DOP-C02 Resilient Cloud Solutions Practice Test 15 — 15 Questions

Question 1

A company uses AWS Lambda functions to process events from an Amazon SQS queue. The Lambda function occasionally fails due to a transient downstream service error. The DevOps team wants to ensure that failed messages are not lost and can be retried later. The team also wants to reduce the number of invocations on the downstream service. Which configuration should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a dead-letter queue (DLQ) on the SQS queue and set the Lambda function's reserved concurrency to 1.. Configuring a dead-letter queue (DLQ) on the SQS queue ensures that messages that exhaust their retries (due to Lambda failures) are preserved for later reprocessing, preventing data loss. Setting the Lambda function's reserved concurrency to 1 throttles the function to a single concurrent invocation, which naturally reduces the rate of downstream service calls and allows the SQS queue's visibility timeout and redrive policy to manage retry timing, thereby reducing pressure on the downstream service.

Answer

Configure an Amazon SNS topic as a Lambda destination for failure events and subscribe the SQS queue to it.

Answer

Configure a dead-letter queue (DLQ) on the Lambda function and set the function's maximum retry attempts to 2.

Answer

Configure the Lambda function to write failed messages to an Amazon DynamoDB table and set up a scheduled Lambda to retry.

Question 2

A company is designing a highly available architecture for a web application. The application runs on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The instances are behind an Application Load Balancer (ALB). Which additional step should the team take to ensure that traffic is evenly distributed across all healthy instances in all Availability Zones?

Accepted Answer

Enable cross-zone load balancing on the ALB.. By default, ALB distributes traffic evenly across AZs, but cross-zone load balancing must be enabled to distribute traffic evenly across all instances regardless of AZ. Option A is wrong because Route 53 weighted routing is not needed for internal load balancing; the ALB already distributes traffic across AZs. Option B is wrong because configuring health checks to mark instances unhealthy based on AZ instance count would not help with even distribution and could cause unnecessary failures. Option D is wrong because the least outstanding requests routing algorithm optimizes for request queue depth but does not enable cross-zone load balancing; cross-zone load balancing must be explicitly enabled.

Answer

Use Amazon Route 53 weighted routing policy to distribute traffic to each AZ.

Answer

Configure health checks on the target group to mark instances as unhealthy if they are in an AZ with fewer instances.

Answer

Configure the ALB to use least outstanding requests routing algorithm.

Question 3

A company runs a microservices application on Amazon EKS. The application's frontend service needs to communicate with the backend service. The DevOps team wants to implement service-to-service authentication using AWS IAM. Which method should the team use?

Accepted Answer

Use IAM roles for service accounts (IRSA) to associate an IAM role with each service's Kubernetes service account.. IAM roles for service accounts (IRSA) allows each Kubernetes service account to assume an IAM role with fine-grained permissions, enabling secure service-to-service authentication without managing long-lived credentials. The frontend service can use its associated IAM role to sign AWS API requests (e.g., STS AssumeRole) to authenticate to the backend service, which validates the role via IAM policies. This approach integrates natively with EKS and follows AWS best practices for workload identity.

Answer

Configure the backend service as an Amazon RDS database with IAM database authentication.

Answer

Use AWS App Mesh with mTLS for authentication between services.

Answer

Create an IAM user with access keys and store them as Kubernetes secrets.

Question 4

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application generates logs that are sent to Amazon CloudWatch Logs. The DevOps team needs to configure a metric filter to monitor for error patterns and trigger an alarm when the error rate exceeds 5% of total requests over a 5-minute period. Which TWO steps should the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group to count occurrences of the error pattern.. Option B is correct because a CloudWatch Logs metric filter is the mechanism that scans log events in a log group for a specified pattern (for example, "ERROR") and increments a custom metric each time the pattern matches, which is exactly how the error count is derived from the application logs. Option E is correct because the requirement is an error rate (a percentage), not a raw count, so the alarm must use a CloudWatch metric math expression that divides the error-count metric by the total-request-count metric and compares the result against the 5% threshold over the 5-minute evaluation period. Option A is not needed because metric filters are applied to an existing log group that already receives the application logs; you do not create a separate log group for the metric. Option C is wrong because subscription filters stream log data to destinations such as Lambda or Kinesis for real-time processing, which is unnecessary when CloudWatch metric filters and metric math can compute the rate natively. Option D is wrong because the metric is created automatically by the metric filter defined in Option B, so a separate manual metric creation step is redundant.

Answer

Create a CloudWatch Logs log group for the error metric.

Answer

Create a CloudWatch Logs subscription filter to stream errors to a Lambda function that calculates the error rate.

Answer

Create a CloudWatch metric for the error count.

Question 5

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is expected to have unpredictable traffic patterns. The DevOps team needs to ensure that the application can handle sudden spikes in traffic without throttling. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes without requiring capacity planning or throttling. This mode charges per request and can accommodate sudden bursts of traffic up to the table's previous peak, making it ideal for serverless applications with variable workloads.

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.

Answer

Increase the Lambda function timeout to the maximum (15 minutes).

Answer

Set API Gateway throttling limits to a high value to prevent throttling.

Question 6

A company is deploying a web application on Amazon ECS with Fargate. The application consists of a frontend service and a backend service. The DevOps team needs to ensure that the frontend service can communicate with the backend service securely without exposing the backend to the internet. Which THREE steps should the team take? (Choose THREE.)

Accepted Answer

Deploy the backend service in a private subnet with no internet access.. Deploying the backend service in a private subnet with no internet access ensures that the backend is not reachable from the internet, which is a fundamental security requirement. In Amazon ECS with Fargate, tasks in a private subnet use an elastic network interface (ENI) with no public IP address, and outbound traffic can be routed through a NAT gateway if needed, but inbound traffic from the internet is blocked. This isolates the backend from direct external exposure while still allowing communication from the frontend service within the same VPC.

Answer

Deploy the backend service in a public subnet with an internet-facing Application Load Balancer.

Answer

Use an internet-facing Network Load Balancer for the backend service.

Question 7

An AWS account owner (Account A) owns an S3 bucket named my-bucket. The bucket policy shown in the exhibit is attached to the bucket. A user from Account B attempts to upload an object to the bucket without specifying the x-amz-acl header. What will happen?

Accepted Answer

The upload fails because the bucket policy requires the x-amz-acl header to be set to bucket-owner-full-control.. The condition requires the x-amz-acl header to be set to bucket-owner-full-control. If the header is not specified, the condition fails, and the request is denied. Option A is wrong because the condition is not met. Option B is wrong because the policy does not grant permission without the header. Option C is wrong because the bucket policy evaluates before the object ACL.

Answer

The upload fails because the bucket policy requires the object ACL to be set, but the default ACL allows the upload anyway.

Answer

The upload succeeds because the bucket policy does not explicitly deny the request.

Answer

The upload succeeds because the bucket policy allows s3:PutObject for any principal.

Question 8

A DevOps engineer runs the above command and sees that one target is unhealthy with reason 'Target.Timeout'. The target is an EC2 instance running a web server on port 80. The security group for the instance allows inbound traffic on port 80 from the ALB's security group. What is the most likely cause of the health check failure?

Accepted Answer

The web server on the instance is not responding to health check requests on port 80.. The 'Target.Timeout' reason indicates that the health check request timed out, meaning the instance is not responding within the timeout period. The most common cause is that the web server is not running or is not listening on the correct port. Option C is correct because a non-responsive web server on port 80 would cause the timeout. Option A is incorrect because health checks are performed over private IPs, not public IPs. Option B is incorrect because the network ACL applies at the subnet level and would affect all traffic; the ALB's security group is already allowed inbound, and the instance's security group allows inbound from the ALB. Option D is incorrect because the ALB's security group does not need to allow outbound to the instance; traffic flows from the ALB to the instance, and the instance's security group must allow inbound from the ALB.

Answer

The instance does not have a public IP address.

Answer

The instance's network ACL is blocking inbound traffic from the internet.

Answer

The security group for the ALB does not allow outbound traffic to the instance.

Question 9

A DevOps team uses the above CloudFormation template to create an S3 bucket. What does the bucket policy accomplish?

Accepted Answer

It denies all S3 operations on the bucket unless the request uses HTTPS.. The bucket policy uses a Deny effect with a condition that the request must use HTTPS (SecureTransport: false). This denies all S3 operations on the bucket unless the request is sent over HTTPS. Option B is incorrect because the policy does not target anonymous users specifically; it applies to all principals. Option C is incorrect because the policy denies all actions, not just delete. Option D is incorrect because it allows HTTP requests when the condition is not met, but the Deny overrides; the policy explicitly denies non-HTTPS requests.

Answer

It denies all read access to the bucket for anonymous users.

Answer

It prevents anyone from deleting objects in the bucket.

Answer

It allows only HTTPS requests to the bucket and denies all HTTP requests.

Question 10

A company runs a web application on EC2 instances behind an ALB. To improve resilience, they want to automatically replace failed instances and maintain a minimum number of instances. Which AWS service should be used?

Accepted Answer

Amazon EC2 Auto Scaling. Amazon EC2 Auto Scaling is purpose-built to maintain a desired/minimum number of instances and automatically replace unhealthy ones via health checks integrated with ELB. It continuously monitors instance health and launches replacements when instances fail, ensuring the minimum capacity is preserved. This directly satisfies the resilience requirement without manual intervention.

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Answer

AWS Systems Manager

Question 11

A company uses AWS Lambda functions to process events from Amazon SQS. The Lambda function sometimes fails due to timeouts. The team wants to preserve the event for reprocessing. How should they configure the integration?

Accepted Answer

Set up a DLQ on the SQS queue that receives the events. By configuring a dead-letter queue (DLQ) on the SQS queue, failed messages are preserved for later reprocessing.

Answer

Use Lambda reserved concurrency

Answer

Enable Lambda function DLQ with SNS topic

Answer

Increase Lambda timeout to maximum

Question 12

An application on EC2 instances in an Auto Scaling group uses an ALB. The ALB health checks are failing for some instances, but the instances are healthy from the OS perspective. What is the most likely cause?

Accepted Answer

The security group for the instances does not allow traffic from the ALB. ALB health checks originate from the ALB's nodes and require the instance's security group to permit inbound traffic on the health check port and protocol from the ALB's security group. If the security group does not allow this traffic, the health check fails even though the OS and application are healthy. This is the most common cause of ALB health check failures when instances are otherwise reachable.

Answer

The ALB idle timeout is too low

Answer

The Auto Scaling group cooldown period is too short

Answer

The ALB cross-zone load balancing is disabled

Question 13

A company is building a global application that requires low-latency access to static content across multiple AWS Regions. The content changes infrequently. Which solution is MOST resilient and cost-effective?

Accepted Answer

Use Amazon CloudFront with an S3 bucket as origin. Amazon CloudFront with an S3 bucket as origin provides low-latency global content delivery by caching static content at edge locations worldwide. It is highly resilient because CloudFront automatically routes around failures, and cost-effective since it reduces load on origin and data transfer costs.

Answer

Use Amazon S3 Transfer Acceleration

Answer

Set up a VPN to a single Region

Answer

Deploy EC2 instances in each Region with a global load balancer

Question 14

A company wants to ensure its Amazon RDS DB instance is highly available with automatic failover in case of an AZ failure. Which configuration should they use?

Accepted Answer

Multi-AZ deployment. Amazon RDS Multi-AZ deployments maintain a synchronous standby replica in a different Availability Zone and automatically fail over to it if the primary fails, providing high availability with minimal downtime. The DNS endpoint remains the same, so applications reconnect without configuration changes. This is the standard AWS-recommended configuration for HA with automatic failover.

Answer

Amazon RDS Proxy

Answer

Single-AZ with automated backups

Answer

Read replicas in multiple AZs

Question 15

A company runs a stateful application on EC2 instances. The application stores session data locally. The instances are behind an ALB with sticky sessions enabled. A scaling event terminates an instance, causing loss of session data. How can the company prevent this while maintaining performance?

Accepted Answer

Use Amazon ElastiCache to store session data. Storing session data in Amazon ElastiCache (Redis or Memcached) externalizes the state from the EC2 instances, so when an instance is terminated during scaling, the session data persists and remains accessible to all instances. This maintains performance because ElastiCache provides sub-millisecond latency and high throughput, and it also allows any instance to handle any request, eliminating the need for sticky sessions. The application must be modified to read/write session data to ElastiCache, but this is the standard AWS-recommended approach for stateful web applications.

Answer

Use a dedicated EC2 instance for sessions

Answer

Disable sticky sessions

Answer

Increase the sticky session duration