DOP-C02 Resilient Cloud Solutions Practice Test 4 — 15 Questions

Question 1

A company uses an NLB to distribute traffic to a fleet of EC2 instances in a single Availability Zone. During a recent AWS outage in that zone, the application became completely unavailable. The company wants to achieve high availability without rearchitecting the application. Which change is MOST appropriate?

Accepted Answer

Launch EC2 instances in a second Availability Zone and register them with the NLB target group. Option D is correct because NLB automatically routes traffic to healthy targets across Availability Zones when targets are registered. Option A is wrong because ALB is not required; NLB can handle multi-AZ. Option B is wrong because instance type does not affect availability. Option C is wrong because it does not address zone failure.

Answer

Use a larger instance type and enable detailed CloudWatch monitoring

Answer

Replace the NLB with an Application Load Balancer and enable cross-zone load balancing

Answer

Create an Auto Scaling group with a scheduled scaling policy to add instances during peak hours

Question 2

A company runs a containerized application on Amazon ECS with Fargate. The application needs to store session state. Which service provides the MOST resilient and scalable solution?

Accepted Answer

Amazon ElastiCache for Redis. Option C is correct because ElastiCache for Redis provides a highly available, scalable, and fast in-memory data store for session state. Option A is wrong because EFS is for file storage, not session state. Option B is wrong because S3 is object storage with higher latency. Option D is wrong because local storage is ephemeral.

Answer

Amazon EFS

Answer

Ephemeral storage on the container instance

Answer

Amazon S3

Question 3

A company uses AWS CodePipeline to deploy a web application. The pipeline includes a deploy action that uses AWS CloudFormation to update a stack. The deployment occasionally fails because of a transient resource limit error. Which automatic retry strategy should a DevOps engineer implement?

Accepted Answer

Set the deploy action's retry count to 3 in the pipeline definition. Option B is correct because CodePipeline supports automatic retry of actions; the retry count can be set to 3. Option A is wrong because the pipeline execution itself should not be retried entirely. Option C is wrong because CloudFormation does not have a built-in retry mechanism; it fails the action. Option D is wrong because Step Functions adds complexity and cost.

Answer

Use an AWS Step Function to orchestrate the deployment with retry logic

Answer

Modify the CloudFormation stack to include a retry policy

Answer

Configure the pipeline to retry the entire pipeline execution on failure

Question 4

A company has a critical application running on EC2 instances in an Auto Scaling group across two Availability Zones. The application uses an EBS volume for local caching. The company wants to ensure that if an instance fails, the cache data is not lost and the replacement instance can use it. Which solution meets this requirement?

Accepted Answer

Use Amazon EFS instead of EBS for the cache. Option D is correct because an EBS Multi-Attach volume can be attached to multiple instances in the same Availability Zone, but to persist across zones, you need to use a replication mechanism or EFS. However, the question implies a single volume for caching; the best approach is to use ElastiCache or a shared file system. Option A is wrong because snapshots are not real-time. Option B is wrong because a new volume would be empty. Option C is wrong because EBS volumes are zone-specific.

Answer

Configure the Auto Scaling group to use a launch template that attaches the same EBS volume to new instances

Answer

Take periodic EBS snapshots and create a new volume from the snapshot for the replacement instance

Answer

Use an EBS Multi-Attach volume and attach it to all instances in the Auto Scaling group

Question 5

A company wants to ensure that its application running on AWS can withstand the failure of an entire AWS Region. Which TWO strategies should the company implement?

Accepted Answer

Deploy the application in multiple AWS Regions using an active-active or active-passive pattern. B and C are correct. Multi-Region deployment provides regional isolation. Data replication ensures data availability. Option A is wrong because Multi-AZ protects only within a Region. Option D is wrong because a single CloudFront distribution with multiple origins does not guarantee regional failover. Option E is wrong because RDS read replicas are for read scaling, not disaster recovery.

Answer

Deploy the application across multiple Availability Zones in a single Region

Answer

Use a single CloudFront distribution with multiple origins in the same Region

Answer

Configure RDS read replicas in the same Region

Question 6

A company runs a stateful web application on EC2 instances behind an ALB. The application stores session data in memory. The company wants to make the application stateless to improve resilience. Which TWO changes should the company make?

Accepted Answer

Disable sticky sessions on the ALB. B and E are correct. Storing session data externally (ElastiCache) makes instances stateless. Enabling sticky sessions is not needed if state is external; however, the question asks for statelessness, so removing stickiness is correct. Option A is wrong because stickiness contradicts statelessness. Option C is wrong because in-memory storage is the problem. Option D is wrong because it doesn't address session state.

Answer

Increase the instance memory to store more sessions

Answer

Enable sticky sessions (session affinity) on the ALB

Answer

Use an NLB instead of an ALB

Question 7

A company is designing a disaster recovery plan for a critical application that uses Amazon RDS for MySQL with Multi-AZ. The RPO must be less than 1 minute and RTO less than 15 minutes. The primary Region is us-east-1. Which THREE steps should the company take to meet these requirements?

Accepted Answer

Create a cross-Region read replica of the RDS instance in the secondary Region. B, C, and E are correct. Cross-Region read replica provides near-real-time replication (low RPO) and can be promoted quickly (low RTO). Automated backups are replicated to another Region and can be restored, but RTO may exceed 15 minutes. Option A is wrong because manual snapshots cannot achieve <1 minute RPO. Option D is wrong because Multi-AZ protects within a Region only.

Answer

Take manual snapshots of the RDS instance every 30 seconds and copy them to the secondary Region

Answer

Enable Multi-AZ in the primary Region

Question 8

A company runs a production web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent high latency. The operations team needs to identify the root cause without affecting live traffic. Which approach is the MOST efficient?

Accepted Answer

Enable detailed CloudWatch metrics on the ALB and analyze ALB access logs. Using detailed CloudWatch metrics and access logs from the ALB allows analyzing request latency patterns without impacting production traffic. Option A is wrong because SSH access may be restricted and cannot provide historical data. Option C is wrong because it requires creating a separate test environment. Option D is wrong because tcpdump generates large volumes of data and can impact performance.

Answer

Deploy a separate test environment with identical configuration and run load tests

Answer

Enable EC2 detailed monitoring and SSH into each instance to run top and iostat

Answer

Run tcpdump on all EC2 instances and analyze packet captures

Question 9

A company uses AWS Lambda for processing events from Amazon S3. Recently, the Lambda function started timing out after the 15-minute limit for some large files. The function downloads the entire file to /tmp before processing. What should a DevOps engineer do to resolve this issue with minimal code changes?

Accepted Answer

Use S3 Select to filter and retrieve only necessary data, reducing file size. Splitting the file into smaller parts using S3 Select allows processing within the Lambda timeout without changing the overall architecture. Option A is wrong because increasing memory does not increase timeout beyond 15 minutes. Option C is wrong because reading the file in chunks from S3 still requires processing within the Lambda timeout. Option D is wrong because moving to a different runtime does not remove the timeout limit.

Answer

Switch the Lambda runtime from Python to Node.js for faster execution

Answer

Increase the Lambda function memory to 10,240 MB to improve CPU performance

Answer

Modify the function to read the file in streaming chunks from S3

Question 10

A company runs a critical database on Amazon RDS for PostgreSQL with Multi-AZ deployment. The application experiences a brief outage during automatic failover. To improve availability, the company wants to reduce the failover time. What should they do?

Accepted Answer

Enable Multi-AZ DB cluster with synchronous replication and a standby in a different AZ. Using a Multi-AZ deployment with synchronous replication and a Multi-AZ DB cluster (standby with reader endpoint) provides faster failover times. Option B is wrong because Read Replicas are for read scaling, not automatic failover. Option C is wrong because removing Multi-AZ increases downtime. Option D is wrong because increasing instance size does not reduce failover time.

Answer

Create a cross-Region Read Replica and promote it during failure

Answer

Increase the DB instance class size to improve I/O performance

Answer

Remove Multi-AZ and use a single instance with increased backup frequency

Question 11

A company uses AWS CodeDeploy for blue/green deployments to an Auto Scaling group. The deployment fails because the new instances do not pass health checks. The DevOps engineer discovers that the health check URL returns a 503 error. What is the MOST likely cause?

Accepted Answer

The target group health check path is '/health' but the application does not serve that endpoint. The health check URL returning a 503 error indicates that the application is not responding to the health check endpoint. Since the target group health check path is configured as '/health' but the application does not serve that endpoint, the ALB considers the instances unhealthy, causing CodeDeploy to fail the deployment. This is the most direct cause because the health check is failing at the application layer, not due to infrastructure issues.

Answer

The CodeDeploy agent on the new instances is not running

Answer

The security group for the ALB does not allow inbound traffic on port 80

Answer

The Auto Scaling group health check type is set to EC2 instead of ELB

Question 12

A company runs a stateless web application on a fleet of EC2 instances in an Auto Scaling group. The application stores session state in a shared ElastiCache Redis cluster. During traffic spikes, the application becomes slow. Monitoring shows that the Redis cluster has high CPU utilization. Which solution is MOST cost-effective and scalable?

Accepted Answer

Enable cluster mode on the ElastiCache Redis cluster and add more shards. Enabling cluster mode on ElastiCache Redis and adding more shards horizontally scales the cluster, distributing write and read operations across multiple nodes. This directly reduces CPU utilization on any single node and is more cost-effective than vertical scaling (upgrading to a larger node type) because it allows granular, pay-as-you-grow capacity. Cluster mode also supports automatic shard rebalancing and is ideal for stateless web applications with session state that can be partitioned by session key.

Answer

Upgrade the Redis instance to a larger node type to handle more operations

Answer

Add read replicas to offload read traffic from the primary node

Answer

Migrate session state to DynamoDB with DAX for caching

Question 13

A company runs a containerized microservices architecture on Amazon ECS with Fargate. The services communicate via an internal Application Load Balancer. Recently, a new deployment of Service A caused its health checks to fail. The DevOps engineer notices that the old tasks remain running and the service is unavailable. What configuration change would prevent this issue in future deployments?

Accepted Answer

Set the deployment minimum healthy percent to 50 and maximum percent to 100 with a health check grace period. Setting the deployment minimum healthy percent to 50 and maximum percent to 100 ensures that during a deployment, at least 50% of tasks are healthy, but if health checks fail, the deployment can roll back because the old tasks are not replaced until new tasks are healthy. Option B is wrong because it allows replacing all tasks before health checks pass. Option C is wrong because it is a deployment controller, not a configuration to prevent failure. Option D is wrong because it removes the ability to roll back.

Answer

Set the deployment circuit breaker to rollback on deployment failure and disable rollback

Answer

Change the deployment controller from ECS to CodeDeploy for blue/green deployments

Answer

Set the deployment minimum healthy percent to 0 and maximum percent to 200

Question 14

A company runs a critical application on EC2 instances in an Auto Scaling group. The application uses an EBS volume attached to each instance for temporary data. The company needs to ensure that if an instance fails, the data is not lost, and the new instance can resume quickly. What should they do?

Accepted Answer

Use an EBS Multi-Attach volume attached to all instances in the Auto Scaling group. Using an EBS Multi-Attach volume allows multiple instances in the same AZ to attach the same volume, providing shared access and quick recovery. Option A is wrong because EBS snapshots are point-in-time and take time to restore. Option C is wrong because EFS is a file system, not block storage, and may not be compatible with the application. Option D is wrong because instance store is ephemeral.

Answer

Store temporary data on instance store volumes instead of EBS

Answer

Use an EBS snapshot and create a new volume from the snapshot for the new instance

Answer

Migrate to Amazon EFS and mount the same file system on all instances

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The stack creation fails with the error: 'Resource handler returned message: 'The security group does not exist in VPC'.' The template references a security group by name. What is the MOST likely cause?

Accepted Answer

The security group name is misspelled or uses incorrect case. Option A is correct because CloudFormation resolves security group references by exact name match, including case sensitivity. When a security group is specified by name in a template, CloudFormation performs a case-sensitive lookup in the target VPC. If the name is misspelled or the case differs (e.g., 'MySecurityGroup' vs 'mysecuritygroup'), the resource handler fails with the error 'The security group does not exist in VPC' because the lookup returns no match.

Answer

The IAM role used for CloudFormation does not have permissions to describe security groups

Answer

The template uses a parameter that resolves to the default VPC security group