DOP-C02 Quick Quiz — 10 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. They want to receive notifications when a stack operation fails, including the specific resource that caused the failure. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack and subscribe to receive stack events.. CloudFormation allows you to specify an SNS topic ARN as a notification option when creating or updating a stack. When a stack operation fails, CloudFormation publishes a notification to that SNS topic, and the notification includes the logical resource ID and the status reason for the failure. This provides real-time, event-driven notifications without requiring polling or additional services.

Answer

Create a CloudWatch alarm on the 'StackFailure' metric.

Answer

Create an AWS Lambda function that polls the CloudFormation DescribeStackEvents API every minute and sends an email on failure.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and configure an SNS notification on the trail.

Question 2

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

Accepted Answer

The Deny statement's Resource specifies only the objects, not the bucket itself. The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.

Answer

The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'

Answer

The bucket is not versioned, so the policy does not apply to object versions

Answer

The policy uses Deny, but an Allow policy from another statement overrides it

Question 3

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

Accepted Answer

Define environment variables in the source code using .ebextensions configuration files.. Ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Answer

Update the environment variables manually in the Elastic Beanstalk console after each deployment.

Answer

Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.

Answer

Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.

Question 4

A company runs a containerized microservices application on Amazon EKS. The application includes a critical service that processes real-time financial transactions. This service must be highly available and resilient to node failures. The current setup uses a Deployment with 3 replicas and a ClusterIP service. During a recent node failure, the application experienced a brief period of unavailability. Which action should the DevOps engineer take to improve resilience without changing the underlying infrastructure?

Accepted Answer

Configure a PodDisruptionBudget with a maxUnavailable of 1, and add pod anti-affinity rules to spread pods across different nodes.. A PodDisruptionBudget with maxUnavailable=1 ensures that at most one pod is unavailable during voluntary disruptions, while pod anti-affinity rules force the scheduler to distribute pods across different nodes. This combination prevents a single node failure from taking down all replicas, maintaining service availability without altering the underlying infrastructure.

Answer

Change the service type from ClusterIP to NodePort and configure an external load balancer.

Answer

Increase the number of replicas to 10 and use a node selector to schedule all pods on the largest instance type.

Answer

Enable HorizontalPodAutoscaler with a target CPU utilization of 50% to automatically scale the Deployment.

Question 5

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that critical resources, such as an RDS database, are not accidentally deleted when a stack is updated or deleted. Which CloudFormation feature should be used to prevent this?

Accepted Answer

DeletionPolicy attribute with Retain. The DeletionPolicy attribute with the Retain value is the correct choice because it explicitly instructs CloudFormation to preserve the physical resource (e.g., an RDS database) when its corresponding logical resource is deleted from the stack template during an update or when the entire stack is deleted. This prevents accidental deletion of critical stateful resources by ensuring the resource remains in the AWS account even after the stack operation completes.

Answer

Stack policy

Answer

Termination protection

Answer

DependsOn attribute

Question 6

A company is migrating its on-premises applications to AWS and wants to maintain the same level of monitoring for its Linux-based EC2 instances. They currently use Nagios for monitoring. They want a managed AWS service that can monitor instance health, system metrics, and application logs. Which solution should they use?

Accepted Answer

Install the Amazon CloudWatch agent on each EC2 instance to collect system metrics and logs, and send them to CloudWatch.. The Amazon CloudWatch agent (unified CloudWatch agent) can collect system metrics (CPU, memory, disk) and logs from EC2 instances and send them to CloudWatch, providing a managed monitoring solution similar to Nagios. Option B is incorrect because AWS CloudTrail is for auditing API calls, not for monitoring system metrics or logs. Option C is incorrect because AWS Systems Manager Inventory collects software inventory and configuration data, not real-time metrics or logs. Option D is incorrect because AWS Config tracks resource configuration changes for compliance, not for monitoring system health.

Answer

Use AWS CloudTrail to monitor instance activity and capture log files.

Answer

Use AWS Systems Manager Inventory to collect system configuration and log files.

Answer

Use AWS Config to track instance configuration changes and trigger alerts.

Question 7

A security audit reveals that an S3 bucket contains objects that are publicly accessible. The DevOps engineer must prevent any future public access to the bucket and all objects within it. Which THREE actions should the engineer take? (Choose THREE.)

Accepted Answer

Enable Block Public Access settings on the bucket.. Enabling block public access settings on the bucket prevents any future public access, including through ACLs or bucket policies. Option C is correct because removing any bucket policy that grants public read access eliminates one potential vector for public access. Option D is correct because applying an SCP that denies s3:PutBucketPolicy actions that would make objects public ensures that no account in the organization can create a policy that grants public access. Option B is incorrect because disabling object ACLs only removes one method of granting public access; bucket policies can still allow public access. Option E is incorrect because enabling server access logging helps with auditing but does not prevent public access.

Answer

Disable object ACLs on the bucket.

Answer

Enable S3 server access logging.

Question 8

A company's DevOps team is designing a disaster recovery plan for a critical application. The application runs on EC2 instances with an RDS MySQL database. The Recovery Time Objective (RTO) is 15 minutes, and the Recovery Point Objective (RPO) is 1 hour. Which approach BEST meets these requirements?

Accepted Answer

Use a multi-Region application with Route 53 latency-based routing and RDS read replicas in the DR Region.. The best approach for a multi-Region disaster recovery with RTO of 15 minutes and RPO of 1 hour. By deploying the application in multiple regions and using RDS cross-Region read replicas, data is asynchronously replicated with an RPO typically within seconds to minutes, well within 1 hour. In the event of a failure, the read replica can be promoted to a primary instance, and Route 53 routing (preferably failover routing, but latency-based routing can also redirect traffic) can shift traffic to the DR region. This failover can be completed within a few minutes, meeting the 15-minute RTO. Option A fails because daily snapshots exceed the 1-hour RPO and restore times exceed the RTO. Option C incorrectly relies on RDS Multi-AZ, which is a single-region high-availability feature and does not provide cross-region replication; thus it cannot serve as a disaster recovery solution across regions. Option D, pilot light with snapshots, has a longer RTO as it requires restoring instances from snapshots and starting them, likely exceeding 15 minutes.

Answer

Use backup and restore with daily snapshots stored in S3 and cross-Region replication.

Answer

Use a warm standby strategy with a scaled-down copy of the production environment in the DR Region, and replicate data using RDS Multi-AZ with synchronous replication.

Answer

Use a pilot light strategy with EC2 instances stopped and RDS snapshots copied to the DR Region.

Question 9

Refer to the exhibit. A DevOps engineer is troubleshooting an issue where an IAM user is unable to stop an EC2 instance with the tag 'Environment: Development'. The attached IAM policy is shown. Which statement explains the failure?

Accepted Answer

The Allow statement only grants ec2:DescribeInstances, not start/stop.. The IAM policy in the exhibit only grants ec2:DescribeInstances and explicitly denies ec2:RunInstances with a condition. It does not include an Allow for ec2:StopInstances. By default, IAM denies any action that is not explicitly allowed. Therefore, the user lacks permission to stop instances, including the Development-tagged instance. Option C correctly identifies this as the reason for the failure. Option D is incorrect because the policy itself denies stop implicitly due to the missing Allow; it is not necessary to invoke another policy or SCP.

Answer

The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.

Answer

The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.

Answer

The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?

Accepted Answer

Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.. AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.

Answer

Use IAM Access Analyzer to validate the roles against a policy template.

Answer

Run AWS Trusted Advisor and check the IAM report for roles with long session durations.

Answer

Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.