DOP-C02 Resilient Cloud Solutions Practice Test 14 — 15 Questions

Question 1

A company is designing a resilient architecture for a web application using AWS Global Accelerator and two Application Load Balancers in different AWS Regions. The application is stateless and uses a global DynamoDB table for data. What is the primary benefit of using Global Accelerator in this architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It provides static IP addresses and automatically routes traffic to the closest healthy ALB, improving availability and performance.. Global Accelerator provides static IP addresses and directs traffic to the nearest healthy endpoint, improving resilience and performance. Option A is wrong because Global Accelerator does not cache content. Option C is wrong because DNS routing is not the primary benefit; Global Accelerator uses anycast. Option D is wrong because Global Accelerator does not replace ALB; it works with ALBs.

Answer

It replaces the need for an Application Load Balancer.

Answer

It provides DNS-based failover between Regions.

Answer

It caches static content at AWS edge locations.

Question 2

A company is designing a disaster recovery plan for a MySQL database running on Amazon RDS. The database is critical and must have an RPO of 5 minutes and an RTO of 1 hour. The primary Region is us-east-1, and the DR Region is us-west-2. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Create a cross-Region read replica in us-west-2.. Option A is correct because a cross-Region read replica continuously replicates data asynchronously from the primary RDS instance in us-east-1 to us-west-2, which can keep the DR copy within the 5-minute RPO requirement. Option D is correct because, during a disaster, the cross-Region read replica must be promoted to a standalone DB instance in us-west-2 so it can accept writes and become the new primary, enabling recovery within the 1-hour RTO. Option B is not correct because a 5-minute backup window does not guarantee a 5-minute RPO; automated backups are periodic snapshots and the backup window only defines when backups occur, not continuous replication. Option C is not correct because cross-Region automated snapshot copy is periodic and typically cannot achieve a 5-minute RPO, and restoring from a snapshot would likely exceed the 1-hour RTO. Option E is not correct because Multi-AZ in us-east-1 only provides high availability within the same Region and does not protect against a Region-wide disaster or provide a DR copy in us-west-2.

Answer

Enable automated backups with a 5-minute backup window.

Answer

Configure cross-Region automated snapshot copy to us-west-2.

Answer

Enable Multi-AZ deployment in us-east-1.

Question 3

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must be resilient to regional outages. Which THREE steps should the company take to achieve multi-Region resilience? (Choose THREE.)

Accepted Answer

Configure Route 53 with a failover routing policy to direct traffic to the secondary Region if the primary fails.. Amazon Route 53 with a failover routing policy allows the company to route traffic to a secondary Region when health checks detect a failure in the primary Region. This provides DNS-level failover, which is a fundamental component of multi-Region resilience for HTTP-based applications.

Answer

Use Amazon CloudFront with multiple origins pointing to each Region's API Gateway.

Answer

Deploy Lambda@Edge functions to handle requests at edge locations.

Question 4

A DevOps engineer ran the above command and saw this output. What is the MOST likely cause of the stack creation failure?

Accepted Answer

The launch template name specified in the CloudFormation template is incorrect or does not exist.. The error message indicates that the launch template name specified in the CloudFormation template does not match any existing launch template in the account and Region. CloudFormation resolves the launch template name at stack creation time; if the name is incorrect or the template does not exist, the Auto Scaling group creation fails with a validation error. This is the most direct cause because the launch template name is a required parameter that must reference a pre-existing resource.

Answer

The key pair specified in the launch template does not exist.

Answer

The IAM role does not have permission to create the Auto Scaling group.

Answer

The AMI ID specified in the launch template is not available in this Region.

Question 5

A DevOps engineer applies this S3 bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All objects uploaded must use server-side encryption with Amazon S3 managed keys (SSE-S3).. The S3 bucket policy in question denies uploads unless the `x-amz-server-side-encryption` header is set to `AES256`, which is the value for SSE-S3 (Amazon S3 managed keys). This ensures that all objects uploaded to the bucket must be encrypted using server-side encryption with S3-managed keys (SSE-S3). Option C correctly identifies this requirement.

Answer

All objects uploaded must be encrypted with SSE-C.

Answer

All uploads to the bucket are blocked.

Answer

All objects uploaded must be encrypted with SSE-KMS.

Question 6

A DevOps engineer runs the above command and sees that instance i-0abcd1234efgh5678 is unhealthy with reason 'Target.Timeout'. The instance is running and the application on port 80 responds to curl from the instance itself. What is the MOST likely cause?

Accepted Answer

The security group for the instance does not allow inbound traffic from the ALB on port 80.. The 'Target.Timeout' health check reason indicates that the load balancer's health check request timed out, meaning it could not establish a connection or receive a response within the timeout period. Since the instance responds to curl locally, the application is running, but the ALB cannot reach it. The most likely cause is that the instance's security group does not allow inbound traffic from the ALB on port 80, blocking the health check requests.

Answer

The ALB health check interval is set too high.

Answer

The web server process is not running on the instance.

Answer

The health check path returns a 404 status code.

Question 7

An e-commerce platform uses Amazon DynamoDB as its primary database. The platform experiences occasional read throttling during flash sales. The operations team needs to ensure that read traffic is handled without errors, while keeping costs low. What should a DevOps engineer recommend?

Accepted Answer

Enable DynamoDB Accelerator (DAX) to cache frequently read data.. DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that reduces read load on the table by serving repeated read requests from cache. During flash sales, read traffic spikes on popular items; DAX absorbs these reads, preventing throttling and improving latency, while keeping costs low because it reduces the need to over-provision read capacity. This is the most cost-effective solution for read-heavy, repetitive access patterns.

Answer

Increase the read capacity units for the table during flash sale events.

Answer

Use DynamoDB Streams to replicate reads to a separate table.

Answer

Implement Global Tables to distribute read traffic across multiple regions.

Question 8

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences intermittent failures when the ECS service scheduler attempts to place tasks during a deployment. The DevOps engineer notices that tasks fail to start due to insufficient IP addresses in the VPC subnets. What is the MOST resilient solution to prevent this issue?

Accepted Answer

Configure the ECS service to use multiple subnets with larger CIDR blocks across multiple Availability Zones.. Using a larger CIDR block for subnets provides more IP addresses, and using multiple subnets across Availability Zones increases availability and capacity. Option A is wrong because increasing desired count does not solve IP shortage. Option B is wrong because ECS service-linked role does not affect IP allocation. Option C is wrong because VPC endpoints do not provide IP addresses for tasks.

Answer

Create an ECS service-linked role with permissions to allocate IPs.

Answer

Increase the desired task count in the ECS service to pre-warm IP addresses.

Answer

Use VPC endpoints for ECS to reduce IP usage.

Question 9

A DevOps engineer is designing a highly available web application using Amazon Route 53. The application is deployed in two AWS Regions. The engineer wants to route traffic to the nearest healthy endpoint. Which routing policy should be used?

Accepted Answer

Latency routing. Latency routing in Amazon Route 53 directs users to the AWS Region that provides the lowest network latency, which matches the requirement to route traffic to the nearest healthy endpoint. Route 53 uses latency measurements between the user and each AWS Region to select the optimal record. Health checks can be associated with latency records to ensure traffic only goes to healthy endpoints.

Answer

Failover routing

Answer

Weighted routing

Answer

Geolocation routing

Question 10

An organization runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that all traffic be encrypted in transit. The security team mandates the use of TLS 1.2 or higher and specific ciphers. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Configure the ALB with a security policy that enforces TLS 1.2 and the required ciphers.. The Application Load Balancer (ALB) supports predefined security policies that enforce TLS version and cipher requirements at the load balancer level, providing centralized control. Option D is correct because configuring the ALB with a security policy that mandates TLS 1.2 and specific ciphers meets the requirement efficiently without modifying individual instances. Option A is incorrect because a Network Load Balancer (NLB) with TLS listeners does not offer the same granular security policy options as ALB and is less efficient for this requirement. Option B is incorrect because CloudFront is a CDN service; placing it in front of the ALB does not directly enforce TLS settings on the ALB itself and adds unnecessary complexity. Option C is incorrect because installing self-signed certificates on each EC2 instance is inefficient, not centralized, and does not enforce consistent TLS version and cipher requirements across all traffic.

Answer

Use a Network Load Balancer with TLS listeners and target groups.

Answer

Place a CloudFront distribution in front of the ALB and configure the origin protocol policy.

Answer

Install a self-signed certificate on each EC2 instance and configure the web server.

Question 11

A company wants to automatically recover an Amazon RDS DB instance if the underlying hardware fails. Which feature should the DevOps engineer enable?

Accepted Answer

Multi-AZ deployment.. Multi-AZ deployment maintains a synchronous standby replica in a different Availability Zone and automatically fails over to it if the primary instance's hardware fails, the AZ becomes unavailable, or the instance is rebooted with failover. This is the only RDS feature designed for automatic hardware-failure recovery with minimal downtime (typically 60–120 seconds). Deletion protection, cross-Region read replicas, and automated backups do not provide automatic failover on hardware failure.

Answer

Deletion protection.

Answer

Read replicas in a different Region.

Answer

Automated backups with a retention period of 35 days.

Question 12

Which TWO strategies can be used to improve the resilience of an application running on Amazon ECS with Fargate? (Select TWO.)

Accepted Answer

Configure the ECS service to place tasks in multiple Availability Zones.. Configuring the ECS service to place tasks in multiple Availability Zones distributes the application across physically separate data centers, so if one AZ fails, the tasks in other AZs continue to run. Option D is correct because implementing a circuit breaker pattern for downstream dependencies prevents cascading failures by detecting faults and failing fast, allowing the system to recover gracefully. Option A is incorrect; using a single subnet for all tasks typically places them in a single Availability Zone, reducing fault tolerance. Option C is incorrect; increasing task memory reservation helps handle peak load but does not improve resilience against failures. Option E is incorrect; scheduled scaling adjusts capacity based on historical patterns and does not handle unexpected spikes or failures.

Answer

Use a single subnet for all tasks to simplify networking.

Answer

Increase the task memory reservation to handle peak load.

Answer

Use scheduled scaling to adjust task count based on historical patterns.

Question 13

Which THREE components are required to implement a global application that can withstand the failure of an entire AWS Region? (Select THREE.)

Accepted Answer

Amazon CloudFront with multiple origins and origin failover.. B is correct because Amazon CloudFront with multiple origins and origin failover automatically routes requests to a healthy origin in another Region when the primary origin becomes unavailable, providing a global entry point that survives a full Region failure. C is correct because DynamoDB Global Tables replicate data across Regions in a multi-active configuration, so the application can continue reading and writing to a replica table in a surviving Region. E is correct because Route 53 health checks detect an unhealthy Region endpoint and the failover routing policy then directs DNS queries to the standby Region's endpoint, enabling regional failover. A is not required because an Application Load Balancer is Region-scoped and cannot by itself provide cross-Region resilience; it would only be part of a single-Region design. D is not required because a single-AZ RDS deployment has no cross-Region (or even cross-AZ) redundancy and would not survive a Region failure.

Answer

An Application Load Balancer in the primary Region.

Answer

Amazon RDS with a single-AZ deployment.

Question 14

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application frequently experiences high latency during peak hours. The DevOps team needs to implement a solution that automatically adds capacity based on demand and reduces cost during off-peak hours. Which combination of AWS services should the team use?

Accepted Answer

Use an AWS Auto Scaling group with target tracking scaling policies based on the ALB's request count per target, and attach it to the ALB target group.. Target tracking scaling policies allow the Auto Scaling group to automatically adjust capacity based on a specific metric, such as ALB request count per target, which directly reflects the load on each instance. This ensures that capacity is added during high latency periods and removed during off-peak hours, optimizing both performance and cost. The ALB target group integration ensures that new instances are automatically registered and start receiving traffic.

Answer

Use an AWS Auto Scaling group with scheduled scaling policies that add instances during known peak hours and remove them during off-peak hours.

Answer

Implement Amazon Route 53 weighted routing policies to distribute traffic to multiple ALBs, each fronting a fixed set of EC2 instances.

Answer

Use an AWS Auto Scaling group with simple scaling policies based on CPU utilization and attach it to the ALB target group.

Question 15

A company is running a production database on Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences a failover due to an AZ outage. What happens to the existing database connections during the failover?

Accepted Answer

Existing connections are dropped, and applications must reconnect to the new primary using the same endpoint.. During an RDS Multi-AZ failover, the DNS CNAME for the DB instance is updated to point to the standby, which is promoted to primary. However, existing TCP connections are severed because the standby has a different IP and the failover breaks the session; applications must reconnect using the same endpoint hostname, which now resolves to the new primary.

Answer

Existing connections are automatically redirected to the standby without interruption.

Answer

The RDS endpoint IP address changes, and the application must update its configuration.

Answer

The primary DB instance is promoted to standby and connections remain active.