following are best practices for securing secrets in the pipeline?

Accepted Answer

Use encrypted environment variables in CodeBuild.. Options A and E are correct. Option A: CodeBuild allows environment variables to be encrypted using AWS KMS, which is a secure way to handle secrets in the pipeline. Option E: AWS Secrets Manager is a dedicated service for securely storing and retrieving secrets, and integrating it with the pipeline ensures secrets are not exposed. Option B is incorrect because storing secrets in a parameter file in the source repository exposes them to anyone with repository access, violating security best practices. Option C is incorrect because hardcoding secrets in CloudFormation template parameters can lead to exposure in logs or template outputs, and is not secure. Option D is incorrect because while S3 bucket policies can restrict access, they do not encrypt the secrets themselves, and S3 is not designed for managing secrets; AWS Secrets Manager or Parameter Store are better choices.

Answer

Store secrets in a parameter file in the source repository.

Answer

Hardcode secrets in CloudFormation template parameters.

Answer

Use S3 bucket policies to restrict access to secret files.

Question 17

A company uses AWS CodeCommit for source control. Developers need to automatically run tests on every push to a feature branch, but only if the push includes changes to the 'src/' directory. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CodePipeline. AWS CodePipeline can be configured to trigger a pipeline execution when a push occurs to a specific branch in CodeCommit, and it supports path-based filtering using the 'PathFilter' condition in the source action. By combining CodePipeline with AWS Lambda, you can run custom validation logic (e.g., checking if changes are within the 'src/' directory) before invoking further actions like tests. This pair allows you to conditionally run tests only when the push includes changes to 'src/'.

Answer

Amazon CloudWatch Logs

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Question 18

A company uses DynamoDB global tables for a multi-region application. They notice that write conflicts are occurring. Which TWO strategies can reduce write conflicts?

Accepted Answer

Use conditional writes in the application code. Conditional writes prevent overwriting data unless a specified condition is met, thereby reducing write conflicts by ensuring that updates are only applied when the data is in a known state. Application-level conflict resolution allows the application to handle conflicts when they occur, using custom logic to merge or resolve differences, which reduces the impact of conflicts on the database. Option D (increasing write capacity) does not reduce conflicts; it only increases throughput capacity. Option A (reducing read capacity) is unrelated to write conflicts. Option B (DynamoDB Streams with last writer wins) is the default behavior and does not reduce conflicts; it may cause data loss.

Answer

Reduce read capacity units to limit concurrent reads

Answer

Enable DynamoDB Streams with last writer wins

Answer

Increase write capacity units on the table

Question 19

A company runs a critical application on Amazon ECS with Fargate. The application emits structured logs in JSON format. The DevOps team wants to monitor for specific error codes and receive near-real-time alerts. The team also needs to retain logs for 5 years for compliance. Which TWO steps should the team implement?

Accepted Answer

Create a CloudWatch Logs metric filter to count occurrences of specific error codes and create an alarm. CloudWatch Logs metric filters can parse JSON-structured logs to count occurrences of specific error codes, and you can create a CloudWatch alarm on that metric to trigger near-real-time notifications via SNS. This is a native, low-latency solution for monitoring specific patterns in ECS Fargate logs without additional infrastructure.

Answer

Use Amazon Kinesis Data Analytics to analyze logs in real-time and send alerts

Answer

Enable AWS CloudTrail to log the application's API calls

Answer

Stream logs to Amazon S3 via Amazon Kinesis Data Firehose and use S3 event notifications to trigger alerts

Question 20

A company uses AWS CloudFormation to provision infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the stack to change the DB instance class from db.t2.micro to db.t3.medium. Which THREE of the following must be true for the update to succeed? (Choose three.)

Accepted Answer

The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.. CloudFormation stacks in a terminal failure state like ROLLBACK_COMPLETE cannot be updated; they must be deleted and recreated. This is a fundamental constraint of the CloudFormation service, as the stack is considered non-functional and unable to process further operations.

Answer

Deletion protection must be disabled on the DB instance.

Answer

A change set must be created and executed for the update.