DOP-C02 Question Bank · Latest 50 Questions Free Preview (Page 2/5)
Questions 11–20 of the latest 50 DOP-C02 questions (5 pages total), with answers and explanations, no login required. Practice all 951 questions online.
Question 11 · No. 912 · Single choice
A company builds container images and stores them on Amazon Elastic Container Registry (Amazon ECR) in the company's primary AWS Region. A DevOps engineer wants to replicate all the company's ECR repository images to a secondary Region. The DevOps engineer creates a new ECR repository in the secondary Region and configures permission on the new repository to allow replication. Which solution will meet these requirements with the MOST operational efficiency?
- A. Pull the existing primary ECR images and then push the images to the secondary ECR repository. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry.
- B. Pull the existing primary ECR images and then push the images to the secondary ECR repository. Configure permission on the primary ECR registry to allow access from the secondary Region.
- C. Configure permission on the primary ECR registry to allow access from the secondary Region. Create a replication rule on the primary ECR registry to replicate the images to the secondary ECR registry.
- D. Configure an AWS Lambda function to automatically save the ECR images to an Amazon S3 bucket. Configure cross-Region replication for the S3 bucket. Configure a second Lambda function to push the images to ECR repositories in the replication destination Region when images are replicated to the S3 bucket.
Answer: A
Question 12 · No. 913 · Single choice
A company has deployed a microservices-based application on Amazon Elastic Container Service (Amazon ECS). The application is experiencing performance issues. The company needs to identify which microservices are causing the issues. Which solution will provide this information?
- A. Configure AWS X-Ray for each ECS task. Create an X-Ray group for each microservice. Implement custom X-Ray subsegments in each microservice to capture detailed timing information. Use an X-Ray service map to visualize and identify slow microservices and requests.
- B. Configure AWS X-Ray for each ECS task. Use an X-Ray service map to visualize the application's architecture and request flow. Filter the X-Ray traces by response time and error rate. Identify the microservices that have high latency or high error rates. Analyze individual traces to identify slow microservices and requests.
- C. Configure Amazon CloudWatch Container Insights for each ECS task. Analyze Container Insights metrics to identify slow microservices. Use CloudWatch Logs Insights to filter the Container Insights log data by response time and error rate. Analyze the log data to identify slow requests.
- D. Configure Amazon CloudWatch Container Insights for each ECS task. Use the CloudWatch automatic dashboard for Amazon ECS to identify slow microservices. Use CloudWatch Logs Insights to analyze the Container Insights performance logs for each ECS task to identify slow requests.
Answer: B
Explanation: Option B is the most effective solution because AWS X-Ray is specifically designed for distributed tracing in microservices architectures. It provides a service map that visualizes the application’s architecture and request flow, allowing engineers to quickly identify performance bottlenecks. By filtering traces based on response time and error rate, and then analyzing individual traces, teams can pinpoint which microservices are causing latency or errors. While Option A also uses X-Ray, it adds unnecessary complexity with custom subsegments and groups, which aren't required for basic identification of slow services. Options C and D rely on CloudWatch Container Insights, which provides infrastructure-level metrics (like CPU, memory) but lacks the detailed request-level tracing that X-Ray offers, making it less suitable for identifying problematic microservices in a distributed system.
Question 13 · No. 914 · Single choice
A company is developing a web application that runs on Amazon EC2 Linux instances. The application requires monitoring of custom performance metrics. The company must collect metrics for API response times and database query latency across multiple instances. Which solution will generate the custom metrics with the LEAST operational overhead?
- A. Install the Amazon CloudWatch agent on the instances. Configure the agent to collect the custom metrics. Instrument the application to send the metrics to the agent.
- B. Use Amazon Managed Service for Prometheus to scrape the custom metrics from the application. Use the Amazon CloudWatch agent to forward the metrics to CloudWatch.
- C. Create a custom AWS Lambda function that polls the application endpoints and database at regular intervals. Program the Lambda function to calculate the custom metrics and to send the metrics to Amazon CloudWatch by using PutMetricData API calls.
- D. Implement custom logging in the application code to record the custom metrics. Use Amazon CloudWatch Logs Insights to extract and analyze the metrics.
Answer: A
Explanation: Option A is the best solution because the Amazon CloudWatch agent is purpose-built for collecting custom metrics from EC2 instances with minimal operational overhead. Once installed and configured, it can continuously collect custom metrics (such as API response times and database query latency) via the StatsD protocol or by running collection scripts. The agent is natively integrated with CloudWatch, so no additional forwarding services are required. Option B adds overhead by introducing Prometheus and requiring metric forwarding. Option C requires creating and maintaining a Lambda function with polling logic and API calls, which is operationally intensive. Option D requires custom logging and using CloudWatch Logs Insights to derive metrics, which is not efficient for metric generation. Therefore, Option A provides the least operational overhead while effectively meeting the requirements.
Question 14 · No. 915 · Single choice
A company's applications run on Amazon EC2 instances and use AWS Lambda functions in multiple AWS accounts. All EC2 instances have the Amazon CloudWatch agent installed. All accounts belong to the same organization in AWS Organizations. The company has created a dedicated central log account. All logs that the applications produce must be sent to a central location. The logs must be encrypted with keys that the company manages. Which solution meets these requirements with the LEAST operational overhead?
- A. In the central log account, enable logs as the data source in CloudWatch. Add the organization ID to the source account list. Create a CloudFormation StackSet by using the template provided by CloudWatch to enable central monitoring in all the organization's accounts.
- B. Create an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream in the central log account. Set the S3 bucket as the destination of the Firehose stream. Create a log subscription in the central log account. Set the Firehose stream as a target of the subscription. Store the subscription log ARN in AWS Systems Manager Parameter Store for each project to use to send logs to the S3 bucket.
- C. Create an Amazon S3 bucket in each account. Create an Amazon OpenSearch Service cluster in the central log account. Create an Amazon Simple Queue Service (Amazon SQS) queue in the central log account. Create an S3 trigger that sends events to the SQS queue each time a new file is uploaded to the S3 bucket. Create a Lambda function that processes each file and sends each file to the OpenSearch Service cluster.
- D. Create an Amazon S3 bucket in the central log account. Create an Amazon Data Firehose stream in each account. Set the S3 bucket as the destination of the Firehose streams. Create a log subscription in each account with the Firehose streams as a target.
Answer: A
Explanation: Option A uses CloudWatch cross-account observability, which is designed specifically for centralizing logs and metrics across accounts within an AWS Organization. By enabling logs as a data source in the central log account and using a CloudFormation StackSet provided by CloudWatch, the setup is automated across all organization accounts with minimal manual configuration. This approach has the least operational overhead compared to the other options, which require creating multiple resources (Firehose streams, SQS queues, Lambda functions, log subscriptions) in each individual account and maintaining them separately. CloudWatch cross-account observability also supports encryption using customer-managed KMS keys, meeting the encryption requirement.
Question 15 · No. 916 · Single choice
A company uses Amazon Elastic Kubernetes Services (Amazon EKS) to host containerized applications that are available in Amazon Elastic Container Registry (Amazon ECR). The company currently launches EKS clusters in the company's development environment by using the AWS CLI aws eks create-cluster command. The company uses the aws eks create-addon command to install required add-ons. All installed add-ons are currently version compatible with the version of Kubernetes that the company uses. All clusters exclusively use managed node groups for compute capacity. Some of the EKS clusters require a version upgrade. A DevOps engineer must ensure that upgrades continuously occur within the AWS standard support schedule. Which solution will meet this requirement with the LEAST operational overhead?
- A. Run the aws eks update-cluster-version command. Providing appropriate arguments such as cluster name and version number.
- B. Enable EKS Auto Mode on all EKS clusters. Remove all existing managed node groups.
- C. Run the eksctl command to upgrade the EKS clusters. Provide appropriate arguments such as cluster name and version number
- D. Refactor the environment to create EKS clusters by using infrastructure as code (IaC). Upgrade the clusters by using code changes.
Answer: B
Explanation: EKS Auto Mode is designed to automate cluster management tasks including Kubernetes version upgrades. It automatically manages version upgrades to keep clusters within the AWS standard support schedule, which requires the least operational overhead for continuous upgrades. While option A and C involve manual execution of CLI commands for each upgrade, and option D requires significant refactoring to use IaC, EKS Auto Mode handles upgrades automatically once enabled.
Question 16 · No. 917 · Single choice
A company uses a pipeline in AWS CodePipeline to upload AWS CloudFormation templates to an Amazon S3 bucket. The pipeline uses the templates to deploy CloudFormation stacks that match the names of the templates. The company has experienced issues when it tries to revert templates to a previous version. To prevent these issues, the company must have the ability to review template modifications before the modifications are deployed to production. Which solution will meet these requirements with the LEAST operational overhead?
- A. Configure a connection in AWS CodeConnections to a Git repository. Store the templates in the Git repository. Configure a pull request workflow to review template modifications. Configure AWS CloudFormation Git sync for the stacks.
- B. Add a manual review action in the pipeline to review modifications to the template code before the stack deployments.
- C. Update the pipeline to invoke an AWS Lambda function to check the template modifications before the stack deployments.
- D. Configure a connection in AWS CodeConnections to a Git repository. Store the templates in the Git repository. Configure the pipeline to include a source action that uses the connection. Add a manual review action to the pipeline to review template modifications before the stack deployments.
Answer: A
Question 17 · No. 918 · Single choice
A company manages environments for its application in multiple AWS accounts. Each environment account is in a different OU in AWS Organizations. A DevOps team is responsible for the application deployment process across the environments. The deployment process uses an AWS CodePipeline pipeline in a Shared Services account. The DevOps team members are in the same user group. The team members have administrative access to all accounts through AWS IAM Identity Center. A recent deployment problem in the development environment required the DevOps team to perform manual steps. The deployment to the production environment then resulted in an incident that caused the pipeline to fail, which blocked new deployments for several hours. A DevOps engineer needs to ensure that only the pipeline can perform deployments in the production environment. The DevOps engineer must have access to the environment in case of an emergency. Which solution will meet these requirements with the MOST operational efficiency?
- A. Update the DevOps group to have the ReadOnlyAccess permission set for the production accounts. Configure the DevOps engineer user with a new permission set that has AdministratorAccess permissions and that allows the user to assume the pipeline role. Add an SCP that denies modification of resources by any entity other than the pipeline role.
- B. Create an SCP that denies all write actions for the DevOps team members on the production OU. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the pipeline role.
- C. Update the DevOps group to be able to assume the pipeline role for the production accounts. Configure a new user in IAM Identity Center for the DevOps engineer with a new permission set that has AdministratorAccess permissions. Add an SCP that denies modification of resources by any entity other than the DevOps engineer.
- D. Create an SCP that denies all write actions for the DevOps team members on the production OU. Use a specific tag to tag the resources that CodePipeline provisions. Add an SCP that denies modification of tagged resources by any entity other than the DevOps engineer.
Answer: A
Explanation: Option A is the most operationally efficient solution. It modifies the existing DevOps group's permission set to ReadOnlyAccess for production accounts (limiting team member access), creates a new permission set for the DevOps engineer with AdministratorAccess and the ability to assume the pipeline role, and adds an SCP that denies resource modification by any entity other than the pipeline role. This approach: (1) Ensures only the pipeline performs deployments because team members have ReadOnlyAccess and the SCP blocks direct modification by anyone except the pipeline role; (2) Gives the DevOps engineer emergency access by allowing them to assume the pipeline role; (3) Maintains operational efficiency by using the existing engineer identity rather than creating a new user (unlike options B and C), and avoids the tagging complexity and pipeline update restrictions of option D.
Question 18 · No. 919 · Single choice
A company is experiencing failures in its AWS CodeDeploy deployments for a critical application. The application is deployed on Amazon EC2 instances. A DevOps engineer must analyze the failed deployments to identify the root cause of the failures. Which solution will provide the appropriate information to troubleshoot the deployment issues?
- A. Configure VPC Flow Logs to monitor network traffic. Use Amazon Inspector to detect non-network deployment issues. Use Amazon Detective to analyze the findings.
- B. Enable detailed monitoring on the EC2 instances. Use AWS Systems Manager Run Command to run troubleshooting scripts on all the EC2 instances simultaneously. Analyze the results in AWS CloudTrail logs.
- C. Use Amazon CloudWatch Logs to review application logs. Analyze CodeDeploy deployment logs in the /opt/codedeploy-agent/deployment-root/ directory on the EC2 instances. Use AWS X-Ray to trace requests through the application components.
- D. Examine AWS Trusted Advisor checks for the CodeDeploy deployments. Use the AWS Health Dashboard to monitor application health. Analyze performance metrics in Amazon CloudWatch dashboards.
Answer: C
Explanation: Option C is the correct answer because it provides the most appropriate tools for troubleshooting CodeDeploy deployment failures. Amazon CloudWatch Logs is the standard service for collecting and reviewing application logs. The /opt/codedeploy-agent/deployment-root/ directory is the exact location where the CodeDeploy agent stores its deployment logs on EC2 instances, which is essential for identifying what went wrong during the deployment process. AWS X-Ray helps trace requests through application components, which is useful for identifying application-level issues that may have caused the failure. Option A uses tools not designed for CodeDeploy troubleshooting. Option B incorrectly suggests using CloudTrail logs to analyze Run Command results (CloudTrail logs API calls, not script output). Option D uses Trusted Advisor and Health Dashboard, which are not designed for diagnosing specific CodeDeploy deployment failures.
Question 19 · No. 920 · Multiple choice
A company has developed a web application that conducts seasonal sales on public holidays. The web application is deployed on AWS and uses AWS services for storage, database, computing, and encryption. During seasonal sales, the company expects high network traffic from a large number of users. The company must receive insights regarding any unexpected behavior during the sale. A DevOps team wants to review the insights upon detecting anomalous behaviors during the sale. The DevOps team wants to receive recommended actions to resolve the anomalous behaviors. The recommendations must be provided on the provisioned infrastructure to address the issues that might occur in the future. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
- A. Enable Amazon DevOps Guru in the AWS account. Determine the coverage for DevOps Guru for all supported AWS resources in the account. Use the DevOps Guru dashboard to find the analysis, recommendations, and related metrics.
- B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon DevOps Guru to send notifications about important events to the company when anomalies are identified.
- C. Create an Amazon S3 bucket. Store Amazon CloudWatch logs, AWS CloudTrail data, and AWS Config data in the S3 bucket. Use Amazon Athena to generate insights on the data. Create a dashboard by using Amazon QuickSight.
- D. Configure email message reports for an Amazon QuickSight dashboard. Schedule and send the email reports to the company.
- E. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure Amazon Athena to send query results about important events to the company when anomalies are identified.
Answer: A, B
Explanation: Options A and B together best meet the requirements with the least operational overhead. Option A enables Amazon DevOps Guru, which is a fully managed ML-powered service that automatically detects anomalous behaviors, provides insights, and gives recommendations on provisioned infrastructure through its dashboard. Option B complements this by creating an SNS topic that DevOps Guru can integrate with to send notifications to the DevOps team when anomalies are identified, allowing them to review insights promptly. Options C, D, and E require manual setup, custom dashboards, or use services (like Athena) that are not designed for automatic anomaly detection, resulting in much higher operational overhead.
Question 20 · No. 921 · Single choice
A DevOps engineer needs to design a cloud-based solution to standardize deployment artifacts for AWS Cloud deployments and on-premises deployments. There is currently no routing traffic between the on-premises data center and the AWS environment. The solution must be able to consume downstream packages from public repositories and must be highly available. Data must be encrypted in transit and at rest. The solution must store the deployment artifacts in object storage and deploy the deployment artifacts into Amazon Elastic Container Service (Amazon ECS). The deployment artifacts must be encrypted in transit if the deployment artifacts travel across the public internet. The DevOps engineer needs to deploy this solution in less than two weeks. Which solution will meet these requirements?
- B. Use an AWS Direct Connect connection and a VPN connection to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.
- C. Use two AWS VPN connections to connect the on-premises data center to AWS. Use AWS CodeArtifact to store the deployment artifacts.
- D. Use parallel AWS Direct Connect connections to connect the on-premises data center to AWS. Deploy third-party artifact management software on Amazon EC2 instances.
Answer: C
Explanation: Option C is the best choice because it uses AWS VPN connections, which can be provisioned within days, easily meeting the 'less than two weeks' deployment requirement. AWS CodeArtifact is a fully managed service that is highly available by default, stores artifacts encrypted in object storage (S3), supports consuming downstream packages from public repositories (npm, PyPI, Maven, NuGet, etc.), and encrypts data both in transit (via TLS) and at rest. In contrast, Options B and D rely on AWS Direct Connect, which typically takes 1-3 months to establish and therefore cannot meet the two-week deadline. Additionally, deploying third-party artifact management software on EC2 instances requires more manual configuration to achieve high availability and encryption requirements compared to using the fully managed CodeArtifact service.