Courseiva

AWS Certified DevOps Engineer Professional DOP-C02 (DOP-C02) — Questions 226–251

251 questions total · 4pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 4

226
MCQhard

Refer to the exhibit. A DevOps engineer deploys this CloudFormation template. The EC2 instance launches, but the httpd service does not start. The engineer connects to the instance and finds that the user data script did not run. What is the most likely cause?

A.The UserData is not base64 encoded correctly
B.The AMI does not have yum installed
C.The tags prevent user data from executing
D.The AMI uses a different init system than systemd
AnswerB

The `yum` command is specific to RPM-based distributions that use YUM as the package manager, such as older Amazon Linux (AL1/AL2) or CentOS 7. If the AMI is based on Amazon Linux 2023, which uses `dnf`, or on Ubuntu/Debian, which uses `apt`, the `yum` binary will not be present. When the UserData script runs `yum` on such an AMI, the shell returns a 'command not found' error, preventing the installation and causing the deployment to fail.

Why this answer

The most likely cause is that the AMI does not have yum installed. The CloudFormation template's UserData script uses yum to install httpd, but if the AMI is based on a distribution that does not use yum (e.g., Amazon Linux 2023 uses dnf, or Ubuntu uses apt), the script will fail silently or not execute as intended. Since the script itself is valid and the instance launched, the failure is due to the package manager not being available, preventing the httpd service from starting.

Exam trap

The trap here is that candidates often assume the issue is with base64 encoding or the init system, but the real problem is a mismatch between the package manager used in the UserData script and the one available on the AMI.

How to eliminate wrong answers

Option A is wrong because the UserData is automatically base64 encoded by CloudFormation when passed as a string in the template, so encoding is not an issue. Option C is wrong because tags do not affect the execution of user data scripts; tags are metadata and have no impact on the instance's initialization process. Option D is wrong because the init system (systemd vs.

SysVinit) does not prevent user data from running; user data scripts are executed by cloud-init, which works regardless of the init system, and the script itself does not rely on systemd commands.

Full explanation →
227
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team needs to centrally monitor and analyze VPC Flow Logs from all accounts. The solution must be cost-effective and allow querying across accounts. Which approach should they take?

A.Use Amazon Elasticsearch Service (Amazon OpenSearch Service) with a cross-account ingestion pipeline.
B.Stream VPC Flow Logs from each account to Amazon Kinesis Data Analytics for real-time analysis.
C.Send VPC Flow Logs from each account to a centralized Amazon S3 bucket, then use Amazon Athena to query the logs.
D.Configure each account to send VPC Flow Logs to a central CloudWatch Logs group using cross-account subscription.
AnswerC

Sending VPC Flow Logs from each account to a centralized Amazon S3 bucket is correct because it creates a single, durable, cost-effective data lake that scales to petabytes. You configure each account's VPC Flow Logs to deliver to the same S3 bucket (with a bucket policy allowing cross-account delivery, ideally scoped to your AWS Organization ID). Then Amazon Athena can query these logs directly using standard SQL, with per-query pricing and no server to manage; using partition projection on account, region, and date drastically reduces scan costs and speeds up investigations.

Why this answer

It uses a centralized Amazon S3 bucket to aggregate VPC Flow Logs from all accounts, which is cost-effective (S3 storage costs are low) and enables cross-account querying via Amazon Athena using standard SQL. This approach avoids per-ingestion costs of services like CloudWatch Logs or Kinesis and provides a serverless, scalable query engine for analyzing logs across accounts.

Exam trap

The trap here is that candidates may overestimate the complexity of cross-account S3 access or underestimate the cost of CloudWatch Logs ingestion, leading them to choose Option D (central CloudWatch Logs group) which seems simpler but is actually more expensive and less query-friendly than S3+Athena.

How to eliminate wrong answers

Option A is wrong because Amazon OpenSearch Service (formerly Elasticsearch Service) incurs significant costs for ingestion and storage, and cross-account ingestion pipelines require complex setup with Lambda or Kinesis, making it less cost-effective than S3+Athena. Option B is wrong because Amazon Kinesis Data Analytics is designed for real-time stream processing, not for cost-effective historical querying across accounts; it would be overkill and expensive for periodic analysis of VPC Flow Logs. Option D is wrong because CloudWatch Logs cross-account subscriptions require each account to send logs to a central account's CloudWatch Logs group, which incurs per-ingestion costs and does not natively support SQL-based querying like Athena; querying across accounts would require additional tools or cross-account log group access, increasing complexity and cost.

Full explanation →
228
MCQeasy

Refer to the exhibit. This S3 bucket policy allows the root user of account 111122223333 to perform which actions?

A.Change the bucket policy
B.Delete objects from the bucket
C.Read and write objects in the bucket
D.List objects in the bucket
AnswerC

This policy grants the root principal s3:GetObject and s3:PutObject actions on the arn:aws:s3:::bucket/* resource. s3:GetObject allows downloading an object's data and metadata, while s3:PutObject allows uploading a new object or overwriting an existing one. Together, these actions explicitly authorize reading and writing objects inside the bucket, which is exactly what the question asks — making this the correct option.

Why this answer

The policy grants s3:GetObject and s3:PutObject to the root user of the specified account. It does not grant other actions. The resource is objects under my-bucket.

The principal is the root user of the other account.

Full explanation →
229
Multi-Selectmedium

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application stores session data in a shared Amazon ElastiCache for Redis cluster. The operations team reports that during a recent AZ failure, users experienced session loss and application errors. Which combination of actions should the company take to improve resilience and maintain session state during an AZ failure? (Choose TWO.)

Select 2 answers
A.Configure the ALB with cross-zone load balancing enabled and connection draining set to a suitable timeout.
B.Deploy an Auto Scaling group with a dynamic scaling policy that adds instances in the remaining AZs.
C.Enable cluster mode for the ElastiCache for Redis cluster and configure replica nodes in different Availability Zones.
D.Configure the application to use a custom DNS name with a low TTL pointing to the ElastiCache cluster endpoint.
E.Enable Multi-AZ for the ElastiCache cluster to automatically fail over to a replica in another AZ.
AnswersA, C

Cross-zone load balancing on the ALB ensures that incoming traffic is distributed evenly across all registered targets in every Availability Zone, preventing any single AZ from being overloaded and allowing the ALB to continue serving requests even if one AZ is impaired. Connection draining gives in-flight requests a grace period to complete before an instance is deregistered or replaced, avoiding request interruption during rolling updates or failed health checks. Together, these features support seamless instance replacement without dropping active requests, though they do not on their own preserve stored session data — they protect the connection lifecycle while the application layer (e.g., ElastiCache) handles state.

Why this answer

Enabling cross-zone load balancing on the ALB ensures traffic is distributed evenly across all EC2 instances in all AZs, and connection draining with a suitable timeout allows in-flight requests to complete before instances are deregistered, preventing session loss during an AZ failure. Option C is correct because enabling cluster mode for ElastiCache for Redis with replica nodes in different AZs provides automatic sharding and replication, ensuring session data remains available and consistent even if a primary node in one AZ fails. Option E is incorrect because while ElastiCache for Redis supports Multi-AZ with automatic failover, it alone does not guarantee that replica nodes are placed in different Availability Zones for each shard; enabling cluster mode with replicas in different AZs (Option C) provides a more comprehensive solution for maintaining session state during an AZ failure.

Exam trap

Candidates may choose Multi-AZ (Option E) thinking it provides cross-AZ failover for ElastiCache for Redis, which is true. However, Multi-AZ with automatic failover requires replication groups with replicas in different AZs. In a cluster-mode setup, you must explicitly ensure replicas are in different AZs per shard.

Option C directly addresses this by enabling cluster mode and configuring replica nodes in different AZs, making Option C a more complete solution for the given scenario of a shared cluster.

Full explanation →
230
MCQmedium

A company runs a stateful application on EC2 instances. The application stores session data locally. The instances are behind an ALB with sticky sessions enabled. A scaling event terminates an instance, causing loss of session data. How can the company prevent this while maintaining performance?

A.Use Amazon ElastiCache to store session data
B.Use a dedicated EC2 instance for sessions
C.Disable sticky sessions
D.Increase the sticky session duration
AnswerA

ElastiCache provides a resilient, high-performance session store.

Why this answer

Using ElastiCache for session storage externalizes session data, making it resilient to instance termination.

Full explanation →
231
Multi-Selecthard

A DevOps engineer is designing an infrastructure as code solution for a microservices application that runs on Amazon ECS with Fargate. The application requires a shared Application Load Balancer (ALB) and multiple ECS services. Which CloudFormation resources are required to expose each service behind the ALB? (Choose THREE.)

Select 3 answers
A.AWS::ElasticLoadBalancingV2::Listener
B.AWS::ElasticLoadBalancingV2::LoadBalancer
C.AWS::ECS::Service
D.AWS::ElasticLoadBalancingV2::ListenerRule
E.AWS::AutoScaling::AutoScalingGroup
AnswersA, C, D

The listener receives incoming traffic on a specific port.

Why this answer

AWS::ElasticLoadBalancingV2::Listener is correct because it defines the protocol and port (e.g., HTTP:80) on which the ALB accepts traffic. Without a listener, the ALB cannot receive incoming requests. This resource is essential for routing traffic to target groups that are associated with ECS services.

Exam trap

The trap here is that candidates often select the LoadBalancer resource (Option B) thinking it is required for each service, but the LoadBalancer is a shared resource created once, while the Listener, ListenerRules, and ECS Service are the per-service components that enable routing.

Full explanation →
232
Multi-Selectmedium

A company is building a multi-tier web application on AWS. The application must be resilient to the failure of an entire Availability Zone. The architecture includes an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group, and an Amazon RDS for MySQL database. Which TWO actions should be taken to achieve this resilience? (Choose two.)

Select 2 answers
A.Configure an RDS read replica in a different Availability Zone.
B.Use a Single-AZ RDS for MySQL database to keep costs low.
C.Place all EC2 instances in the same Availability Zone to reduce cross-AZ data transfer costs.
D.Configure the Auto Scaling group to launch EC2 instances in at least two Availability Zones.
E.Deploy the RDS for MySQL database in a Multi-AZ configuration.
AnswersD, E

Distributing instances across AZs provides high availability for the web tier.

Why this answer

Configuring the Auto Scaling group to launch EC2 instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) can continue serving traffic. This is a fundamental pattern for building AZ-resilient compute tiers. Option E is correct because deploying Amazon RDS for MySQL in a Multi-AZ configuration automatically provisions and maintains a synchronous standby replica in a different AZ, providing automatic failover if the primary DB instance fails, thus ensuring database resilience.

Exam trap

The trap here is that candidates often confuse read replicas (asynchronous, for read scaling) with Multi-AZ deployments (synchronous, for high availability), and mistakenly think placing all resources in one AZ reduces costs without recognizing the critical single point of failure it introduces.

Full explanation →
233
Multi-Selecthard

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with timeout errors. The DevOps team needs to troubleshoot the root cause. Which THREE actions should they take? (Select THREE.)

Select 3 answers
A.Use AWS CloudTrail to review Canary API calls.
B.Increase the canary timeout configuration to allow more time for the endpoint to respond.
C.Check the EC2 instance CPU utilization in the VPC where the canaries run.
D.Review VPC Flow Logs to see if requests are being dropped or denied.
E.Examine the canary logs in CloudWatch Logs for error messages.
AnswersB, D, E

If the timeout is too low, increasing it may resolve false positives.

Why this answer

Options B, D, and E are correct. B: Increasing the canary timeout configuration can resolve timeout errors if the endpoint is slow but still functional. D: Reviewing VPC Flow Logs helps identify network issues such as dropped or denied requests that could cause timeouts.

E: Examining canary logs in CloudWatch Logs provides detailed error messages and execution traces to pinpoint the failure cause. Option A is incorrect because CloudTrail records API calls, not canary execution details; canary logs are in CloudWatch Logs. Option C is incorrect because canaries run in AWS Lambda, not on EC2 instances, so EC2 CPU utilization is irrelevant.

Full explanation →
234
MCQmedium

A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?

A.Configure the web server on the EC2 instances to only respond to HTTPS requests.
B.Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.
C.Configure the security group of the ALB to only allow inbound HTTPS traffic.
D.Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.
AnswerB

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS. This is the correct pattern because ALB listeners combine a protocol/port with rule actions: the HTTP (port 80) listener can have a rule that returns a 301/302 redirect to the same path on the HTTPS listener (port 443). This enforces HTTPS at the access point, automatically upgrades clients, and leaves web servers free to handle only HTTP/HTTPS as needed, typically with TLS terminated at the ALB.

Why this answer

An ALB can be configured with an HTTPS listener and a redirect rule that sends HTTP traffic to HTTPS, enforcing encrypted transit at the load balancer level. Option A is incorrect because configuring the web server to only respond to HTTPS does not prevent HTTP traffic from reaching the ALB; the ALB would still accept HTTP. Option C is incorrect because security groups filter traffic based on ports and IP addresses but cannot redirect HTTP to HTTPS; they only allow or deny traffic.

Option D is incorrect because while CloudFront can redirect HTTP to HTTPS, the question asks for a configuration on the ALB itself, not an additional service.

Full explanation →
235
MCQeasy

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is Blue/Green. During a recent deployment, the new instances passed all health checks, but traffic was not routed to them. What is the most likely reason?

A.The target group associated with the Auto Scaling group is not properly configured to route traffic.
B.The deployment group is not configured to use a load balancer.
C.The Auto Scaling group's lifecycle hook failed to signal readiness.
D.The CodeDeploy agent on the new instances is not installed.
AnswerA

The target group tied to the Auto Scaling group acts as the traffic-routing endpoint for the load balancer. If its health check path, port, or timeout settings are misconfigured—or if it is not attached to the appropriate listener rule—the newly deployed instances will be registered but immediately marked unhealthy and deregistered, so no user traffic reaches them. CodeDeploy itself successfully completes its scripts, but the deployment outcome appears as a routing failure, not an instance-level failure.

Why this answer

In a Blue/Green deployment with CodeDeploy and an Auto Scaling group, traffic routing is handled by a load balancer target group. If the target group is not properly configured to route traffic to the new instances (e.g., missing or incorrect listener rules, deregistration delay, or health check thresholds), the instances may pass health checks but never receive traffic. This is the most likely cause because the deployment succeeded in provisioning and validating the new instances, but the load balancer did not forward requests to them.

Exam trap

The trap here is that candidates often assume health check success guarantees traffic routing, but in AWS, health checks only verify instance readiness; traffic routing depends on separate load balancer listener rules and target group associations.

How to eliminate wrong answers

Option B is wrong because if the deployment group were not configured to use a load balancer, CodeDeploy would not attempt to route traffic via a load balancer at all; the issue described is that traffic was not routed, implying a load balancer is present but misconfigured. Option C is wrong because a lifecycle hook failure would prevent the instance from completing its launch or termination process, typically causing the instance to remain in a 'Pending:Wait' state and fail health checks, not pass them. Option D is wrong because if the CodeDeploy agent were not installed, the deployment would fail during the Install phase on the new instances, and they would not pass health checks or reach the 'Succeeded' state.

Full explanation →
236
Multi-Selecteasy

A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)

Select 3 answers
A.Run Command
B.OpsCenter
C.Parameter Store
D.Patch Manager
E.State Manager
AnswersA, D, E

Run Command is a Systems Manager capability that lets you execute shell scripts or PowerShell commands on one or more EC2 instances via the SSM Agent, without the need for SSH/RDP or opening inbound ports. By invoking documents like AWS-RunShellScript or AWS-RunPowerShellScript, you can directly enforce configuration settings, install software, or remediate configuration drift on demand. It supports rate control, error thresholds, and IAM-based permission scoping, making it a direct and flexible mechanism for enforcing instance configuration.

Why this answer

Run Command (A) is correct because it allows you to remotely and securely execute scripts or commands across EC2 instances without needing SSH or RDP, using an SSM document (SSM Document) that defines the desired configuration actions. This capability directly enforces a desired state by running idempotent scripts on demand or on a schedule.

Exam trap

The trap here is confusing Parameter Store (a data store) with a configuration management tool, or thinking OpsCenter (an operations dashboard) can enforce state, when only Run Command, State Manager, and Patch Manager directly execute actions to achieve and maintain a desired configuration.

Full explanation →
237
MCQmedium

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team needs to monitor application performance and troubleshoot slow API responses. They currently use Amazon CloudWatch Logs for container logs and have enabled Container Insights. However, they are unable to see detailed latency breakdowns per API endpoint. Which solution would provide the most granular visibility into API performance?

A.Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.
B.Enable CloudWatch Logs Insights to query API logs for slow requests.
C.Use AWS X-Ray to instrument the application and collect trace data.
D.Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.
E.Set up VPC Flow Logs to analyze network latency between services.
AnswerC

AWS X-Ray provides end-to-end tracing with segment details, allowing you to see latency per API endpoint and downstream dependencies.

Why this answer

AWS X-Ray provides end-to-end tracing of requests as they travel through microservices, capturing detailed latency breakdowns per API endpoint, including downstream calls, database queries, and external HTTP requests. This gives the operations team the granular visibility needed to pinpoint exactly where slow responses occur, unlike aggregated metrics or log-based queries.

Exam trap

The trap here is that candidates confuse infrastructure-level metrics (CPU, memory, network) or log-based querying with the distributed tracing capability needed to break down latency per API endpoint, overlooking that only X-Ray provides end-to-end trace segments with sub-millisecond timing per service call.

How to eliminate wrong answers

Option A is wrong because enabling detailed CloudWatch metrics for ECS and Fargate (CPU, memory, network) provides infrastructure-level metrics, not per-endpoint latency breakdowns. Option B is wrong because CloudWatch Logs Insights can query logs for slow requests but cannot trace a single request across multiple services or show the latency contributed by each downstream call. Option D is wrong because the AWS Distro for OpenTelemetry collector sends metrics and traces to CloudWatch, but without X-Ray integration or trace sampling, it does not provide the per-endpoint latency breakdowns that X-Ray's service map and trace segments offer.

Option E is wrong because VPC Flow Logs capture network-level metadata (packet headers, timestamps) and can indicate network latency between ENIs, but they cannot reveal application-level latency per API endpoint or trace a request through microservices.

Full explanation →
238
MCQmedium

A company requires that all access to their S3 buckets be encrypted in transit. Which configuration achieves this?

A.Use CloudFront with the bucket as origin and enforce HTTPS only between viewer and CloudFront.
B.Enable default encryption on the bucket.
C.Use a bucket policy that denies requests when aws:SecureTransport is false.
D.Set the bucket policy to require SSE-KMS.
AnswerC

Correctly enforces HTTPS by denying non-secure transport.

Why this answer

Using a bucket policy with a condition that denies requests when `aws:SecureTransport` is `false` explicitly enforces encryption in transit for all access to the S3 bucket. This policy ensures that any HTTP (non-TLS) request is denied, while HTTPS requests are allowed, meeting the requirement that all access be encrypted in transit.

Exam trap

The trap here is confusing encryption in transit with encryption at rest; candidates often pick options like default encryption or SSE-KMS, which only address data at rest, not the requirement for HTTPS enforcement.

How to eliminate wrong answers

Option A is wrong because it only enforces HTTPS between the viewer and CloudFront, but the connection between CloudFront and the S3 origin can still be HTTP unless an additional policy or setting enforces HTTPS there, leaving a gap in transit encryption. Option B is wrong because default encryption on the bucket only encrypts data at rest (server-side encryption), not in transit; it does not enforce HTTPS for client connections. Option D is wrong because requiring SSE-KMS enforces encryption at rest using AWS KMS keys, but it does not control whether the data is transmitted over HTTPS or HTTP; transit encryption is a separate concern.

Full explanation →
239
MCQeasy

A DevOps engineer is creating an AWS CloudFormation template to deploy a stack that includes an Amazon EC2 instance. The instance needs to be launched in a specific subnet. How should the engineer reference the subnet ID in the template?

A.Hardcode the subnet ID in the template.
B.Use a mapping (Mappings) to define the subnet ID based on the stack name.
C.Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.
D.Use the Fn::GetAtt function to retrieve the subnet ID from a VPC resource.
AnswerC

Defining a parameter of type AWS::EC2::Subnet::Id lets the caller supply the actual subnet at stack creation or update, and CloudFormation validates that the value is a real subnet ID. Referencing it via Ref keeps the template portable across environments, and the parameter appears in the console or CLI for clear input.

Why this answer

Defining a parameter of type `AWS::EC2::Subnet::Id` allows the CloudFormation template to accept a subnet ID as input at stack creation or update time, making the template reusable across different environments without modification. This approach follows infrastructure-as-code best practices by avoiding hardcoded values and enabling parameterized deployments.

Exam trap

The trap here is that candidates often confuse Fn::GetAtt with the ability to retrieve any resource attribute from any stack, but Fn::GetAtt only works for resources defined in the same template and cannot fetch a subnet ID from an existing VPC resource unless that VPC resource itself outputs the subnet ID.

How to eliminate wrong answers

Option A is wrong because hardcoding the subnet ID makes the template environment-specific and non-portable, violating the principle of reusable infrastructure-as-code. Option B is wrong because Mappings are used to define static lookup tables based on keys like region or environment, not to dynamically accept user-provided subnet IDs; the stack name is not a reliable key for subnet selection. Option D is wrong because Fn::GetAtt retrieves attributes from resources defined within the same template, but if the VPC and subnet are not created in the same stack, there is no resource to reference; even if they were, Fn::GetAtt on a VPC resource returns VPC-level attributes (e.g., VpcId), not a subnet ID.

Full explanation →
240
MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During an incident, the primary DB instance becomes unreachable. The failover to the standby instance succeeds, but application connections are failing with 'Access denied for user'. What is the most likely cause?

A.The DNS CNAME for the RDS endpoint has not propagated to the application's DNS resolver
B.The standby instance has a different storage configuration than the primary
C.The application is using the old master user credentials that were changed on the primary but not replicated to the standby
D.The security group for the RDS instance does not allow inbound traffic from the application's new IP address
AnswerC

Credentials are not replicated across Multi-AZ; they must be the same.

Why this answer

The most likely cause is that the application is using credentials that were changed on the primary but not replicated to the standby. In RDS Multi-AZ, changes made via the RDS console or API (e.g., modifying the master password) are automatically replicated, but direct SQL modifications (e.g., ALTER USER) are not. After failover, the standby becomes the new primary with the old credentials, causing 'Access denied for user' errors.

Option A is incorrect because DNS CNAME propagation delays cause connection timeouts, not authentication failures. Option B is incorrect because storage configuration differences do not affect authentication. Option D is incorrect because the security group remains associated with the RDS instance and the application's IP address does not change during failover.

Full explanation →
241
MCQhard

Refer to the exhibit. A DevOps engineer is troubleshooting an issue where an IAM user is unable to stop an EC2 instance with the tag 'Environment: Development'. The attached IAM policy is shown. Which statement explains the failure?

A.The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.
B.The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.
C.The Allow statement only grants ec2:DescribeInstances, not start/stop.
D.The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.
AnswerC

The policy's only explicit Allow is ec2:DescribeInstances; because ec2:StopInstances is a separate action in the IAM action namespace, no permission is granted to perform a stop. When the user calls StopInstances, IAM finds no allow and defaults to an implicit deny, so the API request fails. The Deny statement on RunInstances does not counteract this, so the missing start/stop Allow is precisely the cause.

Why this answer

The IAM policy in the exhibit only grants ec2:DescribeInstances and explicitly denies ec2:RunInstances with a condition. It does not include an Allow for ec2:StopInstances. By default, IAM denies any action that is not explicitly allowed.

Therefore, the user lacks permission to stop instances, including the Development-tagged instance. Option C correctly identifies this as the reason for the failure. Option D is incorrect because the policy itself denies stop implicitly due to the missing Allow; it is not necessary to invoke another policy or SCP.

Exam trap

The trap here is that candidates misread the Deny statement's action (ec2:RunInstances) and condition (StringNotEquals) as applying to stopping instances, when in fact it only affects launching instances, leading them to incorrectly select Option A or B without noticing the action mismatch.

How to eliminate wrong answers

Option A is wrong because the Deny statement uses ec2:RunInstances, not ec2:StopInstances, and the StringNotEquals condition applies to launching instances, not stopping them; it does not deny stopping Development instances. Option B is wrong because the Deny statement explicitly lists ec2:RunInstances, and AWS IAM does not implicitly include ec2:StopInstances under termination actions; stop and terminate are separate actions. Option C is wrong because while the Allow statement only grants ec2:DescribeInstances, the question asks why the user cannot stop the instance; the lack of an explicit allow for ec2:StopInstances would cause a default implicit deny, but the policy itself does not prevent stopping—the failure must be from another policy or SCP, as the provided policy does not deny stop actions.

Full explanation →
242
MCQmedium

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage using AWS CodeBuild. Developers notice that the deployed application occasionally crashes due to missing environment variables that were configured in the Elastic Beanstalk environment but not passed from CodeBuild. What is the MOST efficient way to ensure the environment variables are consistently applied?

A.Define environment variables in the source code using .ebextensions configuration files.
B.Update the environment variables manually in the Elastic Beanstalk console after each deployment.
C.Use the aws elasticbeanstalk update-environment CLI command after the pipeline completes.
D.Store environment variables in AWS Systems Manager Parameter Store and have the application retrieve them at runtime.
AnswerA

Commit the variables in a .ebextensions/*.config file (e.g., option_settings for namespace aws:elasticbeanstalk:application:environment). CodePipeline packages the entire source into the application version, and the Elastic Beanstalk deployment agent processes this file automatically, injecting the values into the Node.js process's environment. This makes environment configuration declarative, versioned, and reproducible for every pipeline run, eliminating manual or post-deployment steps.

Why this answer

Ebextensions configuration files allow you to define environment variables declaratively in the source code, ensuring they are consistently applied during every deployment via CodePipeline. This approach eliminates the dependency on runtime or manual steps, as the Elastic Beanstalk environment automatically reads these files during environment creation and updates. It integrates seamlessly with CodeBuild and CodePipeline, making it the most efficient and reliable method for maintaining environment variable consistency.

Exam trap

The trap here is that candidates often assume runtime parameter retrieval (e.g., from Parameter Store or Secrets Manager) is the best practice for all scenarios, but for environment variables required at process startup in Elastic Beanstalk, .ebextensions provide a more reliable and simpler solution that avoids application code changes and ensures variables are set before the application runs.

How to eliminate wrong answers

Option B is wrong because manually updating environment variables in the Elastic Beanstalk console after each deployment is error-prone, not scalable, and violates the principle of infrastructure as code, leading to configuration drift. Option C is wrong because using the aws elasticbeanstalk update-environment CLI command after the pipeline completes introduces an extra post-deployment step that can fail or be forgotten, and it does not tie the variables to the source code version, making rollbacks inconsistent. Option D is wrong because while Parameter Store can be used for runtime retrieval, it requires application code changes to fetch variables at startup, adds latency, and does not guarantee the variables are present during the Elastic Beanstalk environment initialization, potentially causing crashes before the application code runs.

Full explanation →
243
MCQhard

A company runs a containerized microservices application on Amazon EKS. The application includes a critical service that processes real-time financial transactions. This service must be highly available and resilient to node failures. The current setup uses a Deployment with 3 replicas and a ClusterIP service. During a recent node failure, the application experienced a brief period of unavailability. Which action should the DevOps engineer take to improve resilience without changing the underlying infrastructure?

A.Change the service type from ClusterIP to NodePort and configure an external load balancer.
B.Increase the number of replicas to 10 and use a node selector to schedule all pods on the largest instance type.
C.Configure a PodDisruptionBudget with a maxUnavailable of 1, and add pod anti-affinity rules to spread pods across different nodes.
D.Enable HorizontalPodAutoscaler with a target CPU utilization of 50% to automatically scale the Deployment.
AnswerC

A PodDisruptionBudget with maxUnavailable:1 guarantees that at most one Pod is unavailable during voluntary evictions such as node drains, and pod anti-affinity rules (preferably with topologyKey kubernetes.io/hostname) force the scheduler to place replicas on distinct nodes. This means an involuntary node failure can kill only one replica, and the remaining replicas continue to serve traffic. Combined, these mechanisms directly address both failure classes—involuntary hardware failures and voluntary maintenance—by ensuring the application always has at least N-1 replicas available across different failure domains.

Why this answer

A PodDisruptionBudget with maxUnavailable=1 ensures that at most one pod is unavailable during voluntary disruptions, while pod anti-affinity rules force the scheduler to distribute pods across different nodes. This combination prevents a single node failure from taking down all replicas, maintaining service availability without altering the underlying infrastructure.

Exam trap

The trap here is that candidates often confuse scaling (HPA or more replicas) with resilience, failing to realize that without proper pod distribution and disruption budgets, scaling alone cannot prevent downtime from node failures.

How to eliminate wrong answers

Option A is wrong because changing to NodePort with an external load balancer adds network complexity and does not address pod distribution or node failure resilience; the ClusterIP service already provides internal load balancing. Option B is wrong because increasing replicas to 10 and using node selector to pin pods to the largest instance type actually reduces resilience by creating a single point of failure on that node. Option D is wrong because HorizontalPodAutoscaler scales based on CPU utilization, which does not protect against node failures; it may even exacerbate the problem by scaling pods onto the same failing nodes.

Full explanation →
244
MCQmedium

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that critical resources, such as an RDS database, are not accidentally deleted when a stack is updated or deleted. Which CloudFormation feature should be used to prevent this?

A.DeletionPolicy attribute with Retain
B.Stack policy
C.Termination protection
D.DependsOn attribute
AnswerA

DeletionPolicy: Retain on a resource instructs AWS CloudFormation to preserve that physical resource when the stack is deleted. Without it, DeleteStack removes every resource in the template; with Retain, the resource is simply left in place and becomes orphaned, allowing you to keep critical data such as databases or S3 buckets. This is the standard way to prevent accidental data loss during stack deletion.

Why this answer

The DeletionPolicy attribute with the Retain value is the correct choice because it explicitly instructs CloudFormation to preserve the physical resource (e.g., an RDS database) when its corresponding logical resource is deleted from the stack template during an update or when the entire stack is deleted. This prevents accidental deletion of critical stateful resources by ensuring the resource remains in the AWS account even after the stack operation completes.

Exam trap

The trap here is that candidates confuse termination protection (an EC2-specific feature) with CloudFormation's DeletionPolicy, or mistakenly think a stack policy can prevent deletion during a full stack deletion, when it only restricts update operations.

How to eliminate wrong answers

Option B is wrong because a stack policy is an IAM-like resource-level policy that controls which stack resources can be updated or deleted during a stack update, but it does not prevent deletion when the entire stack is deleted; it only restricts update/delete actions during an update operation. Option C is wrong because termination protection is an EC2 instance-level feature that prevents accidental termination of an EC2 instance, not a CloudFormation feature and not applicable to RDS databases. Option D is wrong because the DependsOn attribute only specifies resource creation order within a stack template; it has no effect on preventing deletion of resources during stack updates or deletions.

Full explanation →
245
MCQeasy

A DevOps engineer must ensure that all API calls in an AWS account are logged for compliance. The logs should be stored in an S3 bucket with server-side encryption enabled. Which two services should be used together to meet these requirements?

A.AWS CloudTrail and Amazon CloudWatch Logs
B.AWS CloudTrail and Amazon S3
C.Amazon VPC Flow Logs and Amazon S3
D.AWS Config and AWS CloudTrail
AnswerB

CloudTrail logs API calls and delivers to S3, which supports server-side encryption.

Why this answer

AWS CloudTrail logs all API calls in the account and can deliver these logs to an S3 bucket, where server-side encryption (SSE) can be enabled for compliance. Option A (AWS CloudTrail and Amazon CloudWatch Logs) can capture API calls, but the requirement is to store logs in an S3 bucket with encryption, not CloudWatch Logs. Option C (Amazon VPC Flow Logs and Amazon S3) captures network traffic, not API calls.

Option D (AWS Config and AWS CloudTrail) includes AWS Config, which tracks resource configuration changes, not API calls; CloudTrail alone suffices for API logging, but Config is not needed for this requirement.

Full explanation →
246
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?

A.Use IAM Access Analyzer to validate the roles against a policy template.
B.Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.
C.Run AWS Trusted Advisor and check the IAM report for roles with long session durations.
D.Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.
AnswerB

The AWS Config managed rule iam-role-max-session-duration evaluates every IAM role in the account, comparing each role's MaxSessionDuration setting against the rule's maxSessionDuration parameter. This rule is triggered proactively on configuration changes and periodically, so it detects both existing and newly modified roles, flagging any role whose allowed session duration exceeds the defined threshold as noncompliant. It integrates with AWS Organizations and can be remediated automatically or through Config conformance packs.

Why this answer

AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to evaluate resource configurations (like IAM role session duration) with CloudTrail's event logging or IAM Access Analyzer's policy analysis, leading them to choose options that detect creation events rather than continuously assess the current state of all roles.

How to eliminate wrong answers

Option A is wrong because IAM Access Analyzer is designed to analyze resource-based policies (like S3 bucket policies or KMS key policies) for unintended public or cross-account access, not to validate IAM role session duration settings against a policy template. Option C is wrong because AWS Trusted Advisor checks for IAM use (e.g., unused IAM users, MFA on root) but does not include a specific check for IAM role maximum session duration. Option D is wrong because while CloudTrail can log `CreateRole` and `UpdateAssumeRolePolicy` events, a metric filter cannot directly evaluate the `MaxSessionDuration` parameter from the event; it would require complex custom parsing and still not provide ongoing compliance evaluation like AWS Config.

Full explanation →
247
MCQhard

A DevOps team is implementing a blue/green deployment strategy for a microservice running on Amazon ECS with AWS CodeDeploy. They want to shift 10% of traffic to the new task set for 5 minutes, then shift the remaining 90%. Which deployment configuration should they use?

A.CodeDeployDefault.ECSAllAtOnce
B.CodeDeployDefault.ECSLinear10PercentEvery1Minutes
C.CodeDeployDefault.ECSCanary10Percent5Minutes
D.Custom configuration with 10% initial traffic and 100% after 5-minute interval
AnswerC

The built-in deployment configuration CodeDeployDefault.ECSCanary10Percent5Minutes instructs CodeDeploy to initially route 10% of the load balancer's traffic to the new ECS task set (the green environment) while the remaining 90% continues to go to the blue task set. After a 5-minute waiting period, during which health checks and metrics can be evaluated, CodeDeploy automatically shifts the remaining 90% of traffic to green, completing the deployment. This two-step canary pattern exactly satisfies the requirement for a 10% initial shift with a 5-minute soak before the final 90% cutover.

Why this answer

The built-in configuration `CodeDeployDefault.ECSCanary10Percent5Minutes` shifts 10% of traffic to the new task set, holds for 5 minutes, then shifts the remaining 90%. This matches the requirement exactly. A custom configuration (D) is unnecessary and not a standard deployment configuration.

Exam trap

Candidates often confuse the canary and linear configurations. `CodeDeployDefault.ECSCanary10Percent5Minutes` shifts 10% instantly and then holds for 5 minutes before shifting the rest. The linear configuration, `CodeDeployDefault.ECSLinear10PercentEvery1Minutes`, shifts 10% every minute over 10 minutes without a hold.

How to eliminate wrong answers

Option A is wrong because CodeDeployDefault.ECSAllAtOnce shifts 100% of traffic to the new task set immediately, which does not match the 10% then 90% gradual shift requirement. Option B is wrong because CodeDeployDefault.ECSLinear10PercentEvery1Minutes shifts 10% of traffic every 1 minute until 100%, resulting in a linear progression over 10 minutes, not a 5-minute wait at 10% followed by a single 90% shift. Option C is wrong because CodeDeployDefault.ECSCanary10Percent5Minutes shifts 10% for 5 minutes and then automatically shifts the remaining 90% immediately after the 5-minute interval, which does not allow the 5-minute hold at 10% before the final shift as specified; it completes the deployment in one canary step.

Full explanation →
248
Multi-Selecthard

A security audit reveals that an S3 bucket contains objects that are publicly accessible. The DevOps engineer must prevent any future public access to the bucket and all objects within it. Which THREE actions should the engineer take? (Choose THREE.)

Select 3 answers
A.Enable Block Public Access settings on the bucket.
B.Disable object ACLs on the bucket.
C.Remove any bucket policy that grants public read access.
D.Apply an SCP that denies s3:PutBucketPolicy that would make objects public.
E.Enable S3 server access logging.
AnswersA, C, D

Enabling Block Public Access (BPA) on the bucket is the correct immediate remediation because it applies four distinct settings—BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets—that override all existing and future public access grants, including those from object ACLs, bucket policies, and access point policies. This is the most direct and comprehensive way to seal the bucket at the resource level until a full audit can be completed, and it prevents accidental re-publication through any subsequent misconfiguration.

Why this answer

Enabling block public access settings on the bucket prevents any future public access, including through ACLs or bucket policies. Option C is correct because removing any bucket policy that grants public read access eliminates one potential vector for public access. Option D is correct because applying an SCP that denies s3:PutBucketPolicy actions that would make objects public ensures that no account in the organization can create a policy that grants public access.

Option B is incorrect because disabling object ACLs only removes one method of granting public access; bucket policies can still allow public access. Option E is incorrect because enabling server access logging helps with auditing but does not prevent public access.

Full explanation →
249
MCQhard

A company uses AWS Lambda with Amazon DynamoDB to process orders. During peak hours, the Lambda function sometimes fails with throttling errors from DynamoDB. The system must be resilient and cost-effective. What should a DevOps engineer do?

A.Use Amazon SQS to buffer the requests and have Lambda pull from the queue with a reserved concurrency limit.
B.Increase the DynamoDB provisioned read and write capacity units to a high fixed value.
C.Provision DynamoDB Accelerator (DAX) to cache reads and reduce throttling.
D.Configure DynamoDB auto scaling and implement a dead-letter queue in Lambda to retry failed events.
AnswerD

DynamoDB auto scaling adjusts provisioned capacity based on actual usage, preventing most throttling, but it cannot anticipate sudden one-off spikes because it relies on trends. A Lambda dead-letter queue, combined with the function's built-in retries and exponential backoff, ensures that any event which still fails due to a throttle is safely captured for manual or automated replay rather than silently dropped. This two-tier approach balances elasticity with data durability, which is why it is the recommended solution for unpredictable write spikes.

Why this answer

Configuring DynamoDB auto scaling allows the table to adjust its provisioned capacity based on actual traffic patterns, preventing throttling during peak hours while remaining cost-effective during low usage. Implementing a dead-letter queue (DLQ) in Lambda ensures that failed events (e.g., due to transient throttling) are captured and can be retried or investigated, providing resilience without manual intervention.

Exam trap

The trap here is that candidates may confuse read caching solutions (DAX) or queue-based decoupling (SQS) with the direct need to scale write capacity and handle retries, overlooking the combination of auto scaling and DLQ as the most resilient and cost-effective approach for write-throttling scenarios.

How to eliminate wrong answers

Option A is wrong because using Amazon SQS to buffer requests and having Lambda pull from the queue with a reserved concurrency limit does not directly address DynamoDB throttling; it only controls Lambda concurrency, not the underlying DynamoDB capacity, and could still result in throttling if the database cannot handle the aggregate write volume. Option B is wrong because increasing DynamoDB provisioned read and write capacity units to a high fixed value is not cost-effective; it leads to over-provisioning during off-peak hours and does not adapt to variable traffic, contradicting the requirement for a cost-effective solution. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for read operations only; it does not mitigate write throttling errors, which are the primary issue described in the scenario.

Full explanation →
250
MCQhard

A DevOps engineer is reviewing the CodePipeline structure above. The pipeline fails during the Deploy stage with an error: 'The deployment group could not be found.' What is the most likely cause?

A.The pipeline is configured as a single-region pipeline, but the Deploy action is in a different region.
B.The source artifact is not accessible from us-west-2.
C.The CodeDeploy application does not exist in us-west-2.
D.The CodeBuild project is not configured to output artifacts.
AnswerA

In CodePipeline, every pipeline is bound to a single region. If a Deploy action references a CodeDeploy application in another region, it is treated as a cross-region action and must be explicitly configured with the Region property. Without that, the pipeline attempts to execute the action in us-east-1, where no deployment group exists, producing the 'Deployment group not found' error. The fix is to add the cross-region configuration or move the Deploy action to the same region.

Why this answer

The error 'The deployment group could not be found' indicates that CodePipeline is attempting to invoke a CodeDeploy deployment in a region where the specified deployment group does not exist. If the pipeline is configured as a single-region pipeline (e.g., in us-east-1) but the Deploy action references a deployment group in a different region (e.g., us-west-2), CodePipeline will fail because it cannot resolve the deployment group across regions in a single-region pipeline configuration. Cross-region actions require explicit cross-region action configuration in the pipeline structure.

Exam trap

The trap here is that candidates often confuse the error message 'deployment group could not be found' with the deployment group not existing at all (Option C), rather than recognizing it as a region mismatch issue where the deployment group exists but in a different region than the pipeline.

How to eliminate wrong answers

Option B is wrong because the source artifact's accessibility from us-west-2 would cause a different error, such as 'Artifact not found' or 'Access denied', not a deployment group not found error. Option C is wrong because if the CodeDeploy application did not exist in us-west-2, the error would be 'The application could not be found' or 'Application does not exist', not specifically about the deployment group. Option D is wrong because a CodeBuild project not configured to output artifacts would cause the pipeline to fail earlier in the Build stage or during artifact retrieval, not during the Deploy stage with a deployment group error.

Full explanation →
251
MCQmedium

A DevOps team uses AWS CodePipeline with a multi-branch strategy. The pipeline should deploy to production only from the 'main' branch, but run unit tests for all branches. How should the team configure the pipeline?

A.Configure the pipeline source stage to trigger on all branches, use branch-specific logic in the test stage, and add a manual approval step for production deployment only when the branch is 'main'.
B.Use an AWS Lambda function to check the branch name and invoke different CodePipeline executions for testing and deployment.
C.Create one pipeline with two source stages: one for 'main' and one for all other branches, each with its own test and deploy actions.
D.Create a separate pipeline for each branch, each with identical test and deploy stages.
AnswerA

Configuring the source stage to trigger on all branches is the recommended approach because CodePipeline natively supports branch filters on source actions, allowing a single pipeline to react to every branch push. Branch-specific logic can then be implemented in the test stage using environment variables or run-time conditions to vary test suites, while a manual approval action can be conditionally added to the deploy stage only when the branch is 'main'. This leverages built-in pipeline features, avoids duplication, and keeps the deployment workflow centralized and auditable, which is the most scalable and maintainable design.

Why this answer

AWS CodePipeline supports branch filtering in the source stage to trigger on all branches, and you can use a condition in the deploy stage (e.g., via a Lambda function or a manual approval step) to restrict production deployment to the 'main' branch only. This approach avoids duplicating pipelines while ensuring unit tests run for every branch, meeting the multi-branch strategy requirement efficiently.

Exam trap

The trap here is that candidates may think they need separate pipelines or multiple source stages to handle branch-specific logic, but CodePipeline's branch filtering and conditional actions (like Lambda checks or manual approvals) allow a single pipeline to handle all branches efficiently.

How to eliminate wrong answers

Option B is wrong because invoking separate CodePipeline executions via a Lambda function for testing and deployment adds unnecessary complexity and breaks the single-pipeline model; CodePipeline natively supports branch-based conditions without external orchestration. Option C is wrong because having two source stages in one pipeline is not supported—CodePipeline allows only one source stage per pipeline, and mixing branches in separate source stages would cause conflicts in artifact handling. Option D is wrong because creating a separate pipeline for each branch violates the DRY principle, increases maintenance overhead, and does not leverage CodePipeline's built-in branch filtering and conditional execution capabilities.

Full explanation →
Page 3

Page 4 of 4

All pages

1234

Practice DOP-C02 by domain

Target a specific domain to shore up weak areas.

Configuration Management and IaCResilient Cloud SolutionsMonitoring and LoggingIncident and Event ResponseSecurity and ComplianceSDLC Automation
See all domains with question counts →