DOP-C02 Resilient Cloud Solutions Practice Test 18 — 15 Questions

Question 1

A company's application runs on Amazon EC2 instances in an Auto Scaling group. The application writes logs to local instance storage. The operations team needs to ensure logs are not lost during instance termination or scaling events. What should be done?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the CloudWatch Logs agent on each instance and stream logs to CloudWatch Logs.. The CloudWatch Logs agent streams log data in near real-time to Amazon CloudWatch Logs, ensuring logs are persisted independently of the EC2 instance lifecycle. This decouples log storage from ephemeral instance store volumes, so logs are not lost during Auto Scaling termination or scaling events. The agent handles log rotation, compression, and encryption in transit, providing a durable and centralized log solution.

Answer

Increase the size of the instance store volumes.

Answer

Use an Amazon EFS file system and mount it to each instance for log storage.

Answer

Configure the Auto Scaling group to terminate instances after logs are copied to S3.

Question 2

A company uses Amazon Route 53 for DNS. They want to ensure that if their primary website endpoint fails, traffic is automatically routed to a secondary endpoint in a different Region. Which routing policy should be used?

Accepted Answer

Failover routing. Failover routing policy allows you to configure an active-passive failover setup.

Answer

Latency routing

Answer

Simple routing

Answer

Weighted routing

Question 3

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must be resilient to sudden spikes in traffic without manual intervention. Which combination of services should be used?

Accepted Answer

API Gateway with throttling, Lambda with reserved concurrency, and DynamoDB auto scaling.. It combines API Gateway throttling to absorb traffic spikes by queuing or rejecting excess requests, Lambda reserved concurrency to guarantee execution capacity for the function, and DynamoDB auto scaling to adjust read/write capacity based on demand. This triad ensures the application remains available and responsive under sudden load without manual intervention.

Answer

API Gateway with usage plans, Lambda with provisioned concurrency, and DynamoDB on-demand.

Answer

API Gateway with WAF, Lambda with function URLs, and DynamoDB Accelerator (DAX).

Answer

API Gateway with caching, Lambda with no concurrency limits, and DynamoDB global tables.

Question 4

A company is designing a resilient architecture for a web application that uses Amazon RDS for MySQL. The application must be able to withstand the loss of an entire AWS Region. Which TWO actions should the company take?

Accepted Answer

Configure automated backups to be copied to another Region.. To withstand the loss of an entire AWS Region, the company must have a disaster recovery strategy that includes cross-region data replication. Option B is correct because copying automated backups to another Region ensures that a recoverable copy of the database exists in a different geographic area, allowing restoration in a separate Region if the primary Region fails. Option D is correct because a Cross-Region Read Replica provides a live, asynchronously replicated copy of the database in another Region, which can be promoted to a standalone primary instance during a regional outage, minimizing recovery time.

Answer

Use RDS Proxy to pool database connections.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Enable deletion protection on the RDS instance.

Question 5

A company runs a containerized application on Amazon EKS. The application must be highly available across multiple Availability Zones and must automatically recover from node failures. Which THREE steps should be taken?

Accepted Answer

Use Pod Disruption Budgets to ensure a minimum number of pods are available during voluntary disruptions.. Pod Disruption Budgets (PDBs) are correct because they allow you to specify the minimum number of pods that must remain available during voluntary disruptions, such as node drains or cluster upgrades. This ensures that the application maintains high availability even when Kubernetes performs planned maintenance, preventing all replicas from being taken down simultaneously.

Answer

Deploy worker nodes in a single Availability Zone to reduce cross-AZ data transfer costs.

Answer

Use a single large instance type for all worker nodes to simplify management.

Question 6

A company wants to ensure that its Amazon S3 bucket is resilient to accidental deletion of objects. Which TWO actions should be taken?

Accepted Answer

Enable MFA Delete on the bucket.. Enabling MFA Delete on an S3 bucket requires multi-factor authentication for any delete operations, including object version deletion and bucket deletion. This adds a critical layer of protection against accidental or unauthorized deletions, as the user must present both their AWS credentials and a valid MFA code to perform these destructive actions.

Answer

Enable S3 Object Lock.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure a lifecycle policy to expire objects after 30 days.

Question 7

A company runs a high-traffic web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. The application uses an Amazon RDS for PostgreSQL database. Recently, during a traffic spike, the application became unresponsive. Investigation revealed that the database CPU utilization reached 100%, causing queries to timeout. The Auto Scaling group added more EC2 instances, which only increased the load on the database. The DevOps team needs to implement a solution that prevents the database from being overwhelmed during traffic spikes while maintaining application availability. The solution must be cost-effective and require minimal changes to the application code. Which solution should the DevOps team implement?

Accepted Answer

Use Amazon RDS Proxy between the application and the database to pool and reuse connections.. RDS Proxy manages database connections efficiently, reducing the number of connections and CPU overhead. It also provides connection pooling, which helps handle spikes without overwhelming the database.

Answer

Implement read replicas for the RDS database and modify the application to use read replicas for read queries.

Answer

Increase the instance size of the RDS database to a larger instance type to handle more connections.

Answer

Configure Auto Scaling to launch EC2 instances based on a custom metric that tracks database CPU utilization, and throttle the number of instances.

Question 8

A company hosts a static website on Amazon S3 with a CloudFront distribution. The website is critical for business operations and must be available even if the primary AWS Region fails. Currently, the S3 bucket is in us-east-1, and CloudFront uses that bucket as the origin. The company has a secondary bucket in us-west-2 with a replica of the data. The company wants to use CloudFront to automatically fail over to the secondary bucket if the primary becomes unavailable. The DevOps engineer needs to implement a solution that requires minimal operational overhead. What should the engineer do?

Accepted Answer

Configure CloudFront Origin Failover by adding both buckets as origins, with the primary in us-east-1 and secondary in us-west-2.. CloudFront Origin Failover is a native feature that allows you to designate a primary and secondary origin within a single distribution; CloudFront automatically routes requests to the secondary origin when the primary returns specific error codes (e.g., 500, 502, 503, 504) or fails health checks. This requires no additional infrastructure, no DNS changes, and no custom code, making it the lowest-operational-overhead solution. It directly meets the requirement of automatic failover to the us-west-2 bucket.

Answer

Use an Application Load Balancer in front of both S3 buckets and point CloudFront to the ALB.

Answer

Create a second CloudFront distribution pointing to the secondary bucket and use Route 53 failover routing between the two distributions.

Answer

Modify the application to switch the CloudFront origin URL using Lambda@Edge when health checks fail.

Question 9

A company uses AWS CloudFormation to deploy infrastructure. During a recent deployment, the stack failed to create an Amazon RDS DB instance because of a parameter validation error. The DevOps engineer fixed the parameter and wants to resume the stack creation without recreating the resources that were already successfully created. The stack template is parameterized and uses nested stacks. What is the MOST efficient way to resume the stack creation?

Accepted Answer

Use the CloudFormation stack update operation with the corrected parameter.. CloudFormation stack updates can be used to fix the issue. By updating the stack with the corrected parameters, CloudFormation will only modify the failed resource and not recreate already created resources.

Answer

Manually create the RDS instance with the corrected parameter and update the stack to import it.

Answer

Delete the entire stack and redeploy with the corrected parameter.

Answer

Use the 'ContinueUpdateRollback' feature to rollback the failed stack and then redeploy.

Question 10

A media company runs a video processing pipeline on AWS. Raw videos are uploaded to an S3 bucket, which triggers a Lambda function to start an AWS Batch job for transcoding. The Batch job reads the source video from S3, processes it, and writes the output to another S3 bucket. Recently, the company has seen an increase in processing failures. Investigation shows that the Batch jobs are being terminated with a 'TIMEOUT' status after running for exactly 30 minutes. The video files are large, and some jobs legitimately take up to 45 minutes. The Batch job definition has a 'timeout' setting configured. Which action should be taken to resolve this issue?

Accepted Answer

Modify the Batch job definition to increase the 'timeout' value to 3600 seconds (60 minutes).. The Batch job is being terminated with TIMEOUT after exactly 30 minutes, and the job definition has a timeout setting — this is the Batch job attempt timeout (default 30 minutes if not explicitly set, or set to 1800 seconds). Since legitimate jobs take up to 45 minutes, the fix is to raise the job definition's timeout to at least 3600 seconds (60 minutes) to accommodate the longest jobs with headroom.

Answer

Increase the S3 bucket lifecycle policy to retain videos longer.

Answer

Increase the Lambda function timeout to 60 minutes.

Answer

Change the Batch job queue to a different compute environment.

Question 11

A company runs a static website on Amazon S3 with public read access. The website content is stored in an S3 bucket and served through an Amazon CloudFront distribution for better performance and security. Recently, the company noticed that some users are accessing the S3 bucket directly via the S3 endpoint, bypassing CloudFront. This increases costs and exposes the bucket to potential attacks. The company wants to ensure that all access to the website goes through CloudFront only. Which solution should the company implement?

Accepted Answer

Create an origin access identity (OAI) in CloudFront and update the S3 bucket policy to allow only the OAI to read objects.. To restrict access to the S3 bucket only through CloudFront, use an origin access identity (OAI) and a bucket policy that allows only the OAI. This way, direct access via S3 URL is denied.

Answer

Set the S3 bucket policy to deny all requests that do not come from the CloudFront distribution's IP addresses.

Answer

Configure the S3 bucket to use AWS WAF to block requests that do not have a custom header set by CloudFront.

Answer

Change the S3 bucket to be private and use presigned URLs for all requests.

Question 12

A company runs a critical application on Amazon ECS with the Fargate launch type. The application is deployed across three Availability Zones. Each service has its own Application Load Balancer. The company wants to implement a blue/green deployment strategy to reduce risk. They currently use AWS CodeDeploy for ECS deployments. During a recent deployment, the company noticed that the new version (green) was not receiving any traffic even after passing all health checks. The CodeDeploy configuration uses a 'Linear10PercentEvery3Minutes' traffic shifting configuration. What is the most likely reason that the green tasks are not receiving traffic?

Accepted Answer

The green target group's health check is misconfigured, causing CodeDeploy to consider the green tasks unhealthy and not route traffic.. The green target group's health check is misconfigured, causing CodeDeploy to consider the green tasks unhealthy. With a 'Linear10PercentEvery3Minutes' traffic shifting configuration, CodeDeploy gradually shifts traffic in 10% increments every 3 minutes, but only if the green target group passes health checks. If the health check fails, CodeDeploy stops traffic shifting, leaving the green tasks with zero traffic despite the tasks themselves being healthy.

Answer

The CodeDeploy deployment group is not associated with the correct ECS service.

Answer

The blue target group is still set as the production target group in the load balancer listener.

Answer

The green tasks are in a different VPC than the load balancer.

Question 13

A company runs a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The function scales up to handle high traffic but sometimes experiences throttling errors (HTTP 429) from Lambda. The company wants to improve the resilience of the application by reducing throttling. The SQS queue is configured as a Lambda event source with a batch size of 10. The Lambda function has a reserved concurrency of 100. Which combination of actions will best reduce throttling? (Choose the single best answer.)

Accepted Answer

Increase the Lambda function's reserved concurrency to 500.. Throttling errors (HTTP 429) occur when Lambda function invocations exceed the account-level concurrency limit or the function's reserved concurrency. By increasing the reserved concurrency from 100 to 500, the function can handle more concurrent invocations, reducing the likelihood of throttling when traffic spikes. This directly addresses the scaling bottleneck without changing the event source or message processing pattern.

Answer

Change the SQS queue to use a FIFO queue to guarantee exactly-once processing.

Answer

Increase the SQS batch size to 50 to process more messages per invocation.

Answer

Use a dead-letter queue (DLQ) for unprocessed messages and set up a CloudWatch alarm to trigger a second Lambda function to reprocess them.

Question 14

A company runs a critical REST API on Amazon ECS Fargate behind an Application Load Balancer. The operations team wants the service to automatically recover from a failed task without manual intervention. They have configured a target group health check, but the ECS service still does not replace unhealthy tasks. What should the DevOps engineer do to ensure automatic task replacement?

Accepted Answer

Enable the ECS service to use the load balancer target group health check by specifying the target group ARN in the service definition.. For ECS services with a load balancer, ECS uses the target group health check to determine if a task is healthy. When a task fails the health check, ECS automatically stops it and starts a new one. This behavior requires that the service definition includes the load balancer configuration with the target group ARN. Without this, ECS does not monitor task health via the load balancer and will not replace unhealthy tasks.

Answer

Create an Amazon CloudWatch alarm based on the UnhealthyHostCount metric and configure it to invoke an AWS Lambda function that calls the ECS StopTask API.

Answer

Set the deployment configuration to use the rolling update strategy with a minimum healthy percent of 100 and a maximum percent of 200.

Answer

Configure the ECS service to use a container health check with the HEALTHCHECK instruction in the Dockerfile.

Question 15

A company runs a critical batch processing workload on a fleet of EC2 instances in a single AWS Region. The workload can tolerate interruptions but must complete within 4 hours and must not lose progress if an instance is terminated. The company wants to minimize cost and operational overhead while ensuring resilience against a single Availability Zone failure. Which solution meets these requirements?

Accepted Answer

Use Spot Instances with a diversified allocation strategy across multiple Availability Zones, and store intermediate results in Amazon S3.. The workload is interruptible, so Spot Instances are the most cost-effective choice. A diversified allocation strategy across multiple Availability Zones reduces correlated interruptions and provides AZ resilience. Storing intermediate results in Amazon S3 ensures progress is preserved because any instance can retrieve the latest checkpoint. This solution satisfies cost, availability, and durability requirements with minimal operational overhead.

Answer

Use Reserved Instances in a single Availability Zone, and store intermediate results on instance store volumes.

Answer

Use On-Demand instances spread across multiple Availability Zones, and store intermediate results in an Amazon S3 bucket.

Answer

Use Spot Instances in a single Availability Zone, and store intermediate results on Amazon EBS volumes attached to each instance.