DOP-C02 Question Bank · Latest 50 Questions Free Preview (Page 5/5)
Questions 41–50 of the latest 50 DOP-C02 questions (5 pages total), with answers and explanations, no login required. Practice all 951 questions online.
Question 41 · No. 942 · Single choice
A company runs an application on an Amazon Elastic Container Service (Amazon ECS) service by using the AWS Fargate launch type. The application consumes messages from an Amazon Simple Queue Service (Amazon SQS) queue. The application can take several minutes to process each message from the queue. When the application processes a message, the application reads a file from an Amazon S3 bucket and processes the data in the file. The application writes the processed output to a second S3 bucket. The company uses Amazon CloudWatch Logs to monitor processing errors and to ensure that the application processes messages successfully. The SQS queue typically receives a low volume of messages. However, occasionally the queue receives higher volumes of messages. A DevOps engineer needs to implement a solution to reduce the processing time of message bursts. Which solution will meet this requirement in the MOST cost-effective way?
- A. Register the ECS service as a scalable target in AWS Application Auto Scaling. Configure a target tracking scaling policy to scale the service in response to the queue size.
- B. Increase the maximum number of messages that Amazon SQS requests to batch messages together. Use long polling to minimize the number of API calls to Amazon SQS during periods of low traffic.
- C. Send messages to an Amazon EventBridge event bus instead of the SQS queue. Replace the ECS service with an EventBridge rule that launches ECS tasks in response to matching events.
- D. Create an Auto Scaling group of EC2 instances. Create a capacity provider in the ECS cluster by using the Auto Scaling group. Change the ECS service to use the EC2 launch type.
Answer: A
Explanation: Option A is the most cost-effective solution because it uses AWS Application Auto Scaling to dynamically scale the Fargate ECS service based on the SQS queue size. This allows the service to scale up during message bursts (reducing processing time) and scale down during periods of low traffic (minimizing costs). Since Fargate is a serverless launch type, you only pay for the compute resources when tasks are running, making this both elastic and cost-efficient. Option B only optimizes API calls but doesn't address the processing bottleneck during bursts. Option C is inappropriate because EventBridge is designed for short-lived event-driven tasks, not for long-running message processing (several minutes per message). Option D is not cost-effective because EC2 instances typically require continuous running capacity, whereas Fargate scales to zero during low traffic periods.
Question 42 · No. 943 · Single choice
A global company uses Amazon S3 to host its product catalog website in the us-east-1 Region. The company must improve website performance for users across different geographical regions and must reduce the load on the origin server. The company must implement a highly available cross-Region solution that uses Amazon CloudFront. Which solution will meet these requirements with the LEAST operational effort?
- A. Set up multiple CloudFront distributions. Point each distribution to another S3 bucket in a different Region. Use Amazon Route 53 latency-based routing to direct users to the nearest distribution. Enable S3 replication between the S3 bucket in us-east-1 and the S3 bucket in the different Region.
- B. Enable CloudFront with Origin Shield in us-east-1. Configure global edge locations. Set up cache behaviors with optimal TTLs for static content and dynamic content. Configure origin failover to an S3 bucket in a different Region. Enable S3 replication between the S3 bucket in us-east-1 and the S3 bucket in the different Region.
- C. Enable CloudFront with Origin Shield in us-east-1. Configure Amazon ElastiCache clusters in multiple Regions to serve as a distributed caching layer between CloudFront and the S3 origin. Set up a replication script to synchronize the S3 bucket in us-east-1 to an S3 bucket in a different Region. Use Amazon EventBridge to schedule the script to run once a day.
- D. Enable CloudFront with Origin Shield in the eu-west-1 Region. Configure Regional edge caches. Implement AWS Global Accelerator to route requests to the nearest Regional edge location. Enable S3 replication between the S3 bucket in us-east-1 and an S3 bucket in a different Region.
Answer: B
Explanation: Option B is the best choice because it provides a highly available cross-Region solution with the least operational effort. CloudFront with global edge locations automatically routes users to the nearest edge location, improving performance across geographical regions. Origin Shield in us-east-1 (the same region as the origin S3 bucket) effectively reduces the load on the origin server by acting as an additional caching layer. Cache behaviors with optimal TTLs improve cache hit rates for both static and dynamic content. Origin failover to an S3 bucket in a different Region provides high availability, and S3 Cross-Region Replication is a fully managed service that requires no operational overhead. Compared to Option A (multiple distributions = high management effort), Option C (managing ElastiCache and custom replication scripts = high effort), and Option D (Origin Shield in eu-west-1 wouldn't help reduce load on us-east-1 origin, plus Global Accelerator adds unnecessary complexity), Option B offers the optimal balance of performance, availability, and low operational burden.
Question 43 · No. 944 · Single choice
A company is using AWS CodeDeploy to deploy applications to a fleet of Amazon EC2 instances. During a recent deployment, several EC2 instances failed to update successfully. A DevOps engineer must investigate the root cause of the failures and must determine which specific deployment lifecycle events encountered errors. What is the MOST operationally efficient way to access and analyze the detailed deployment logs for troubleshooting?
- A. Use SSH to connect to each EC2 instance that failed to update successfully. Read the logs from the CodeDeploy agent.
- B. Use AWS Systems Manager Session Manager to connect to each EC2 instance that failed to update successfully. Read the logs from the CodeDeploy agent.
- C. Create an Amazon S3 bucket to store CodeDeploy logs. Update the appspec.yml file to copy logs to the S3 bucket. Query the S3 bucket by using Amazon Athena
- D. Send CodeDeploy agent logs to Amazon CloudWatch Logs by using the CloudWatch agent. Analyze the logs by using CloudWatch Logs Insights.
Answer: D
Explanation: Sending the CodeDeploy agent logs to Amazon CloudWatch Logs and querying them with CloudWatch Logs Insights provides centralized, scalable log analysis. This avoids connecting to each failed EC2 instance individually and is more operationally efficient than using SSH, Session Manager, or an invalid S3 logging approach.
Question 44 · No. 945 · Single choice
A company built its serverless infrastructure on AWS. The infrastructure consists of an Amazon API Gateway REST API, multiple AWS Lambda functions, and Amazon EventBridge. The company wants to be aware of any new supply chain attacks that the company's CI/CD pipelines do not catch. The company needs a solution to detect malicious activity in the deployed application. Which solution meets these requirements?
- A. Enable AWS WAF for the API Gateway REST API. Configure an AWS WAF ACL. Add the known bad inputs managed rule group.
- B. Enable Amazon GuardDuty. Enable Lambda Protection. Use EventBridge for event notifications.
- C. Deploy AWS CloudFormation Guard in the CI/CD pipelines. Write rules to catch the supply chain attacks.
- D. Create a firewall in AWS Network Firewall. Configure a policy. Add the managed rule for the Emerging Threats rule group.
Answer: B
Explanation: Amazon GuardDuty with Lambda Protection is the correct solution because it specifically monitors Lambda function execution environments for malicious activity, including detecting compromised code from supply chain attacks. GuardDuty can identify suspicious behaviors like crypto mining, backdoors, and data exfiltration within deployed Lambda functions. EventBridge can then be used to route these security findings to notifications or remediation workflows. Option A (WAF) only protects API endpoints from web attacks but cannot detect malicious code within Lambda. Option C (CloudFormation Guard) validates infrastructure templates in CI/CD but does not address attacks already in deployed applications. Option D (Network Firewall) operates at network level and doesn't inspect application behavior in serverless functions.
Question 45 · No. 946 · Single choice
A company has a stateless web application that is deployed on Amazon EC2 instances. The EC2 instances are in a target group behind an Application Load Balancer (ALB). Amazon Route 53 manages the application domain. The company updates the application UI and develops a beta version of the application. The company wants to test the beta version on 10% of its traffic. Which solution will meet these requirements with the LEAST number of configuration changes?
- A. Deploy the beta version to new EC2 instances in a new target group. Associate the new target group with a new ALB. Update the existing Route 53 record to use a weighted routing policy. Add a new Route 53 record that points to the new ALB with the same routing policy. Assign a weight of 90 to the existing record. Assign a weight of 10 to the new record.
- B. Deploy the beta version to new EC2 instances in a new target group. Associate the new target group with the same ALB listener rule. Assign a weight of 90 to the existing target group. Assign a weight of 10 to the new target group.
- C. Refactor the application to implement a feature flag for the beta version by using AWS AppConfig. Use the feature flag to enable the beta version for 10% of the EC2 instances.
- D. Containerize and deploy the application on Amazon Elastic Container Service (Amazon ECS). Use AWS CodeDeploy to deploy the beta version by using the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration.
Answer: B
Explanation: Option B is the best choice because it requires the least number of configuration changes. It only involves deploying the beta version to new EC2 instances in a new target group and associating that new target group with the existing ALB listener rule with weights (90% for existing, 10% for beta). The existing ALB and Route 53 setup remain unchanged. Option A requires creating a new ALB and changing Route 53 records (more changes). Option C requires code refactoring to implement feature flags (significant changes). Option D requires containerization and migration to ECS (major changes).
Question 46 · No. 947 · Single choice
A company frequently creates Docker images of an application. The company stores the images in Amazon Elastic Container Registry (Amazon ECR). The company creates both tagged images and untagged images. The company wants to implement a solution to automatically delete images that have not been updated for a long time and are not frequently used. The solution must retain at least a specified number of images. Which solution will meet these requirements with the LEAST operational overhead?
- A. Use Amazon S3 Lifecycle policies on the ECR repository to automatically delete images based on image age or the absence of tags on the image.
- B. Use Amazon ECR lifecycle policies to delete images based on age or the number of images that need to be to retained in the repository.
- C. Configure an AWS Lambda function to run a schedule to delete images based on age or the number of images that need to be retained in the repository.
- D. Use AWS Systems Manager to run a script by using the aws:executeScript action to automatically delete images based on image age or the absence of tags on the image.
Answer: B
Explanation: Amazon ECR has native lifecycle policy support that allows automatic deletion of images based on age (for untagged images) or based on the number of images, with the ability to set a minimum number of images to retain. This is the built-in solution designed specifically for ECR image management and requires the least operational overhead because it doesn't require managing additional AWS services like Lambda functions or Systems Manager scripts. ECR lifecycle policies are configured directly on the repository and run automatically without any custom code or additional infrastructure.
Question 47 · No. 948 · Single choice
A company uses AWS Lambda functions in the primary operating AWS Region of its AWS account. The company manually created the Lambda functions. The company needs to use a Python-based AWS Cloud Development Kit (AWS CDK) application to manage the Lambda functions. Which solution meets these requirements with the LEAST implementation effort?
- A. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create an AWS CDK application from the scanned resources. Download the AWS CDK application. For each Lambda function, set the from_asset parameter for the Lambda handler code object.
- B. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create a CloudFormation template from the scanned resources. Download the CloudFormation template. For each Lambda function, replace the Code/S3Bucket property and the Code/S3Key property with the Code/ZipFile property. Convert the CloudFormation template to an AWS CDK application.
- C. Start a partial scan by using the AWS CloudFormation infrastructure as code (IaC) generator. Filter by the Lambda resource type. Create a CloudFormation template from the scanned resources. Download the CloudFormation template. For each Lambda function, replace the Code/S3Bucket property and the Code/S3Key property with the Code/ImageUri property. Convert the CloudFormation template to an AWS CDK application.
- D. Create a resource inventory by using AWS Config. Filter by the Lambda resource type. Export the inventory to a .csv file. Write an AWS CDK application that references the Lambda functions from the .csv file. For each Lambda function, set the from_asset parameter for the Lambda handler code object.
Answer: A
Explanation: Option A is the best choice because the AWS CloudFormation IaC generator can directly create an AWS CDK application from the scanned resources, eliminating the need for an intermediate CloudFormation template conversion step. Additionally, using the 'from_asset' parameter for the Lambda handler code object packages the Lambda code directly with the CDK application, removing the dependency on S3 buckets (Code/S3Bucket and Code/S3Key) for storing the deployment package. This approach requires the least implementation effort compared to the other options, which involve additional steps such as template conversion, manual property replacement, or setting up AWS Config inventories and CSV exports.
Question 48 · No. 949 · Single choice
A company produces builds for an open source project every day. The company hosts the open source project in a public code repository that the company supports. The company manually invokes a pipeline in AWS CodePipeline to build artifacts for the project. The company wants to make the build artifacts publicly available on a website that the company hosts in an Amazon S3 bucket. Which solution will meet these requirements with the LEAST operational overhead?
- A. Create an AWS CodeBuild project. Set the public repository as the source. Use a webhook to rebuild when the company pushes a code change. Configure the artifacts section of the project to use the S3 bucket as the destination. Set up an appropriate path to store build outputs in the bucket. Disable artifact encryption.
- B. Create an AWS CodeBuild project. Set the public repository as the source. Configure the artifacts section of the project to use the S3 bucket as the destination. Ensure that artifact encryption is enabled in the artifacts configuration. Configure an Amazon EventBridge rule to initiate the CodeBuild project on a daily schedule.
- C. Add a new stage to the end of the pipeline. Configure the stage to include an action to publish artifacts to the S3 bucket. Update the pipeline to run in response to pull requests to the public repository.
- D. Add a new stage to the end of the pipeline. Configure the stage to include an action to publish artifacts to the S3 bucket. Create an Amazon EventBridge rule to initiate the pipeline on a daily schedule.
Answer: A
Question 49 · No. 950 · Single choice
An ecommerce company hosts a web application on Amazon EC2 instances that are in an Auto Scaling group. The company deploys the application across multiple Availability Zones. Application users are reporting intermittent performance issues with the application. The company enables basic Amazon CloudWatch monitoring for the EC2 instances. The company identifies and implements a fix for the performance issues. After resolving the issues, the company wants to implement a monitoring solution that will quickly alert the company about future performance issues. Which solution will meet this requirement?
- A. Enable detailed monitoring for the EC2 instances. Create custom CloudWatch metrics for application-specific performance indicators. Set up CloudWatch alarms based on the custom metrics. Use CloudWatch Logs Insights to analyze application logs for error patterns.
- B. Use AWS X-Ray to implement distributed tracing. Integrate X-Ray with Amazon CloudWatch RUM. Use Amazon EventBridge to trigger automatic scaling actions based on custom events.
- C. Use Amazon CloudFront to deliver the application. Use AWS CloudTrail to monitor API calls. Use AWS Trusted Advisor to generate recommendations to optimize performance. Use Amazon GuardDuty to detect potential performance issues.
- D. Enable VPC Flow Logs. Use Amazon Data Firehose to stream flow logs to Amazon S3. Use Amazon Athena to analyze the logs and to send alerts to the company.
Answer: A
Explanation: Option A is the correct choice because it provides a comprehensive monitoring solution specifically designed to alert on application performance issues. Detailed monitoring increases metric granularity to 1-minute intervals (compared to 5-minute basic monitoring), allowing for quicker detection of performance anomalies. Custom CloudWatch metrics allow tracking application-specific performance indicators (not just infrastructure metrics), and CloudWatch alarms trigger immediate notifications when thresholds are breached. CloudWatch Logs Insights further enhances the ability to identify error patterns. Options B, C, and D focus on distributed tracing/CDN delivery/security/network flow logs respectively, which are not optimal for directly alerting on application performance issues.
Question 50 · No. 951 · Multiple choice
A company deploys a web application on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The company stores the application code in an AWS CodeConnections compatible Git repository. When the company merges code to the main branch, an AWS CodeBuild project is initiated. The CodeBuild project compiles the code, stores the packaged code in AWS CodeArtifact, and invokes AWS Systems Manager Run Command to deploy the packaged code to the EC2 instances. Previous deployments have resulted in defects, EC2 instances that were not running the latest version of the packaged code, and inconsistencies between instances. A DevOps engineer needs to improve the reliability of the deployment solution. Which combination of actions will meet this requirement? (Choose two.)
- A. Create a pipeline in AWS CodePipeline that uses the Git repository as the source provider. Configure the pipeline to have parallel build and test stages. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action.
- B. Create a pipeline in AWS CodePipeline that uses the Git repository as the source provider. Configure the pipeline to have a build stage followed by a test stage. In the pipeline, pass the CodeBuild project output artifact to an AWS CodeDeploy action.
- C. Create an AWS CodeDeploy application and a deployment group to deploy the packaged code to the EC2 instances. Configure the ALB for the deployment group.
- D. Create individual AWS Lambda functions that use AWS CodeDeploy instead of Systems Manager to run build, test, and deploy actions.
- E. Create an Amazon S3 bucket. Modify the CodeBuild project to store the packages in the S3 bucket instead of in CodeArtifact. Use deploy actions in CodeDeploy to deploy the artifact to the EC2 instances.
Answer: B, C
Explanation: The correct combination is B and C. Option B establishes a proper CI/CD pipeline using AWS CodePipeline with a sequential build stage followed by a test stage, which addresses the defects issue by ensuring code is tested after compilation. The pipeline uses CodeDeploy for deployment, which is more reliable than Systems Manager Run Command. Option C creates the necessary CodeDeploy application and deployment group configured with the ALB, which ensures consistent deployment across EC2 instances and handles the issue of instances running inconsistent versions of code. Option A is incorrect because parallel build and test stages are not logical (testing depends on build output). Option D incorrectly introduces Lambda functions unnecessarily since CodeDeploy handles deployments natively. Option E unnecessarily replaces CodeArtifact with S3, which doesn't address the core reliability issues - CodeArtifact was working fine for storage, the problem was in the deployment mechanism.