DOP-C02 Incident and Event Response Practice Question
A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group (ASG) for web servers, and an Amazon RDS Multi-AZ DB instance. The ASG uses a launch template with Amazon Linux 2 and a user data script that installs the web application and connects to the RDS database using a static password stored in the user data. Recently, the security team discovered that the user data script is exposed in the EC2 console and could be viewed by anyone with EC2 describe-instances permissions. The team wants to remediate this immediately without causing downtime. The ASG is configured with a min size of 2, max size of 6, and desired capacity of 4. The application is currently under load. Which option describes the best course of action?
⚠ Common exam trap
Candidates often assume updating the launch template automatically propagates to existing instances, but in reality, the ASG only applies the launch template to new instances, so an instance refresh or manual replacement is required to remediate existing instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new launch template version that retrieves the password from AWS Secrets Manager. Update the ASG to use the new template version and perform an instance refresh with a minimum healthy percentage of 100%.
It uses an instance refresh with a minimum healthy percentage of 100% to replace instances without downtime, while the new launch template version retrieves the password from AWS Secrets Manager, eliminating the static password exposure. This approach ensures that the security vulnerability is remediated immediately without disrupting the running application under load.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a new launch template version that retrieves the password from AWS Secrets Manager. Update the ASG to use the new template version and perform an instance refresh with a minimum healthy percentage of 100%.
Why this is correct
This action creates a new launch template version that retrieves the password from AWS Secrets Manager, then performs an instance refresh with a minimum healthy percentage of 100%. This replaces instances one by one without downtime, remediating the security issue on all instances.
- ✗
Immediately modify the user data on each running EC2 instance to remove the password, then update the launch template to reference AWS Secrets Manager.
Why it's wrong here
Modifying user data on running instances does not take effect because user data scripts run only at instance launch. Thus, this action fails to remove the password from the user data that was already executed, and the static password remains exposed.
- ✗
Update the existing launch template to use AWS Secrets Manager for the database password. The ASG will automatically apply the change to existing instances.
Why it's wrong here
Launch template changes are only applied to new instances that the Auto Scaling group launches; they do not retroactively modify running instances. Since the static password remains in the user data of every existing instance (and in the instance metadata accessible from within the instance), the vulnerability persists until those instances are replaced. The ASG will not automatically recycle instances just because the template changed, so the password remains exposed until a manual refresh, scale-in, or termination event occurs.
- ✗
Delete the existing launch template and create a new one with secrets from AWS Secrets Manager. Then terminate all running instances and let the ASG launch new ones.
Why it's wrong here
Deleting the launch template while it is still referenced by the Auto Scaling group can break the group's ability to replace instances or scale, and terminating all running instances simultaneously creates a full outage rather than a rolling replacement. Even if new instances launched from a new template pull the password from Secrets Manager, the abrupt termination of the entire fleet violates the principle of maintaining capacity and can fail health checks and SLAs. A safer path is to add a new template version and use an instance refresh with a minimum healthy percentage, which preserves availability while rotating the fleet.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.