DOP-C02 Practice Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. They want to receive notifications when a stack operation fails, including the specific resource that caused the failure. Which approach should they use?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack and subscribe to receive stack events.. CloudFormation allows you to specify an SNS topic ARN as a notification option when creating or updating a stack. When a stack operation fails, CloudFormation publishes a notification to that SNS topic, and the notification includes the logical resource ID and the status reason for the failure. This provides real-time, event-driven notifications without requiring polling or additional services.

Answer

Create a CloudWatch alarm on the 'StackFailure' metric.

Answer

Create an AWS Lambda function that polls the CloudFormation DescribeStackEvents API every minute and sends an email on failure.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and configure an SNS notification on the trail.

Question 2

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing intermittent errors. The DevOps engineer needs to identify if the errors are caused by the application or the underlying infrastructure. Which solution provides the MOST detailed visibility into the application's behavior?

Accepted Answer

Instrument the application with AWS X-Ray SDK and analyze traces. AWS X-Ray provides end-to-end tracing of requests as they travel through the application, allowing the engineer to pinpoint where errors occur. Option A is wrong because CloudWatch metrics only show aggregate data, not per-request details. Option B is wrong because VPC Flow Logs capture network traffic metadata, not application-level errors. Option D is wrong because CloudTrail records API calls, not application errors.

Answer

Enable VPC Flow Logs and analyze traffic patterns

Answer

Enable AWS CloudTrail and monitor for API errors

Answer

Enable detailed CloudWatch metrics on the EC2 instances and ALB

Question 3

A company uses AWS CodeBuild to compile and test code. The build process requires a specific version of a library that is not available in the default build environment. Which approach should be used to include this library in the build process?

Accepted Answer

Create a custom Docker image that includes the library and use it as the build environment in CodeBuild.. Creating a custom Docker image that includes the required library ensures the build environment is consistent, reproducible, and avoids repeated download/compile overhead. AWS CodeBuild supports custom Docker images via the `image` field in the buildspec file or the console, allowing you to specify a repository in Amazon ECR or Docker Hub. This approach aligns with infrastructure-as-code best practices by baking dependencies into the environment rather than managing them at build time.

Answer

Modify the buildspec file to include the library as a build artifact.

Answer

Store the compiled library in an Amazon S3 bucket and download it during the build process using the buildspec file.

Answer

Add an install command in the buildspec file to download and compile the library during each build.

Question 4

A company uses AWS CloudTrail to log API activity across multiple accounts in AWS Organizations. The security team wants to receive near-real-time notifications for specific high-risk API calls, such as IAM policy changes or S3 bucket policy modifications. What is the MOST efficient and scalable solution?

Accepted Answer

Deliver CloudTrail logs to an S3 bucket, enable S3 Event Notifications to trigger a Lambda function that filters and publishes to SNS.. It uses S3 Event Notifications to trigger a Lambda function in near-real-time when CloudTrail logs are delivered to S3. The Lambda function can filter for specific high-risk API calls (e.g., IAM policy changes, S3 bucket policy modifications) and publish only relevant events to an SNS topic, providing a scalable and cost-effective solution that avoids polling or complex querying.

Answer

Create a CloudWatch Events rule that matches the specific API calls and publishes to an SNS topic.

Answer

Use CloudWatch Logs Insights to query CloudTrail logs and set up a metric filter with an alarm.

Answer

Enable AWS Config rules to detect changes and trigger an SNS notification.

Question 5

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during business hours and low traffic at night. The company wants to configure automatic scaling based on CPU utilization. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Set the minimum and maximum number of instances for the auto scaling group.. Elastic Beanstalk uses Auto Scaling groups to manage the EC2 instances for the application. Setting the minimum and maximum number of instances defines the boundaries within which the Auto Scaling group can scale, ensuring the application can handle high traffic during business hours and scale down during low traffic at night.

Answer

Create a CloudWatch alarm that triggers a scaling policy.

Answer

Configure the load balancer health check interval.

Question 6

A financial services company uses Chef for configuration management. They need to enforce security compliance across thousands of EC2 instances. The compliance requirements include specific file permissions, firewall rules, and user account settings. They want to automatically remediate non-compliant instances. Which approach is MOST effective?

Accepted Answer

Use Chef recipes to define desired state and enforce compliance on each client run.. Chef is already in use for configuration management, and its core strength is enforcing desired state through recipes. By running Chef client on each EC2 instance (via cron or Systems Manager), non-compliant instances are automatically remediated on each convergence cycle without needing separate detection or notification tools. This approach directly addresses the requirement for automated remediation using the existing toolchain.

Answer

Use AWS Config rules to detect non-compliance and send notifications.

Answer

Use AWS CloudWatch Events to trigger a Lambda function that runs remediation scripts.

Answer

Use AWS Systems Manager Patch Manager to apply patches.

Question 7

An organization uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The deployment is failing consistently with the error 'ScriptMissing' for the AppSpec lifecycle hook 'ApplicationStop'. The scripts are located in the /opt/scripts directory on the instances. What is the most likely cause of this error?

Accepted Answer

The AppSpec file specifies a path to the script that does not exist on the instance.. The 'ScriptMissing' error in AWS CodeDeploy indicates that the deployment lifecycle hook (in this case, 'ApplicationStop') cannot find the script file at the path specified in the AppSpec file. Since the scripts are located in /opt/scripts, the most likely cause is that the AppSpec file's 'location' field for the ApplicationStop hook points to a path that does not match the actual file location on the instance, or the script file itself is missing from that directory.

Answer

The ApplicationStop hook is not defined in the AppSpec file.

Answer

The CodeDeploy agent is not the latest version.

Answer

The scripts have incorrect file permissions.

Question 8

A DevOps engineer is designing a monitoring solution for a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The team needs to monitor for errors and latency. Which TWO actions should the engineer take to implement comprehensive monitoring? (Choose TWO.)

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. AWS X-Ray provides end-to-end tracing for requests as they travel through API Gateway, Lambda, and DynamoDB, enabling the team to identify latency bottlenecks and errors across the entire serverless application. This is essential for comprehensive monitoring of distributed applications, as it captures detailed timing and error data for each component.

Answer

Enable DynamoDB Accelerator (DAX) to reduce latency.

Answer

Enable detailed billing metrics for cost analysis.

Answer

Configure CloudWatch Logs for DynamoDB.

Question 9

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

Accepted Answer

The Deny statement's Resource specifies only the objects, not the bucket itself. The Deny statement in the bucket policy uses `arn:aws:s3:::example-bucket/*` as the Resource, which applies only to objects within the bucket, not to the bucket itself. To enforce HTTPS for all requests, including those to the bucket endpoint (e.g., `GET /` or `PUT /`), the Resource must also include the bucket ARN without the `/*` suffix. Without it, HTTP requests targeting the bucket itself (such as listing objects or configuring website hosting) are not denied, allowing HTTP access to bypass the policy.

Answer

The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'

Answer

The bucket is not versioned, so the policy does not apply to object versions

Answer

The policy uses Deny, but an Allow policy from another statement overrides it

Question 10

Refer to the exhibit. A DevOps engineer is troubleshooting a cross-account deployment where an AWS CodeBuild project in Account A needs to upload build artifacts to an S3 bucket in Account B. The engineer attaches this IAM policy to the CodeBuild service role in Account A. However, the upload fails. What is the most likely reason?

Accepted Answer

The condition requires bucket-owner-full-control ACL, but the bucket policy may not allow it. The IAM policy includes a condition that requires the `bucket-owner-full-control` canned ACL (`s3:x-amz-acl: bucket-owner-full-control`). For this condition to be satisfied, the bucket policy in Account B must explicitly allow the `s3:PutObject` action with that ACL. If the bucket policy does not include a statement granting `s3:PutObject` with the condition that the ACL is `bucket-owner-full-control`, the upload will fail with an access denied error, even if the IAM policy in Account A appears permissive.

Answer

The bucket policy in Account B grants s3:PutObject to Account A

Answer

The policy does not include s3:PutObjectAcl permission

Answer

The policy does not include s3:GetObject permission

Question 11

A DevOps engineer is troubleshooting a performance issue with an Amazon RDS for MySQL database. The engineer suspects that slow queries are causing high CPU utilization. Which TWO actions can the engineer take to identify the slow queries?

Accepted Answer

Enable the slow query log and publish it to CloudWatch Logs.. Enable the slow query log and publish it to CloudWatch Logs (Option C) allows you to capture and analyze slow SQL queries. Performance Insights (Option D) provides a dashboard to visualize database load and identify the top SQL statements causing performance issues. Option A is incorrect because event subscriptions for low storage notify about storage events, not slow queries. Option B is incorrect because monitoring CPUUtilization only indicates high CPU usage but does not identify specific slow queries. Option E is incorrect because Enhanced Monitoring provides OS-level metrics like CPU and memory, not the actual SQL queries.

Answer

Create an RDS event subscription for 'low storage' events.

Answer

Monitor the 'CPUUtilization' metric in CloudWatch.

Answer

Enable Enhanced Monitoring to view process list and SQL queries.

Question 12

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application frequently experiences high latency during peak hours. The DevOps team needs to implement a solution that automatically adds capacity based on demand and reduces cost during off-peak hours. Which combination of AWS services should the team use?

Accepted Answer

Use an AWS Auto Scaling group with target tracking scaling policies based on the ALB's request count per target, and attach it to the ALB target group.. Target tracking scaling policies allow the Auto Scaling group to automatically adjust capacity based on a specific metric, such as ALB request count per target, which directly reflects the load on each instance. This ensures that capacity is added during high latency periods and removed during off-peak hours, optimizing both performance and cost. The ALB target group integration ensures that new instances are automatically registered and start receiving traffic.

Answer

Use an AWS Auto Scaling group with scheduled scaling policies that add instances during known peak hours and remove them during off-peak hours.

Answer

Implement Amazon Route 53 weighted routing policies to distribute traffic to multiple ALBs, each fronting a fixed set of EC2 instances.

Answer

Use an AWS Auto Scaling group with simple scaling policies based on CPU utilization and attach it to the ALB target group.

Question 13

A team uses AWS CodePipeline with a multi-branch strategy. They want to run different build projects based on the branch name: 'main' triggers a production build, 'develop' triggers a staging build, and feature branches trigger a test build. Which CodePipeline feature should they use?

Accepted Answer

Configure the source action with a branch filter using a regular expression.. CodePipeline's source action supports branch filtering via regular expressions, allowing you to define which branch triggers which pipeline execution. By configuring a single pipeline with a branch filter regex (e.g., '^main$', '^develop$', '^feature/.*$'), you can route commits from different branches to different build projects without creating multiple pipelines or using external logic.

Answer

Use AWS Lambda to dynamically change the pipeline definition.

Answer

Create separate pipelines for each branch and use tags.

Answer

Use a manual approval action to select the branch.

Question 14

A company has a Lambda function that processes sensitive data and needs to access an RDS database. The security team requires that the database credentials are automatically rotated every 30 days. Which service should be used to store and rotate the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like RDS. It supports native, built-in rotation for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) without requiring custom Lambda functions. The automatic rotation can be scheduled at a desired interval (e.g., every 30 days) using a rotation schedule defined in the secret's configuration, and it integrates directly with RDS to update the credentials on both the secret and the database.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS IAM roles

Question 15

A company uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that creates an Amazon RDS DB instance. The database password must be stored securely and rotated automatically. Which approach meets these requirements?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation. Reference the secret in the template using a dynamic reference.. AWS Secrets Manager provides built-in capabilities for automatic password rotation, which is a requirement. By storing the password in Secrets Manager and referencing it in the CloudFormation template using a dynamic reference (e.g., `{{resolve:secretsmanager:secret-id:SecretString:password}}`), the password is never exposed in the template or parameter logs, and rotation can be configured without updating the stack. This approach meets both security and automation requirements.

Answer

Hardcode the password in the CloudFormation template and use a NoEcho parameter.

Answer

Use AWS Key Management Service (KMS) to encrypt the password and pass it as a parameter.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it using a dynamic reference.

AWS Certified DevOps Engineer Professional DOP-C02 practice test

Three ways to study

Study DOP-C02 by domain

Study DOP-C02 by topic

Configuration Management and IaC practice questions

Resilient Cloud Solutions practice questions

Monitoring and Logging practice questions

Incident and Event Response practice questions

Security and Compliance practice questions

SDLC Automation practice questions

DOP-C02 fundamentals practice questions

DOP-C02 scenario practice questions

DOP-C02 troubleshooting practice questions

Top DOP-C02 questions

AWS Certified DevOps Engineer Professional DOP-C02 practice questions

How to use these DOP-C02 questions

Quick answer