DOP-C02 Practice Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. They want to receive notifications when a stack operation fails, including the specific resource that caused the failure. Which approach should they use?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack and subscribe to receive stack events.. CloudFormation allows you to specify an SNS topic ARN as a notification option when creating or updating a stack. When a stack operation fails, CloudFormation publishes a notification to that SNS topic, and the notification includes the logical resource ID and the status reason for the failure. This provides real-time, event-driven notifications without requiring polling or additional services.

Answer

Create a CloudWatch alarm on the 'StackFailure' metric.

Answer

Create an AWS Lambda function that polls the CloudFormation DescribeStackEvents API every minute and sends an email on failure.

Answer

Enable AWS CloudTrail to log CloudFormation API calls and configure an SNS notification on the trail.

Question 2

An IAM policy is attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' even though they are connecting from within the 10.0.0.0/16 IP range. What is the MOST likely reason?

Accepted Answer

The user is accessing S3 through a VPC endpoint, but the condition only works for public IP addresses.. The condition 'aws:SourceIp' evaluates the IP address of the requester. However, if the user is accessing S3 through a VPC endpoint, the source IP is a private IP from the VPC, but the condition works only for public IP addresses. Option C is correct. Option A is wrong because the policy allows GetObject. Option B is wrong because the resource is correct. Option D is wrong because the condition is for source IP, not VPC endpoint.

Answer

The policy needs an additional condition for VPC endpoint.

Answer

The policy does not allow the s3:ListBucket action.

Answer

The resource ARN is missing the bucket-level permission.

Question 3

Refer to the exhibit. An IAM policy is attached to a CodePipeline service role. When the pipeline tries to start a CodeBuild project, it fails with an 'AccessDenied' error. The CodeBuild project uses a different service role (arn:aws:iam::123456789012:role/CodeBuildServiceRole2). What is the MOST likely cause?

Accepted Answer

The policy only allows iam:PassRole for a specific role ARN, but the CodeBuild project uses a different role.. The pipeline's service role has an iam:PassRole action constrained to a specific role ARN via a condition key. When the pipeline attempts to start the CodeBuild project, it needs to pass the CodeBuild service role (arn:aws:iam::123456789012:role/CodeBuildServiceRole2) to CodeBuild. Because the policy only allows iam:PassRole for a different role (not this one), the pass fails, resulting in an AccessDenied error. Option D correctly identifies this issue.

Answer

The policy has a condition on the s3 actions that is not satisfied.

Answer

The policy does not allow codebuild:StartBuild for the specific project.

Answer

The policy does not allow s3:GetObject on the artifact bucket.

Question 4

A company is migrating a monolithic application to a microservices architecture on Amazon EKS. The application uses a relational database. The team wants to ensure that database connections are managed efficiently and that the database can withstand a sudden spike in connections from multiple microservices. Which solution should the DevOps engineer implement? (Choose THREE.)

Accepted Answer

Deploy Amazon RDS Proxy in front of the database.. The correct solutions are C, D, and E. Option C (RDS Proxy) pools and shares database connections, reducing the number of connections and handling spikes efficiently. Option D (increase max_connections and enable Auto Scaling) allows the database to accept more connections and scale dynamically during spikes. Option E (connection pool sidecar like PgBouncer) adds connection pooling at the pod level, further managing connections. Option A (direct connections) would increase the number of connections, potentially overwhelming the database. Option B (ElastiCache) is for caching query results, not for managing database connections, and does not address the spike issue.

Answer

Use direct database connections from each microservice pod.

Answer

Use Amazon ElastiCache for Redis to cache database query results.

Question 5

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application generates logs that are sent to Amazon CloudWatch Logs. The DevOps team needs to configure a metric filter to monitor for error patterns and trigger an alarm when the error rate exceeds 5% of total requests over a 5-minute period. Which TWO steps should the team take? (Choose TWO.)

Accepted Answer

Create a metric filter on the log group to count occurrences of the error pattern.. To achieve the monitoring goal, the team must first create a metric filter on the existing log group (Option B). This filter defines the error pattern to count and emits a custom metric for the error count. Then, they need to create a CloudWatch alarm that uses a math expression to calculate the error rate by dividing the error count metric by a total request count metric (or by using the same log group with another filter for total requests) and triggers when the rate exceeds 5% over 5 minutes (Option E). Option A is not required because the log group already exists. Option C is incorrect because a subscription filter would forward logs to Lambda, but the requirement is to use metric filters and alarms. Option D is incorrect because the metric is automatically created by the metric filter; you do not need to manually create a separate metric.

Answer

Create a CloudWatch Logs log group for the error metric.

Answer

Create a CloudWatch Logs subscription filter to stream errors to a Lambda function that calculates the error rate.

Answer

Create a CloudWatch metric for the error count.

Question 6

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?

Accepted Answer

AWS Config and AWS Systems Manager Automation. AWS Config rules can detect non-compliant security groups, and Systems Manager Automation can remediate by modifying the security group rules. GuardDuty detects threats but not config compliance. EventBridge alone doesn't remediate. CloudTrail is for auditing API calls.

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Question 7

A company uses CloudFormation to manage infrastructure. They have a nested stack that creates an Amazon RDS instance. When updating the parent stack, the RDS instance is unexpectedly replaced even though no changes were made to its properties. The engineer suspects a 'Drift' detection issue. What is the most likely reason for the replacement?

Accepted Answer

The logical ID of the RDS resource was changed in the nested stack template.. If the logical ID of a resource in the nested stack template is changed, CloudFormation treats it as a new resource and replaces the old one. Option A is incorrect because drift detection does not cause replacement; it only detects changes. Option B is incorrect because a 'Retain' deletion policy prevents deletion but does not prevent replacement. Option D is incorrect because a stack policy may prevent updates but would not cause replacement; it would either allow or block the update.

Answer

The RDS instance has drifted from the template definition.

Answer

The deletion policy is set to 'Retain'.

Answer

The stack policy prevents updates to the RDS instance.

Question 8

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet that needs to download patches from the internet. Which solution is MOST secure and scalable?

Accepted Answer

Create a NAT Gateway in a public subnet and update the private route table.. A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet and receive responses, without allowing inbound traffic. This is the most secure and scalable solution because it is managed by AWS and scales automatically. Option B (a proxy server) is less scalable and requires ongoing management. Option C (assigning an Elastic IP to the private instance) would expose the instance to inbound internet traffic, violating the security of the private subnet. Option D (using a VPC endpoint) is only for accessing AWS services, not general internet patch repositories.

Answer

Launch a proxy server in a public subnet and route traffic through it.

Answer

Assign an Elastic IP to the instance in the private subnet.

Answer

Use a VPC endpoint to the Amazon Linux repository.

Question 9

A team wants to automate the creation of a CI/CD pipeline using a JSON/YAML file that defines source, build, and deploy stages. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define infrastructure as code (IaC) using JSON or YAML templates, which can include the creation of a CI/CD pipeline by defining resources like AWS CodePipeline, CodeBuild, and CodeDeploy. This enables full automation of the pipeline's source, build, and deploy stages through a declarative template, rather than manually configuring each service. The question specifically asks for automating the creation of the pipeline itself using a JSON/YAML file, which is exactly what CloudFormation does.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Question 10

A company uses RDS Multi-AZ with a read replica. During a failover test, the application experiences a 30-second write outage. The application uses a single DB endpoint. How can the outage be minimized?

Accepted Answer

Use RDS Proxy to handle database connections and failover.. RDS Proxy helps minimize write outages during failover by managing database connections efficiently. It maintains connection pools and automatically routes connections to the new primary after failover, reducing the outage window from seconds to sub-second. Option A (increasing instance class) does not affect failover time because failover duration is dominated by DNS propagation and database recovery, not instance size. Option C (Route 53 weighted record with health checks) is not suitable because Multi-AZ failover already handles DNS updates automatically, and using a weighted record with health checks would require additional complexity and still involve DNS propagation delays. Option D (using read replica endpoint for writes) is invalid because read replicas do not accept write operations; they are read-only.

Answer

Increase the instance class to improve failover performance.

Answer

Use a Route 53 weighted record with health checks to point to both instances.

Answer

Configure the application to use the read replica endpoint for writes.

Question 11

Refer to the exhibit. The IAM policy above is attached to a Lambda function's execution role. The Lambda function is supposed to publish custom metrics to CloudWatch using PutMetricData. However, the metrics are not appearing. What is the most likely reason?

Accepted Answer

The function needs to specify a metric name and value when calling PutMetricData.. The most likely reason the metrics are not appearing is that the Lambda function is not providing the required parameters—specifically a metric name and value—when calling PutMetricData. The IAM policy correctly grants the cloudwatch:PutMetricData action, but the API call itself must include at least a MetricName and a Value (or StatisticValues) in the MetricDatum array; otherwise, CloudWatch silently drops the request without publishing any metric. This is a common coding error where the execution role permissions are sufficient but the function logic is incomplete.

Answer

The policy does not include the 'cloudwatch:PutMetricData' action.

Answer

The policy includes unnecessary actions that conflict with each other.

Answer

The policy uses a wildcard resource, which is not allowed for the PutMetricData action.

Question 12

A company uses AWS CodeBuild to compile Java applications. The builds often fail due to insufficient memory. The buildspec currently specifies 'compute-type: BUILD_GENERAL1_SMALL'. What is the most cost-effective solution to resolve the memory issues without changing the build logic?

Accepted Answer

Change the compute-type to 'BUILD_GENERAL1_MEDIUM' or 'BUILD_GENERAL1_LARGE' in the buildspec.. The most direct and cost-effective way to resolve insufficient memory in AWS CodeBuild is to increase the compute type to a larger size (e.g., BUILD_GENERAL1_MEDIUM or BUILD_GENERAL1_LARGE), which provides more memory without altering the build logic. This change incurs additional cost only when builds run, and it avoids unnecessary complexity or invalid approaches.

Answer

Enable Amazon S3 caching for the build artifacts to reduce memory usage.

Answer

Split the build into multiple parallel CodeBuild actions in the pipeline, each compiling a subset of the code.

Answer

Set the environment variable 'MEMORY_OVERPROVISION=2' in the buildspec.

Question 13

A company uses AWS Systems Manager to manage its EC2 instances at scale. The DevOps team wants to ensure that all instances are patched with the latest security updates. Which Systems Manager capability should they use to automate patching?

Accepted Answer

Patch Manager. Patch Manager is the correct choice because it is the dedicated AWS Systems Manager capability designed to automate the process of patching managed instances with security updates and other types of updates. It uses patch baselines to define which patches should be installed and can schedule patching on a recurring basis, ensuring compliance across the EC2 fleet.

Answer

Run Command

Answer

Automation

Answer

State Manager

Question 14

A company runs a web application on an Auto Scaling group of EC2 instances. The operations team uses CloudWatch alarms to monitor the application. They have set up a CPUUtilization alarm that triggers when the average CPU exceeds 70% for 5 minutes. The alarm triggers a scaling policy to add instances. Recently, the team noticed that the alarm frequently triggers during the day, but the application performance is acceptable. They suspect the alarm is too sensitive and want to reduce the number of false alarms. The team wants to keep the alarm responsive to real CPU spikes but avoid triggering on short bursts. What should the team change in the alarm configuration?

Accepted Answer

Increase the number of evaluation periods to 3, so the alarm triggers only if CPU is high for 3 consecutive periods.. The alarm is triggering too frequently due to short CPU bursts. The goal is to reduce false alarms while remaining responsive to sustained high CPU. Increasing the number of evaluation periods requires the CPU to exceed the threshold for multiple consecutive periods before triggering, filtering out transient spikes. Thus, option C is correct. Option A (composite alarm) would add complexity but does not address the sensitivity to short bursts. Option B (reducing period to 1 minute) would make the alarm more sensitive, increasing false alarms. Option D (lowering threshold to 60%) would also increase sensitivity, making false alarms worse.

Answer

Create a composite alarm that combines CPUUtilization with MemoryUtilization.

Answer

Reduce the metric period to 1 minute and keep evaluation periods at 1.

Answer

Lower the threshold to 60% to catch more CPU spikes.

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment fails with a '502 Bad Gateway' error. The developer checks the logs and sees that the application is running but returns errors. The environment uses a load balancer. What is the MOST likely cause?

Accepted Answer

The application is not binding to the correct port or is crashing under load.. A 502 Bad Gateway error from an Elastic Beanstalk environment with a load balancer typically indicates that the reverse proxy (nginx or Apache) is unable to communicate with the application process. Since the logs show the application is running but returning errors, the most likely cause is that the application is not binding to the correct port (expected port 8080 by default) or is crashing under load, causing the proxy to receive no valid response and return a 502.

Answer

The application source bundle is missing a required file.

Answer

The security group of the environment does not allow inbound HTTP traffic.

Answer

The environment's environment variables are misconfigured.

AWS Certified DevOps Engineer Professional DOP-C02 practice test

Three ways to study

Study DOP-C02 by domain

Study DOP-C02 by topic

Configuration Management and IaC practice questions

Resilient Cloud Solutions practice questions

Monitoring and Logging practice questions

Incident and Event Response practice questions

Security and Compliance practice questions

SDLC Automation practice questions

DOP-C02 fundamentals practice questions

DOP-C02 scenario practice questions

DOP-C02 troubleshooting practice questions

Top DOP-C02 questions

AWS Certified DevOps Engineer Professional DOP-C02 practice questions