DOP-C02 Question Bank · Latest 50 Questions Free Preview (Page 4/5)

Questions 31–40 of the latest 50 DOP-C02 questions (5 pages total), with answers and explanations, no login required. Practice all 951 questions online.

Question 31 · No. 932 · Single choice

A company runs a microservices application on Amazon Elastic Kubernetes Service (Amazon EKS). Users recently reported significant delays while accessing an account summary feature, particularly during peak business hours. A DevOps engineer used Amazon CloudWatch metrics and logs to troubleshoot the issue. The logs indicated normal CPU and memory utilization on the EKS nodes. The DevOps engineer was not able to identify where the delays occurred within the microservices architecture. The DevOps engineer needs to increase the observability of the application to pinpoint where the delays are occurring. Which solution will meet these requirements?

A. Deploy the AWS X-Ray daemon as a DaemonSet in the EKS cluster. Use the X-Ray SDK to instrument the application code. Redeploy the application
B. Enable CloudWatch Container Insights for the EKS cluster. Use the Container Insights data to diagnose the delays.
C. Create alarms based on the existing CloudWatch metrics. Set up an Amazon Simple Notification Service (Amazon SNS) topic to send email alerts.
D. Increase the timeout settings in the application code for network operations to allow more time for operations to finish.

Answer: A

Explanation: The key requirement is to increase observability to pinpoint where delays occur within the microservices architecture. AWS X-Ray is specifically designed for distributed tracing across microservices, allowing the DevOps engineer to trace individual requests as they travel through multiple services and identify exactly where the latency or bottlenecks occur. By deploying the X-Ray daemon as a DaemonSet in the EKS cluster and instrumenting the application code with the X-Ray SDK, the engineer will gain detailed visibility into request paths, service-to-service latency, and performance bottlenecks within the microservices architecture. Option B (Container Insights) only provides cluster-level metrics, not microservice-level tracing. Option C only adds notifications without improving debugging capability. Option D merely masks the problem by extending timeouts instead of identifying the root cause.

Question 32 · No. 933 · Single choice

A company uses a trunk-based development branching strategy. The company has two AWS CodePipeline pipelines that are integrated with a Git provider. The pull_request pipeline has a branch filter that matches the feature branches. The main_branch pipeline has a branch filter that matches the main branch. When pull requests are merged into the main branch, the pull requests are deployed by using the main_branch pipeline. The company's developers need test results for all submitted pull requests as quickly as possible from the pull_request pipeline. The company wants to ensure that the main_branch pipeline’s test results finish and that each deployment is complete before the next pipeline execution. Which solution will meet these requirements?

A. Configure the pull_request pipeline to use PARALLEL mode. Configure the main_branch pipeline to use QUEUED mode.
B. Configure the pull_request pipeline to use SUPERSEDED mode. Configure the main_branch pipeline to use QUEUED mode.
C. Configure the pull_request pipeline to use PARALLEL mode. Configure the main_branch pipeline to use SUPERSEDED mode
D. Configure the pull_request pipeline to use QUEUED mode. Configure the main_branch pipeline to use SUPERSEDED mode.

Answer: A

Explanation: For the pull_request pipeline, PARALLEL mode is needed so that multiple test executions for different pull requests run concurrently, providing test results as quickly as possible. SUPERSEDED would cancel previous executions (losing results), and QUEUED would make developers wait for each one to finish sequentially. For the main_branch pipeline, QUEUED mode ensures that each execution (including tests and deployments) completes fully before the next one starts, preventing overlapping deployments that could cause issues. PARALLEL would risk concurrent deployments, and SUPERSEDED could leave deployments incomplete by canceling the current execution.

Question 33 · No. 934 · Single choice

A DevOps engineer needs to configure an AWS CodePipeline pipeline that publishes container images to an Amazon Elastic Container Registry (Amazon ECR) repository. The pipeline must wait for the previous run to finish and must run when new Git tags are pushed to a Git repository that is connected to AWS CodeConnections. An existing deployment pipeline needs to run in response to the publication of new container images. Which solution will meet these requirements?

A. Configure a CodePipeline V2 type pipeline that uses QUEUED mode. Add a trigger filter to the pipeline definition that includes all tags. Configure an Amazon EventBridge rule that matches container image pushes to start the existing deployment pipeline.
B. Configure a CodePipeline V2 type pipeline that uses SUPERSEDED mode. Add a trigger filter to the pipeline definition that includes all branches. Configure an Amazon EventBridge rule that matches container image pushes to start the existing deployment pipeline.
C. Configure a CodePipeline V1 type pipeline that uses SUPERSEDED mode. Add a trigger filter to the pipeline definition that includes all tags. Add a stage at the end of the pipeline to invoke the existing deployment pipeline.
D. Configure a CodePipeline V1 type pipeline that uses QUEUED mode. Add a trigger filter to the pipeline definition that includes all branches. Add a stage at the end of the pipeline to invoke the existing deployment pipeline.

Answer: A

Explanation: Option A correctly meets all the requirements: (1) CodePipeline V2 type is required because V2 supports the QUEUED execution mode (V1 does not support this mode). (2) QUEUED mode ensures the pipeline waits for the previous run to finish before starting a new execution. (3) The trigger filter includes all tags, which ensures the pipeline runs when new Git tags are pushed (branches would not be correct). (4) An Amazon EventBridge rule that matches container image pushes to Amazon ECR is the proper way to trigger the existing deployment pipeline when new images are published. Options B is incorrect because SUPERSEDED mode does not wait for previous runs to complete. Options C and D are incorrect because CodePipeline V1 does not support QUEUED/SUPERSEDED execution modes.

Question 34 · No. 935 · Single choice

A company is running an application on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs to implement comprehensive logging for the control plane and the nodes. The company must analyze API requests to the Kubernetes control plane and must monitor container performance on the nodes. Which solution will meet these requirements with the LEAST operational overhead?

A. Enable AWS CloudTrail for control plane logging. Deploy Logstash as a ReplicaSet on the nodes to collect logs from the nodes. Use Amazon OpenSearch Service to store and analyze the logs for the control plane and the nodes.
B. Enable control plane logging for the EKS cluster. Send the logs to Amazon CloudWatch. Use CloudWatch Container Insights to collect logs for the nodes and the containers. Use CloudWatch Logs Insights to query and analyze the logs for the control plane and the nodes.
C. Enable API server control plane logging for the EKS cluster. Send the logs to Amazon S3 Deploy Kubernetes Event Exporter to the nodes to collect logs from the nodes. Send the logs to Amazon S3. Use Amazon Athena to query logs for the control plane and the nodes. Use Amazon QuickSight for visualization.
D. Use AWS Distro for OpenTelemetry to collect logs for the control plane and the nodes. Stream all the logs to Amazon Data Firehose. Use Amazon Redshift to analyze the aggregated log data for the control plane and the nodes.

Answer: B

Explanation: Option B is the best choice because it leverages AWS native integrations that minimize operational overhead. EKS control plane logging can be directly enabled to send logs to CloudWatch, which is a fully managed service. CloudWatch Container Insights is specifically designed to collect, aggregate, and summarize metrics and logs from containerized applications and microservices, providing out-of-the-box monitoring for nodes and containers. CloudWatch Logs Insights provides powerful query capabilities without requiring additional setup. Options A, C, and D all require deploying and managing additional components (Logstash, Kubernetes Event Exporter, OpenTelemetry collectors) and/or using services not optimized for this use case (Redshift for log analysis), which increases operational overhead.

Question 35 · No. 936 · Multiple choice

A company wants to improve its security practices by enforcing least privilege across all projects. Developers must be able to access Amazon EC2 resources but not Amazon RDS resources. Database administrators must have access only to Amazon RDS resources. Every employee has a unique IAM user. There are already pre-existing IAM policies for developer and database administrator job functions. All AWS resources are already tagged with appropriate project tags. All the IAM users are tagged with the appropriate project and job function. The company must ensure that each employee can access only the project that the employee is working on. Which solution will meet these requirements? (Choose three.)

A. For each project, create one IAM role for developers and one IAM role for database administrators. Tag the IAM roles with the corresponding projects and job functions.
B. Modify the pre-existing IAM policies to include a StringEquals ResourceTag condition for projects that match the PrincipalTag value. Attach the modified policies to the IAM roles for each job function.
C. Create an IAM policy that allows users to assume a role when the ResourceTag value matches the PrincipalTag value for project tags and job title tags. Attach the new policy to all IAM users.
D. Create an IAM policy that allows users to assume a role when the ResourceTag value matches the PrincipalTag value for project tags and job title tags. Attach the new policy to the IAM roles for each job function.
E. Tag the pre-existing IAM policies with the appropriate projects and job functions. Attach the modified policies to IAM roles for each job function.
F. For each project, create one IAM group for developers and one IAM group for database administrators. Add the appropriate users to each group so the users can assume their respective IAM roles.

Answer: A, B, C

Question 36 · No. 937 · Single choice

A company runs a development environment website and database on an Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS) storage. The company wants to make the instance more resilient to underlying hardware issues. The company wants to automatically recover the EC2 instance if AWS determines the instance has lost network connectivity. Which solution will meet these requirements?

A. Add the EC2 instance to an Auto Scaling group. Set the minimum, maximum, and desired capacity to 1.
B. Add the EC2 instance to an Auto Scaling group. Configure a lifecycle hook to detach the EBS volume if the EC2 instance shuts down or terminates
C. Create an Amazon CloudWatch alarm for the StatusCheckFailed_System metric. Add an EC2 action to recover the instance when the alarm state is in ALARM
D. Create an Amazon CloudWatch alarm for the NetworkOut metric. Add an EC2 action to recover the instance when the alarm state is in INSUFFICIENT_DATA.

Answer: C

Explanation: Option C is the correct answer. The StatusCheckFailed_System CloudWatch metric specifically monitors AWS-controlled system checks, including underlying hardware issues and loss of network connectivity. When this metric is in ALARM state, the EC2 recover action will automatically recover the instance by moving it to a new healthy host while preserving the EBS volume, instance metadata, and private IP address. Option A is incorrect because Auto Scaling groups with desired capacity of 1 don't automatically recover instances from underlying hardware issues - they respond to scaling policies. Option B is incorrect because lifecycle hooks for EBS volume detachment don't address automatic recovery from network loss. Option D is incorrect because NetworkOut measures outbound network traffic throughput, not network connectivity loss, and recovery actions should be triggered on ALARM state, not INSUFFICIENT_DATA.

Question 37 · No. 938 · Single choice

A company operates a fleet of Amazon EC2 instances that host critical applications and handle sensitive data. The EC2 instances must have up-to-date security patches to protect against vulnerabilities and ensure compliance with industry standards and regulations. The company needs an automated solution to monitor and enforce security patch compliance across the EC2 fleet. Which solution will meet these requirements?

A. Configure AWS Systems Manager Patch Manager and AWS Config with defined patch baselines and compliance rules that run Systems Manager Automation documents.
B. Access each EC2 instance by using SSH keys. Check for and apply security updates by using package managers. Verify the installations.
C. Configure Auto Scaling groups that have scaling policies based on Amazon CloudWatch metrics. Configure Auto Scaling launch templates that launch new instances by using the latest AMIs that contain new security patches.
D. Use AWS CloudFormation to recreate EC2 instances with the latest AMI every time a new patch becomes available. Use AWS CloudTrail logs to monitor patch compliance and to send alerts for non-compliant instances.

Answer: A

Explanation: AWS Systems Manager Patch Manager is specifically designed to automate the patching process for EC2 instances. Combined with AWS Config, you can define patch baselines and compliance rules to monitor patch compliance across the fleet. Systems Manager Automation documents can be used to automatically apply patches when instances are found to be non-compliant. This solution provides a fully automated approach to monitoring and enforcing security patch compliance. Option B is manual and not automated. Option C only addresses new instances launched via Auto Scaling, not the existing fleet. Option D is disruptive as it recreates instances for every patch, and CloudTrail is not designed for compliance monitoring.

Question 38 · No. 939 · Single choice

A company has implemented a new microservices-based application on an Amazon Elastic Container Service (Amazon ECS) cluster. After each deployment, the company wants to validate the critical user journeys and API endpoints before routing traffic to the new application version. The company must implement an automated solution to detect issues in the new deployment and to initiate a rollback if necessary. Which solution will meet these requirements with the LEAST operational overhead?

A. Set up Amazon CloudWatch Application Insights for the ECS cluster. Create an Amazon EventBridge rule to invoke an AWS Lambda function to analyze the task states. Program the Lambda function to use the ECS UpdateService API call to initiate a rollback if a specific percentage of tasks fail.
B. Set up Amazon CloudWatch Application Insights for the ECS cluster. Configure Application Insights to monitor key performance indicators of the microservices in the critical user journeys and API calls. Create CloudWatch alarms based on the insights. Use Amazon EventBridge to invoke an AWS Step Functions workflow to evaluate the alarms. Configure the workflow to initiate a rollback if necessary by using the alarms' built-in integration with Amazon ECS.
C. Create CloudWatch Synthetics canaries that simulate critical user journeys and API calls. Implement AWS X-Ray tracing for all the microservices Configure X-Ray to send traces to CloudWatch. Create CloudWatch alarms based on error rates and latency metrics. Create an AWS Lambda function to analyze the traces and to initiate a rollback if necessary by using the alarms' built-in integration with Amazon ECS.
D. Create CloudWatch Synthetics canaries that simulate critical user journeys and API calls. Configure the canaries to run against the new deployment. Create CloudWatch alarms that are invoked when canaries fail. Use the alarms’ built-in integration with Amazon ECS to initiate a rollback if the alarms are invoked before traffic is routed to the new deployment.

Answer: D

Explanation: Option D is the best choice because it uses CloudWatch Synthetics canaries to validate the critical user journeys and API endpoints, which directly matches the requirement to 'validate the critical user journeys and API endpoints before routing traffic to the new application version.' The canaries run against the new deployment before traffic is routed, CloudWatch alarms are triggered if canaries fail, and the built-in integration with Amazon ECS automatically initiates a rollback. This solution requires no custom Lambda code, no additional tracing infrastructure (like X-Ray), and no complex workflow orchestration, resulting in the least operational overhead. Options A and B require custom Lambda/Step Functions code and CloudWatch Application Insights monitoring setup. Option C requires X-Ray tracing implementation plus a custom Lambda function for analysis, adding significant operational overhead.

Question 39 · No. 940 · Multiple choice

A DevOps engineer needs to implement a CI/CD pipeline in an AWS account. The pipeline must consume sensitive database credentials that are stored in an AWS Systems Manager Parameter Store parameter. The Parameter Store parameter is in a separate central account. The DevOps engineer needs to create and integrate the parameter with the CI/CD account. Which combination of steps will meet these requirements? (Choose three.)

A. Use an advanced tier Parameter Store parameter to store the database credentials in the central AWS account.
B. Create an IAM role in the AWS account that hosts the CI/CD pipeline. Add the full ARN of the parameter to the IAM policy that is associated with the IAM role.
C. Use a standard tier Parameter Store parameter to store the database credentials in the central AWS account.
D. Use an AWS KMS managed key to encrypt the parameter. Grant decrypt permissions for the KMS key to the AWS account that hosts the CI/CD pipeline.
E. Use a customer managed AWS KMS key to encrypt the parameter. Grant decrypt permissions for the customer managed key to the AWS account that hosts the CI/CD pipeline.
F. Create an AWS Resource Access Manager (AWS RAM) resource share in the central AWS account. Share the parameter with the account that hosts the CI/CD pipeline.

Answer: A, E, F

Question 40 · No. 941 · Single choice

A company is using the AWS Cloud Development Kit (AWS CDK) to develop a microservices-based application. The company needs to create reusable infrastructure components for three environments: development, staging, and production. The components must include networking resources, database resources, and serverless compute resources. The company must implement a solution that provides consistent infrastructure across environments while offering the option for environment-specific customizations. The solution also must minimize code duplication. Which solution will meet these requirements with the LEAST development overhead?

A. Create custom Level 1 (L1) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create a single set of deployment stacks that takes the environment name as an argument upon instantiation. Deploy CDK applications for each environment.
B. Create custom Level 1 (L1) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create separate deployment stacks for each environment. Use the CDK context command to determine which stacks to run when deploying to each environment.
C. Create custom Level 3 (L3) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create a single set of deployment stacks that takes the environment name as an argument upon instantiation. Deploy CDK applications for each environment.
D. Create custom Level 3 (L3) constructs out of Level 2 (L2) constructs where repeatable patterns exist. Create separate deployment stacks for each environment. Use the CDK context command to determine which stacks to run when deploying to each environment.

Answer: C

Explanation: The correct choice is C because: 1) L3 constructs (patterns) are built from L2 constructs and are specifically designed for creating reusable architecture patterns, which fits the requirement for reusable infrastructure components. 2) Creating a single set of deployment stacks that takes the environment name as an argument minimizes code duplication and provides a single source of truth for infrastructure across all environments. 3) This approach allows for environment-specific customizations through parameters while maintaining consistency. Option A and B are incorrect because L1 constructs are lower-level than L2 constructs; you would not typically create L1 from L2. Option D is incorrect because creating separate deployment stacks for each environment increases code duplication and management overhead.

Prev 1 2 345 Next