How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

DOP-C02 · topic practice

Scenario practice questions

Practise AWS Certified DevOps Engineer Professional DOP-C02 Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

6 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

6 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Review the full subnetting walkthrough →

A company uses AWS CodeBuild to compile a Java application. The buildspec.yml includes a 'pre_build' phase that runs SonarQube for static code analysis. The analysis requires access to a private SonarQube server hosted on an EC2 instance in the same VPC. The CodeBuild project is configured with a VPC ID, subnet IDs, and security group IDs. However, the build fails with a timeout when trying to connect to the SonarQube server. The security group for the SonarQube server allows inbound traffic on port 9000 from the CodeBuild security group. What is the MOST likely reason for the failure?

Trap 1: The CodeBuild project is not configured with the correct VPC…

Incorrect subnets would cause a different error, such as failure to launch build container.

Trap 2: The SonarQube server is using a self-signed certificate that…

This would cause an SSL error, not a timeout.

Trap 3: The CodeBuild project does not have internet access, so it cannot…

The SonarQube server is in the same VPC, so internet access is not required.

Study all Scenario common traps →

A
The CodeBuild project is not configured with the correct VPC subnets.
Why wrong: Incorrect subnets would cause a different error, such as failure to launch build container.
B
The security group for the SonarQube server does not allow inbound traffic on port 9000 from the CodeBuild security group.
Without inbound rule from CodeBuild's security group, the connection is blocked.
C
The SonarQube server is using a self-signed certificate that CodeBuild does not trust.
Why wrong: This would cause an SSL error, not a timeout.
D
The CodeBuild project does not have internet access, so it cannot reach the SonarQube server.
Why wrong: The SonarQube server is in the same VPC, so internet access is not required.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Scenario explanation →

An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeVolumes",
        "ec2:CreateSnapshot",
        "ec2:CreateTags"
      ],
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "203.0.113.0/24",
            "198.51.100.0/24"
          ]
        },
        "Bool": {
          "aws:ViaAWSService": "false"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "ec2:DeleteSnapshot",
      "Resource": "arn:aws:ec2:*:*:snapshot/*",
      "Condition": {
        "StringNotEquals": {
          "aws:SourceIdentity": "admin"
        }
      }
    }
  ]
}
```

Trap 1: The policy does not grant ec2:CreateSnapshot on specific resource…

The Allow statement uses Resource '*' which covers all snapshots.

Trap 2: The Deny statement explicitly denies ec2:DeleteSnapshot, but the…

The Deny statement does not affect CreateSnapshot.

Trap 3: The source IP address 203.0.113.0/24 is not included in the…

203.0.113.0/24 is included in the list.

Study all Scenario common traps →

A
The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.
Why wrong: The Allow statement uses Resource '*' which covers all snapshots.
B
The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.
If the tool runs via an AWS service, ViaAWSService is true, failing the condition, so the Allow statement does not apply.
C
The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.
Why wrong: The Deny statement does not affect CreateSnapshot.
D
The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.
Why wrong: 203.0.113.0/24 is included in the list.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full NAT/PAT explanation →

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The operations team needs to run a script on all instances that are missing a specific security patch. Which Systems Manager capability should be used to accomplish this?

Trap 1: Automation

Automation is for multi-step workflows, not simple script execution.

Trap 2: Run Command

Run Command is for one-time execution, not for ongoing compliance.

Trap 3: Patch Manager

Patch Manager is specifically for applying patches, not running custom scripts.

Study all Scenario common traps →

A
Automation
Why wrong: Automation is for multi-step workflows, not simple script execution.
B
State Manager
State Manager can maintain desired state of instances, including running scripts to remediate missing patches.
C
Run Command
Why wrong: Run Command is for one-time execution, not for ongoing compliance.
D
Patch Manager
Why wrong: Patch Manager is specifically for applying patches, not running custom scripts.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Scenario explanation →

A team uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. During a stack update, they need to modify the DB instance class but want to avoid downtime. Which update policy should they use?

Trap 1: Use a CreationPolicy on the DB instance.

CreationPolicy only waits for signals during creation, not for modifications.

Trap 2: Use a WaitCondition to delay the update until maintenance window.

WaitCondition does not control the timing of resource updates.

Trap 3: Use an UpdatePolicy with AutoScalingRollingUpdate.

This policy is for Auto Scaling groups, not RDS.

Study all Scenario common traps →

A
Use a CreationPolicy on the DB instance.
Why wrong: CreationPolicy only waits for signals during creation, not for modifications.
B
Use a WaitCondition to delay the update until maintenance window.
Why wrong: WaitCondition does not control the timing of resource updates.
C
Use a stack policy to prevent replacement of the DB instance.
A stack policy can prevent accidental replacement, but for intentional modifications, you need to allow updates with a policy that requires maintenance window.
D
Use an UpdatePolicy with AutoScalingRollingUpdate.
Why wrong: This policy is for Auto Scaling groups, not RDS.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Scenario explanation →

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack update. The stack contains an AWS::Lambda::Function resource. The update failed with the error 'Resource creation cancelled' after a timeout. The engineer wants to view the logs from the Lambda function during the stack update to diagnose the issue. What should the engineer do?

Trap 1: Use AWS CodeBuild to build and test the function locally

CodeBuild is not related to CloudFormation stack updates

Trap 2: Enable detailed CloudFormation logging in the stack template

CloudFormation does not have detailed logging for function output

Trap 3: Review the CloudFormation stack events in the AWS Management Console

Stack events show resource creation status, not function logs

Study all Scenario common traps →

A
Use AWS CodeBuild to build and test the function locally
Why wrong: CodeBuild is not related to CloudFormation stack updates
B
Enable detailed CloudFormation logging in the stack template
Why wrong: CloudFormation does not have detailed logging for function output
C
Access the CloudWatch Logs log group for the Lambda function
Lambda writes logs to CloudWatch Logs automatically
D
Review the CloudFormation stack events in the AWS Management Console
Why wrong: Stack events show resource creation status, not function logs

Full breakdown with real-world context →

Question 6mediummulti select

Read the full Scenario explanation →

A DevOps engineer is managing infrastructure as code using AWS CloudFormation. The engineer wants to automatically update a stack when changes are pushed to a Git repository. Which THREE services can be used together to achieve this?

Trap 1: Amazon CloudWatch Events

CloudWatch Events can trigger the pipeline, but the question asks for services used together; pipeline itself suffices.

Trap 2: AWS CodeBuild

CodeBuild is not required for updating a CloudFormation stack directly; it can be used for linting but not essential.

Study all Scenario common traps →

A
AWS CloudFormation
CloudFormation is used to update the stack.
B
Amazon CloudWatch Events
Why wrong: CloudWatch Events can trigger the pipeline, but the question asks for services used together; pipeline itself suffices.
C
AWS CodeBuild
Why wrong: CodeBuild is not required for updating a CloudFormation stack directly; it can be used for linting but not essential.
D
AWS CodeCommit
CodeCommit hosts the Git repository with the CloudFormation templates.
E
AWS CodePipeline
CodePipeline can have a source stage from CodeCommit and a deploy stage that updates the CloudFormation stack.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed DOP-C02 session

Frequently asked questions

What does the DOP-C02 exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other DOP-C02 topics?: Use the topic links above to move to related areas, or go back to the DOP-C02 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the DOP-C02 exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed DOP-C02 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All DOP-C02 questions Scenario domain overview DOP-C02 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

Exhibit

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The operations team needs to run a script on all instances that are missing a specific security patch. Which Systems Manager capability should be used to accomplish this?

A team uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. During a stack update, they need to modify the DB instance class but want to avoid downtime. Which update policy should they use?

A DevOps engineer is managing infrastructure as code using AWS CloudFormation. The engineer wants to automatically update a stack when changes are pushed to a Git repository. Which THREE services can be used together to achieve this?

Track your progress over time

Start a Scenario only practice session

Related DOP-C02 topic practice pages

Configuration Management and IaC practice questions

Resilient Cloud Solutions practice questions

Monitoring and Logging practice questions

Incident and Event Response practice questions

Security and Compliance practice questions

SDLC Automation practice questions

DOP-C02 fundamentals practice questions

DOP-C02 scenario practice questions

DOP-C02 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid