DOP-C02 Resilient Cloud Solutions Practice Test 13 — 15 Questions

Question 1

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application frequently experiences high latency during peak hours. The DevOps team needs to implement a solution that automatically adds capacity based on demand and reduces cost during off-peak hours. Which combination of AWS services should the team use?

Accepted Answer

Use an AWS Auto Scaling group with target tracking scaling policies based on the ALB's request count per target, and attach it to the ALB target group.. Option D is correct because target tracking scaling policies allow the Auto Scaling group to automatically adjust capacity based on a specific metric, such as ALB request count per target, which directly reflects the load on each instance. This ensures that capacity is added during high latency periods and removed during off-peak hours, optimizing both performance and cost. The ALB target group integration ensures that new instances are automatically registered and start receiving traffic.

Answer

Use an AWS Auto Scaling group with scheduled scaling policies that add instances during known peak hours and remove them during off-peak hours.

Answer

Implement Amazon Route 53 weighted routing policies to distribute traffic to multiple ALBs, each fronting a fixed set of EC2 instances.

Answer

Use an AWS Auto Scaling group with simple scaling policies based on CPU utilization and attach it to the ALB target group.

Question 2

A company's DevOps team is designing a multi-region disaster recovery solution for a stateless web application. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 region. The team needs to fail over to a secondary region (us-west-2) with minimal downtime in case of a regional outage. Which AWS service should the team use to route traffic to the healthy region?

Accepted Answer

Amazon Route 53 with a failover routing policy and health checks on the primary ALB.. Amazon Route 53 with a failover routing policy and health checks on the primary ALB is correct because it allows DNS-based routing that automatically directs traffic to the secondary region (us-west-2) when the primary ALB in us-east-1 is unhealthy. The health checks monitor the ALB endpoint, and upon failure, Route 53 returns the failover record's IP addresses, enabling multi-region failover with minimal downtime for stateless web applications.

Answer

Elastic Load Balancing (ELB) cross-zone load balancing across regions.

Answer

AWS Global Accelerator with endpoint groups in both regions.

Answer

Amazon CloudFront with a multi-origin setup and origin failover.

Question 3

A company is running a production database on Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences a failover due to an AZ outage. What happens to the existing database connections during the failover?

Accepted Answer

Existing connections are dropped, and applications must reconnect to the new primary using the same endpoint.. Option C is correct. During a Multi-AZ failover, RDS automatically updates the DNS record to point to the standby, but existing connections to the primary are dropped and must be re-established. Option A is wrong because connections are not preserved. Option B is wrong because Multi-AZ automatically fails over without manual promotion. Option D is wrong because the CNAME record does not change; it's a DNS update.

Answer

Existing connections are automatically redirected to the standby without interruption.

Answer

The RDS endpoint IP address changes, and the application must update its configuration.

Answer

The primary DB instance is promoted to standby and connections remain active.

Question 4

A company runs a critical application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. The DevOps team needs to ensure that if an entire Availability Zone fails, the application continues to serve traffic without manual intervention. What should the team do?

Accepted Answer

Configure the ECS service to run tasks in at least two Availability Zones and enable the ECS service auto-recovery feature.. Option C is correct because the ECS service's AZ rebalancing feature automatically redistributes tasks across Availability Zones when an imbalance is detected, such as after an AZ failure. By configuring the service to run tasks in at least two AZs and enabling this feature, the ECS service will automatically launch replacement tasks in the remaining healthy AZs to maintain the desired count, ensuring continued traffic serving without manual intervention.

Answer

Use an Amazon ECS service auto-scaling policy to automatically replace tasks in the failed AZ.

Answer

Configure the ALB to enable cross-zone load balancing and enable the ECS service's AZ rebalancing feature.

Answer

Set the ECS service's minimum healthy percent to 100 and maximum percent to 200.

Question 5

A company uses AWS Lambda functions to process events from an Amazon SQS queue. The Lambda function occasionally fails due to a transient downstream service error. The DevOps team wants to ensure that failed messages are not lost and can be retried later. The team also wants to reduce the number of invocations on the downstream service. Which configuration should the team use?

Accepted Answer

Configure a dead-letter queue (DLQ) on the SQS queue and set the Lambda function's reserved concurrency to 1.. Option A is correct because configuring a dead-letter queue (DLQ) on the SQS queue ensures that messages that exhaust their retries (due to Lambda failures) are preserved for later reprocessing, preventing data loss. Setting the Lambda function's reserved concurrency to 1 throttles the function to a single concurrent invocation, which naturally reduces the rate of downstream service calls and allows the SQS queue's visibility timeout and redrive policy to manage retry timing, thereby reducing pressure on the downstream service.

Answer

Configure an Amazon SNS topic as a Lambda destination for failure events and subscribe the SQS queue to it.

Answer

Configure a dead-letter queue (DLQ) on the Lambda function and set the function's maximum retry attempts to 2.

Answer

Configure the Lambda function to write failed messages to an Amazon DynamoDB table and set up a scheduled Lambda to retry.

Question 6

A company is designing a highly available architecture for a web application. The application runs on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The instances are behind an Application Load Balancer (ALB). Which additional step should the team take to ensure that traffic is evenly distributed across all healthy instances in all Availability Zones?

Accepted Answer

Enable cross-zone load balancing on the ALB.. Option C is correct. By default, ALB distributes traffic evenly across AZs, but cross-zone load balancing must be enabled to distribute traffic evenly across all instances regardless of AZ. Option A is wrong because ALB already distributes traffic across AZs. Option B is wrong because Route 53 is not needed for internal distribution. Option D is wrong because target group health checks are already enabled.

Answer

Use Amazon Route 53 weighted routing policy to distribute traffic to each AZ.

Answer

Configure health checks on the target group to mark instances as unhealthy if they are in an AZ with fewer instances.

Answer

Configure the ALB to use least outstanding requests routing algorithm.

Question 7

A company is running a stateful web application on Amazon EC2 instances. The application stores session data locally on the instance. The company wants to make the application stateless and improve resilience. The DevOps team decides to use Amazon ElastiCache for Redis to store session data. What additional step should the team take to ensure that the session data is highly available?

Accepted Answer

Enable ElastiCache for Redis cluster mode with automatic failover across multiple Availability Zones.. Option B is correct. Enabling ElastiCache for Redis cluster mode with automatic failover ensures that if the primary node fails, a read replica is promoted, providing high availability. Option A is wrong because Multi-AZ for ElastiCache is for replication groups, not cluster mode. Option C is wrong because backing up to S3 does not provide automatic failover. Option D is wrong because manually promoting a replica is not automatic.

Answer

Deploy ElastiCache for Redis in a Multi-AZ configuration with automatic failover.

Answer

Use a single ElastiCache for Redis node and rely on the application to reconnect if the node fails.

Answer

Configure ElastiCache for Redis to back up session data to Amazon S3 every 5 minutes.

Question 8

A company runs a microservices application on Amazon EKS. The application's frontend service needs to communicate with the backend service. The DevOps team wants to implement service-to-service authentication using AWS IAM. Which method should the team use?

Accepted Answer

Use IAM roles for service accounts (IRSA) to associate an IAM role with each service's Kubernetes service account.. IAM roles for service accounts (IRSA) allows each Kubernetes service account to assume an IAM role with fine-grained permissions, enabling secure service-to-service authentication without managing long-lived credentials. The frontend service can use its associated IAM role to sign AWS API requests (e.g., STS AssumeRole) to authenticate to the backend service, which validates the role via IAM policies. This approach integrates natively with EKS and follows AWS best practices for workload identity.

Answer

Configure the backend service as an Amazon RDS database with IAM database authentication.

Answer

Use AWS App Mesh with mTLS for authentication between services.

Answer

Create an IAM user with access keys and store them as Kubernetes secrets.

Question 9

A company has an Amazon S3 bucket that stores critical data. The company wants to protect the data from accidental deletion and ensure that even the root user cannot delete the bucket. Which S3 feature should the company enable?

Accepted Answer

S3 Object Lock with compliance retention mode.. Option C is correct because S3 Object Lock with compliance retention mode prevents any user, including the root user, from deleting or overwriting objects until the retention period expires. Compliance mode applies a strict, immutable lock that cannot be removed or shortened by any user, including the AWS account root user, ensuring the data is protected against accidental or malicious deletion.

Answer

S3 bucket policy that denies s3:DeleteBucket for all principals.

Answer

S3 bucket versioning with MFA delete.

Answer

S3 bucket versioning with lifecycle policy to expire noncurrent versions.

Question 10

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application generates logs that are sent to Amazon CloudWatch Logs. The DevOps team needs to configure a metric filter to monitor for error patterns and trigger an alarm when the error rate exceeds 5% of total requests over a 5-minute period. Which TWO steps should the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group to count occurrences of the error pattern.. Options A and D are correct. A metric filter on the log group creates a custom metric for the error count. The alarm then uses that metric and the math expression to calculate the error rate. Option B is wrong because creating a log group is not the step; the filter is on an existing log group. Option C is wrong because you create a metric filter, not a metric. Option E is wrong because CloudWatch Logs does not directly create a metric for error rate; you need a filter and alarm.

Answer

Create a CloudWatch Logs log group for the error metric.

Answer

Create a CloudWatch Logs subscription filter to stream errors to a Lambda function that calculates the error rate.

Answer

Create a CloudWatch metric for the error count.

Question 11

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is expected to have unpredictable traffic patterns. The DevOps team needs to ensure that the application can handle sudden spikes in traffic without throttling. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. Option A is correct because DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes without requiring capacity planning or throttling. This mode charges per request and can accommodate sudden bursts of traffic up to the table's previous peak, making it ideal for serverless applications with variable workloads.

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.

Answer

Increase the Lambda function timeout to the maximum (15 minutes).

Answer

Set API Gateway throttling limits to a high value to prevent throttling.

Question 12

A company is deploying a web application on Amazon ECS with Fargate. The application consists of a frontend service and a backend service. The DevOps team needs to ensure that the frontend service can communicate with the backend service securely without exposing the backend to the internet. Which THREE steps should the team take? (Choose THREE.)

Accepted Answer

Deploy the backend service in a private subnet with no internet access.. Option A is correct because deploying the backend service in a private subnet with no internet access ensures that the backend is not reachable from the internet, which is a fundamental security requirement. In Amazon ECS with Fargate, tasks in a private subnet use an elastic network interface (ENI) with no public IP address, and outbound traffic can be routed through a NAT gateway if needed, but inbound traffic from the internet is blocked. This isolates the backend from direct external exposure while still allowing communication from the frontend service within the same VPC.

Answer

Deploy the backend service in a public subnet with an internet-facing Application Load Balancer.

Answer

Use an internet-facing Network Load Balancer for the backend service.

Question 13

An AWS account owner (Account A) owns an S3 bucket named my-bucket. The bucket policy shown in the exhibit is attached to the bucket. A user from Account B attempts to upload an object to the bucket without specifying the x-amz-acl header. What will happen?

Accepted Answer

The upload fails because the bucket policy requires the x-amz-acl header to be set to bucket-owner-full-control.. Option D is correct. The condition requires the x-amz-acl header to be set to bucket-owner-full-control. If the header is not specified, the condition fails, and the request is denied. Option A is wrong because the condition is not met. Option B is wrong because the policy does not grant permission without the header. Option C is wrong because the bucket policy evaluates before the object ACL.

Answer

The upload fails because the bucket policy requires the object ACL to be set, but the default ACL allows the upload anyway.

Answer

The upload succeeds because the bucket policy does not explicitly deny the request.

Answer

The upload succeeds because the bucket policy allows s3:PutObject for any principal.

Question 14

A DevOps engineer runs the above command and sees that one target is unhealthy with reason 'Target.Timeout'. The target is an EC2 instance running a web server on port 80. The security group for the instance allows inbound traffic on port 80 from the ALB's security group. What is the most likely cause of the health check failure?

Accepted Answer

The web server on the instance is not responding to health check requests on port 80.. Option B is correct. The 'Target.Timeout' reason indicates that the health check request timed out, meaning the instance is not responding within the timeout period. The most common cause is that the web server is not running or is not listening on the correct port. Option A is wrong because the security group already allows traffic from the ALB. Option C is wrong because the health check is from the ALB, not the internet. Option D is wrong because the health check is to the instance's IP, not a public IP.

Answer

The instance does not have a public IP address.

Answer

The instance's network ACL is blocking inbound traffic from the internet.

Answer

The security group for the ALB does not allow outbound traffic to the instance.

Question 15

A DevOps team uses the above CloudFormation template to create an S3 bucket. What does the bucket policy accomplish?

Accepted Answer

It denies all S3 operations on the bucket unless the request uses HTTPS.. Option B is correct. The policy denies all S3 actions on the bucket objects if the request is not sent over HTTPS (SecureTransport false). This enforces encryption in transit. Option A is wrong because it denies all actions, not just read. Option C is wrong because it denies only when not using HTTPS. Option D is wrong because the policy denies all actions, not just delete.

Answer

It denies all read access to the bucket for anonymous users.

Answer

It prevents anyone from deleting objects in the bucket.

Answer

It allows only HTTPS requests to the bucket and denies all HTTP requests.