Free AWS DOP-C02 Practice Questions & Answers 2026 Part5

Question #1

A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, daily, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.Which solution will meet these requirements?

A. Set up AWS Config in the account

B. Set up AWS Config in the account

C. Turn on AWS CloudTrail in the account

D. Turn on AWS CloudTrail in the account

View answer

Correct Answer: B

Question #2

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #3

A company uses AWS Organizations and AWS Control Tower to manage all the company's AWS accounts.The company uses the Enterprise Support plan.A DevOps engineer is using Account Factory for Terraform (AFT) to provision new accounts. When new accounts are provisioned, the DevOps engineer notices that the support plan for the new accounts is set to the Basic Support plan. The DevOps engineer needs to implement a solution to provision the new accounts with the Enterprise Support plan.Which solution will meet these requirements?

A. Use an AWS Config conformance pack to deploy the account-part-of-organizations AWS Config rule and to automatically remediate any noncompliant accounts

B. Create an AWS Lambda function to create a ticket for AWS Support to add the account to the Enterprise Support plan

C. Add an additional value to the control_tower_parameters input to set the AWSEnterpriseSupport parameter as the organization's management account number

D. Set the aft_feature_enterprise_support feature flag to True in the AFT deployment input configuration

View answer

Correct Answer: D

Question #4

A company's DevOps engineer uses AWS Systems Manager to perform maintenance tasks during maintenance windows. The company has a few Amazon EC2 instances that require a restart after notifications from AWS Health. The DevOps engineer needs to implement an automated solution to remediate these notifications. The DevOps engineer creates an Amazon EventBridge rule.How should the DevOps engineer configure the EventBridge rule to meet these requirements?

A. Configure an event source of AWS Health, a service of EC2, and an event type that indicates instance maintenance

B. Configure an event source of Systems Manager and an event type that indicates a maintenance window

C. Configure an event source of AWS Health, a service of EC2, and an event type that indicates instance maintenance

D. Configure an event source of EC2 and an event type that indicates instance maintenance

View answer

Correct Answer: A

Question #5

A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?

A. Auto Scaling groups can create new instances in a single AZ only

B. The EC2 instances have not been manually associated to the AL

C. The ALB should be replaced with a Network Load Balancer (NLB)

D. The new AZ has not been added to the ALB

View answer

Correct Answer: D

Question #6

A DevOps team manages an API running on-premises that serves as a backend for an Amazon API Gateway endpoint. Customers have been complaining about high response latencies, which the development team has verified using the API Gateway latency metrics in Amazon CloudWatch. To identify the cause, the team needs to collect relevant data without introducing additional latency.Which actions should be taken to accomplish this? (Choose two.)

A. nstall the CloudWatch agent server side and configure the agent to upload relevant logs to CloudWatch

B. nable AWS X-Ray tracing in API Gateway, modify the application to capture request segments, and upload those segments to X-Ray during each request

C. nable AWS X-Ray tracing in API Gateway, modify the application to capture request segments, and use the X-Ray daemon to upload segments to X-Ray

D. odify the on-premises application to send log information back to API Gateway with each request

E. odify the on-premises application to calculate and upload statistical data relevant to the API service requests to CloudWatch metrics

View answer

Correct Answer: AC

Question #7

A company uses AWS Storage Gateway in file gateway mode in front of an Amazon S3 bucket that is used by multiple resources. In the morning when business begins, users do not see the objects processed by a third party the previous evening. When a DevOps engineer looks directly at the S3 bucket, the data is there, but it is missing in Storage Gateway.Which solution ensures that all the updated third-party files are available in the morning?

A. Configure a nightly Amazon EventBridge event to invoke an AWS Lambda function to run the RefreshCache command for Storage Gateway

B. Instruct the third party to put data into the S3 bucket using AWS Transfer for SFTP

C. Modify Storage Gateway to run in volume gateway mode

D. Use S3 Same-Region Replication to replicate any changes made directly in the S3 bucket to Storage Gateway

View answer

Correct Answer: A

Question #8

A company has a continuous integration pipeline where the company creates container images by using AWS CodeBuild. The created images are stored in Amazon Elastic Container Registry (Amazon ECR). Checking for and fixing the vulnerabilities in the images takes the company too much time. The company wants to identify the image vulnerabilities quickly and notify the security team of the vulnerabilities. Which combination of steps will meet these requirements with the LEAST operational overhead? (Select TWO.)

A. Activate Amazon Inspector enhanced scanning for Amazon ECR

B. Create an Amazon EventBridge rule for Amazon Inspector findings

C. Activate AWS Lambda enhanced scanning for Amazon ECR

D. Create a new AWS Lambda function

E. Activate default basic scanning for Amazon ECR for all container images

View answer

Correct Answer: CE

Question #9

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #10

To run an application, a DevOps engineer launches an Amazon EC2 instance with public IP addresses in a public subnet. A user data script obtains the application artifacts and installs them on the instances upon launch. A change to the security classification of the application now requires the instances to run with no access to the internet. While the instances launch successfully and show as healthy, the application does not seem to be installed.Which of the following should successfully install the application while complying with the new rule?

A. Launch the instances in a public subnet with Elastic IP addresses attached

B. Set up a NAT gateway

C. Publish the application artifacts to an Amazon S3 bucket and create a VPC endpoint for S3

D. Create a security group for the application instances and allow only outbound traffic to the artifact repository

View answer

Correct Answer: C

Question #11

A company has multiple member accounts that are part of an organization in AWS Organizations. The security team needs to review every Amazon EC2 security group and their inbound and outbound rules. The security team wants to programmatically retrieve this information from the member accounts using an AWS Lambda function in the management account of the organization.Which combination of access changes will meet these requirements? (Choose three.)

A. reate a trust relationship that allows users in the member accounts to assume the management account IAM role

B. reate a trust relationship that allows users in the management account to assume the IAM roles of the member accounts

C. reate an IAM role in each member account that has access to the AmazonEC2ReadOnlyAccess managed policy

D. reate an I AM role in each member account to allow the sts:AssumeRole action against the management account IAM role's ARN

E. reate an I AM role in the management account that allows the sts:AssumeRole action against the member account IAM role's ARN

F. reate an IAM role in the management account that has access to the AmazonEC2ReadOnlyAccess managed policy

View answer

Correct Answer: BCE

Question #12

A company runs applications on Windows and Linux Amazon EC2 instances The instances run across multiple Availability Zones In an AWS Region. The company uses Auto Scaling groups for each application.The company needs a durable storage solution for the instances. The solution must use SMB for Windows and must use NFS for Linux. The solution must also have sub-millisecond latencies. All instances will read and write the data.Which combination of steps will meet these requirements? (Select THREE.)

A. Create an Amazon Elastic File System (Amazon EFS) file system that has targets in multiple Availability Zones

B. Create an Amazon FSx for NetApp ONTAP Multi-AZ file system

C. Create a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume to use for shared storage

D. Update the user data for each application's launch template to mount the file system

E. Perform an instance refresh on each Auto Scaling group

F. Update the EC2 instances for each application to mount the file system when new instances are launched

View answer

Correct Answer: ABD

Question #13

A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache Webserver. The development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. After completion, the team will create additional deployment groups for staging and production.The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group.How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?

A. Tag the Amazon EC2 instances depending on the deployment group

B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify which deployment group the instance is part of

C. Create a CodeDeploy custom environment variable for each environment

D. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which deployment group the instance is part of to configure the log level settings

View answer

Correct Answer: B

Question #14

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #15

A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?

A. Auto Scaling groups can create new instances in a single AZ only

B. The EC2 instances have not been manually associated to the AL

C. The ALB should be replaced with a Network Load Balancer (NLB)

D. The new AZ has not been added to the ALB

View answer

Correct Answer: D

Question #16

A company provides an application to customers. The application has an Amazon API Gateway REST API that invokes an AWS Lambda function. On initialization, the Lambda function loads a large amount of data from an Amazon DynamoDB table. The data load process results in long cold-start times of 8-10 seconds. The DynamoDB table has DynamoDB Accelerator (DAX) configured.Customers report that the application intermittently takes a long time to respond to requests. The application receives thousands of requests throughout the day. In the middle of the day, the application experiences 10 times more requests than at any other time of the day. Near the end of the day, the application's request volume decreases to 10% of its normal total.A DevOps engineer needs to reduce the latency of the Lambda function at all times of the day.Which solution will meet these requirements?

A. Configure provisioned concurrency on the Lambda function with a concurrency value of 1

B. Configure reserved concurrency on the Lambda function with a concurrency value of 0

C. Configure provisioned concurrency on the Lambda function

D. Configure reserved concurrency on the Lambda function

View answer

Correct Answer: C

Question #17

A company has containerized all of its in-house quality control applications. The company is running Jenkins on Amazon EC2 instances, which require patching and upgrading. The compliance officer has requested a DevOps engineer begin encrypting build artifacts since they contain company intellectual property.What should the DevOps engineer do to accomplish this in the MOST maintainable manner?

A. Automate patching and upgrading using AWS Systems Manager on EC2 instances and encrypt Amazon EBS volumes by default

B. Deploy Jenkins to an Amazon ECS cluster and copy build artifacts to an Amazon S3 bucket with default encryption enabled

C. Leverage AWS CodePipeline with a build action and encrypt the artifacts using AWS Secrets Manager

D. Use AWS CodeBuild with artifact encryption to replace the Jenkins instance running on EC2 instances

View answer

Correct Answer: D

Question #18

A development team wants to use AWS CloudFormation stacks to deploy an application. However, the developer IAM role does not have the required permissions to provision the resources that are specified in the AWS CloudFormation template. A DevOps engineer needs to implement a solution that allows the developers to deploy the stacks. The solution must follow the principle of least privilege.Which solution will meet these requirements?

A. Create an IAM policy that allows the developers to provision the required resources

B. Create an IAM policy that allows full access to AWS CloudFormation

C. Create an AWS CloudFormation service role that has the required permissions

D. Create an AWS CloudFormation service role that has the required permissions

View answer

Correct Answer: D

Question #19

A business has an application that consists of ve independent AWS Lambda functions. The DevOps Engineer has built a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild that builds, tests, packages, and deploys each Lambda function in sequence. The pipeline uses an Amazon CloudWatch Events rule to ensure the pipeline execution starts as quickly as possible after a change is made to the application source code.After working with the pipeline for a few months, the DevOps Engineer has noticed the pipeline takes too long to complete. What should the DevOps Engineer implement to BEST improve the speed of the pipeline?

A. Modify the CodeBuild projects within the pipeline to use a compute type with more available network throughput

B. Create a custom CodeBuild execution environment that includes a symmetric multiprocessing con guration to run the builds in parallel

C. Modify the CodePipeline con guration to execute actions for each Lambda function in parallel by specifying the same runOrder

D. Modify each CodeBuild project to run within a VPC and use dedicated instances to increase throughput

View answer

Correct Answer: C

Question #20

A company's developers use Amazon EC2 instances as remote workstations. The company is concerned that users can create or modify EC2 security groups to allow unrestricted inbound access.A DevOps engineer needs to develop a solution to detect when users create unrestricted security group rules. The solution must detect changes to security group rules in near real time, remove unrestricted rules, and send email notifications to the security team. The DevOps engineer has created an AWS Lambda function that checks for security group ID from input, removes rules that grant unrestricted access, and sends notifications through Amazon Simple Notification Service (Amazon SNS).What should the DevOps engineer do next to meet the requirements?

A. Configure the Lambda function to be invoked by the SNS topic

B. Create an Amazon EventBridge scheduled rule to invoke the Lambda function

C. Create an Amazon EventBridge event rule that has the default event bus as the source

D. Create an Amazon EventBridge custom event bus that subscribes to events from all AWS services

View answer

Correct Answer: C

Question #21

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #22

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #23

A DevOps engineer is managing a legacy application on AWS. The application is a monolithic Windows program that runs on a single Amazon EC2 instance. The source code for the application is not available, so the application cannot be modified. The application has a memory leak and malfunctions when memory utilization on the EC2 instance increases to more than 90%.The DevOps engineer has configured the unified Amazon CloudWatch agent on the EC2 instance to collect the operation system’s memory utilization metrics. The DevOps engineer needs to implement a solution to prevent the application from malfunctioning.Which combination of steps will meet these requirements with the MOST operational efficiency?(Select TWO.)

A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when memory utilization increases to more than 80%

B. Create a metric filter on memory utilization in Amazon CloudWatch Logs

C. Create a CloudWatch alarm on the memory utilization metric

D. Configure an AWS Lambda function to restart the application by using AWS Systems Manager Run Command

E. Configure the EC2 instance to run a script that restarts the application

View answer

Correct Answer: cd

Question #24

A DevOps engineer needs to implement a solution to install antivirus software on all the Amazon EC2 instances in an AWS account. The EC2 instances run the most recent version of Amazon Linux .The solution must detect all instances and must use an AWS Systems Manager document to install the software if the software is not present.Which solution will meet these requirements?

A. et up AWS Config to record all the resources in the account

B. reate an Amazon EventBridge rule that uses AWS CloudTrail to detect the RunInstances API call

C. reate an association in Systems Manager State Manager

D. ctivate Amazon EC2 scanning on Amazon Inspector to determine if the software is installed on all the EC2 instances

View answer

Correct Answer: C

Question #25

A DevOps engineer has developed an AWS Lambda function The Lambda function starts an AWS CloudFormation drift detection operation on all supported resources for a specific CloudFormation stack The Lambda function then exits Its invocation The DevOps engineer has created an Amazon EventBrdge scheduled rule that Invokes the Lambda function every hour. An Amazon Simple Notification Service (Amazon SNS) topic already exists In the AWS account. The DevOps engineer has subscribed to the SNS topic to receive notificationsThe DevOps engineer needs to receive a notification as soon as possible when drift is detected in this specific stack configuration.Which solution Will meet these requirements?

A. Configure the existing EventBridge rule to also target the SNS topic Configure an SNS subscription filter policy to match the Cloud Formation stack

B. Create a second Lambda function to query the CloudFormation API for the drift detection results for the stack Configure the second Lambda function to publish a message to the SNS topic If drift ts detected Adjust the existing EventBridge rule to also target the second Lambda function

C. Configure Amazon GuardDuty in the account with drift detection for all CloudFormation stacks

D. Configure AWS Config in the account

View answer

Correct Answer: D

Question #26

A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache Webserver. The development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. After completion, the team will create additional deployment groups for staging and production.The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group.How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?

A. Tag the Amazon EC2 instances depending on the deployment group

B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify which deployment group the instance is part of

C. Create a CodeDeploy custom environment variable for each environment

D. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ID to identify which deployment group the instance is part of to configure the log level settings

View answer

Correct Answer: B

Question #27

A company has developed a serverless web application that is hosted on AWS. The application consists of Amazon S3. Amazon API Gateway, several AWS Lambda functions, and an Amazon RDS for MySQL database. The company is using AWS CodeCommit to store the source code. The source code is a combination of AWS Serverless Application Model (AWS SAM) templates and Python code.A security audit and penetration test reveal that user names and passwords for authentication to the database are hardcoded within CodeCommit repositories. A DevOps engineer must implement a solution to automatically detect and prevent hardcoded secrets.What is the MOST secure solution that meets these requirements?

A. Enable Amazon CodeGuru Profiler

B. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

C. Enable Amazon CodeGuru Profiler

D. Associate the CodeCommit repository with Amazon CodeGuru Reviewer

View answer

Correct Answer: B

Question #28

A company provides an application to customers. The application has an Amazon API Gateway REST API that invokes an AWS Lambda function. On initialization, the Lambda function loads a large amount of data from an Amazon DynamoDB table. The data load process results in long cold - start times of 8 - 10 seconds. The DynamoDB table has DynamoDB Accelerator (DAX) configured. Customers report that the application intermittently takes a long time to respond to requests. The application receives thousands of requests throughout the day. In the middle of the day, the application experiences 10 times more requests than at any other time of the day. Near the end of the day, the application's request volume decreases to 10% of its normal total. A DevOps engineer needs to reduce the latency of the Lambda function at all times of the day. Which solution will meet these requirements?

A. Configure provisioned concurrency on the Lambda function with a concurrency value of 1

B. Configure reserved concurrency on the Lambda function with a concurrency value of 0

C. Configure provisioned concurrency on the Lambda function

D. Configure reserved concurrency on the Lambda function

View answer

Correct Answer: C

Question #29

A company is implementing a well-architected design for its globally accessible API stack. The design needs to ensure both high reliability and fast response times for users located in North America and Europe.The API stack contains the following three tiers:Amazon API GatewayAWS LambdaAmazon DynamoDBWhich solution will meet the requirements?

A. Configure Amazon Route 53 to point to API Gateway APIs in North America and Europe using health checks

B. Configure Amazon Route 53 to point to API Gateway APIs in North America and Europe using latency- based routing and health checks

C. Configure Amazon Route 53 to point to API Gateway in North America, create a disaster recovery API in Europe, and configure both APIs to forward requests to the Lambda functions in that Region

D. Configure Amazon Route 53 to point to API Gateway API in North America using latency-based routing

View answer

Correct Answer: B

Question #30

A company has its AWS accounts in an organization in AWS Organizations. AWS Config is manually configured in each AWS account. The company needs to implement a solution to centrally configure AWS Config for all accounts in the organization The solution also must record resource changes to a central account.Which combination of actions should a DevOps engineer perform to meet these requirements? (Choose two.)

A. Configure a delegated administrator account for AWS Config

B. Configure a delegated administrator account for AWS Config

C. Create an AWS CloudFormation template to create an AWS Config aggregator

D. Create an AWS Config organization aggregator in the organization's management account

E. Create an AWS Config organization aggregator in the delegated administrator account

View answer

Correct Answer: AE

Question #31

A DevOps Engineer manages a web application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an EC2Auto Scaling group across multiple Availability Zones. The engineer needs to implement a deployment strategy that:Launches a second eet of instances with the same capacity as the original eet.Maintains the original eet unchanged while the second eet is launched.Transitions tra c to the second eet when the second eet is fully deployed.Terminates the original eet automatically 1 hour after transition.Which solution will satisfy these requirements?

A. Use an AWS CloudFormation template with a retention policy for the ALB set to 1 hour

B. Use two AWS Elastic Beanstalk environments to perform a blue/green deployment from the original environment to the new one

C. Use AWS CodeDeploy with a deployment group con gured with a blue/green deployment con guration

D. Use AWS Elastic Beanstalk with the con guration set to Immutable

View answer

Correct Answer: D

Question #32

A production account has a requirement that any Amazon EC2 instance that has been logged in to manually must be terminated within 24 hours. All applications in the production account are using Auto Scaling groups with the Amazon CloudWatch Logs agent configured.How can this process be automated?

A. Create a CloudWatch Logs subscription to an AWS Step Functions application

B. Create an Amazon CloudWatch alarm that will be invoked by the login event

C. Create an Amazon CloudWatch alarm that will be invoked by the login event

D. Create a CloudWatch Logs subscription to an AWS Lambda function

View answer

Correct Answer: D

Question #33

A company has an application that runs on Amazon EC2 instances. The company uses an AWS CodePipeline pipeline to deploy the application into multiple AWS Regions. The pipeline is configured with a stage for each Region. Each stage contains an AWS CloudFormation action for each Region.When the pipeline deploys the application to a Region, the company wants to confirm that the application is in a healthy state before the pipeline moves on to the next Region. Amazon Route 53 record sets are configured for the application in each Region. A DevOps engineer creates a Route 53 health check that is based on an Amazon CloudWatch alarm for each Region where the application is deployed.What should the DevOps engineer do next to meet the requirements?

A. onfigure an AWS CodeDeploy application to deploy a CloudFormation template with automatic rollback

B. onfigure the CloudWatch agent on the EC2 instances to report the application status to the Route 53 health check

C. reate an AWS Step Functions workflow to check the state of the CloudWatch alarm

D. reate a new pipeline stage for each Region where the application is deployed

View answer

Correct Answer: C

Question #34

A DevOps engineer is architecting a continuous development strategy for a company's software as a service (SaaS) web application running on AWS. For application and security reasons, users subscribing to this application are distributed across multiple Application Load Balancers (ALBs), each of which has a dedicated Auto Scaling group and fleet of Amazon EC2 instances. The application does not require a build stage, and when it is committed to AWS CodeCommit, the application must trigger a simultaneous deployment to all ALBs, Auto Scaling groups, and EC2 fleets.Which architecture will meet these requirements with the LEAST amount of configuration?

A. Create a single AWS CodePipeline pipeline that deploys the application in parallel using unique AWS CodeDeploy applications and deployment groups created for each ALB-Auto Scaling group pair

B. Create a single AWS CodePipeline pipeline that deploys the application using a single AWS CodeDeploy application and single deployment group

C. Create a single AWS CodePipeline pipeline that deploys the application in parallel using a single AWS CodeDeploy application and unique deployment group for each ALB-Auto Scaling group pair

D. Create an AWS CodePipeline pipeline for each ALB-Auto Scaling group pair that deploys the application using an AWS CodeDeploy application and deployment group created for the same ALB-Auto Scaling group pair

View answer

Correct Answer: C

Question #35

A company is hosting a static website from an Amazon S3 bucket. The website is available to customers at example.com. The company uses an Amazon Route 53 weighted routing policy with a TTL of 1 day. The company has decided to replace the existing static website with a dynamic web application. The dynamic web application uses an Application Load Balancer (ALB) in front of a fleet of Amazon EC2 instances.On the day of production launch to customers, the company creates an additional Route 53 weighted DNS record entry that points to the ALB with a weight of 255 and a TTL of 1 hour. Two days later, a DevOps engineer notices that the previous static website is displayed sometimes when customers navigate to example.com.How can the DevOps engineer ensure that the company serves only dynamic content for example.com?

A. Delete all objects, including previous versions, from the S3 bucket that contains the static website content

B. Update the weighted DNS record entry that points to the S3 bucket

C. Configure webpage redirect requests on the S3 bucket with a hostname that redirects to the ALB

D. Remove the weighted DNS record entry that points to the S3 bucket from the example

View answer

Correct Answer: D

Question #36

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #37

A healthcare services company is concerned about the growing costs of software licensing for an application for monitoring patient wellness. The company wants to create an audit process to ensure that the application is running exclusively on Amazon EC2 Dedicated Hosts. A DevOps Engineer must create a work ow to audit the application to ensure compliance. What steps should the Engineer take to meet this requirement with the LEAST administrative overhead?

A. Use AWS Systems Manager Con guration Compliance

B. Use custom Java code running on an EC2 instance

C. Use AWS Con g

D. Use AWS CloudTrail

View answer

Correct Answer: C

Question #38

A company's application is currently deployed to a single AWS Region. Recently, the company opened a new o ce on a different continent. The users in the new o ce are experiencing high latency. The company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) and uses AmazonDynamoDB as the database layer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones. A DevOps Engineer is tasked with minimizing application response times and improving availability for users in both Regions. Which combination of actions should be taken to address the latency issues? (Choose three.)

A. Create a new DynamoDB table in the new Region with cross-Region replication enabled

B. Create new ALB and Auto Scaling group global resources and con gure the new ALB to direct tra c to the new Auto Scaling group

C. Create new ALB and Auto Scaling group resources in the new Region and con gure the new ALB to direct tra c to the new Auto Scaling group

D. Create Amazon Route 53 records, health checks, and latency-based routing policies to route to the ALB

E. Create Amazon Route 53 aliases, health checks, and failover routing policies to route to the ALB

F. Convert the DynamoDB table to a global table

View answer

Correct Answer: CDF

Question #39

A company is reviewing its AWS account security policies. The company has staff members in different countries and wants to monitor its AWS accounts for unusual behavior that is associated with an IAM identity. The company wants to send a notification to any staff member for whom unusual activity is detected. The company also wants to send a notification to the user’s team leader. An external messaging platform will send the notifications.The platform requires a target user-id for each recipient. The company already has an API on AWS that the company can use to return the user-id of the staff member and the team leader from IAM user names. The company manages its AWS accounts by using AWS Organizations.Which solution will meet these requirements?

A. Designate an account in the organization as the Amazon GuardDuty administrator

B. Designate an account in the organization as the Amazon Detective administrator

C. Designate an account in the organization as the Amazon GuardDuty administrator

D. Designate an account in the organization as the Amazon Detective administrator

View answer

Correct Answer: a

Question #40

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #41

A DevOps Engineer administers an application that manages video les for a video production company. The application runs on Amazon EC2 instances behind an ELB Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. Data is stored in an Amazon RDS PostgreSQLMulti-AZ DB instance, and the video les are stored in an Amazon S3 bucket. On a typical day, 50 GB of new video are added to the S3 bucket. The Engineer must implement a multi-region disaster recovery plan with the least data loss and the lowest recovery times. The current application infrastructure is already described using AWS CloudFormation.Which deployment option should the Engineer choose to meet the uptime and recovery objectives for the system?

A. Launch the application from the CloudFormation template in the second region, which sets the capacity of the Auto Scaling group to 1

B. Launch the application from the CloudFormation template in the second region, which sets the capacity of the Auto Scaling group to 1

C. Launch the application from the CloudFormation template in the second region, which sets the capacity of the Auto Scaling group to 1

D. Use Amazon CloudWatch Events to schedule a nightly task to take a snapshot of the database and copy the snapshot to the second region

View answer

Correct Answer: A

Question #42

A company has an AWS CodePipeline pipeline that is configured with an Amazon S3 bucket in the eu-west-1Region. The pipeline deploys an AWS Lambda application to the same Region. The pipeline consists of an AWS CodeBuild project build action and an AWS CloudFormation deploy action.The CodeBuild project uses the aws cloudformation package AWS CLI command to build an artifact that contains the Lambda function code's .zip file and the CloudFormation template. The CloudFormation deploy action references the CloudFormation template from the output artifact of the CodeBuild project's build action.The company wants to also deploy the Lambda application to the us-east-1 Region by using the pipeline in eu- west-1. A DevOps engineer has already updated the CodeBuild project to use the aws cloudformation package command to produce an additional output artifact for us-east-1.Which combination of additional steps should the DevOps engineer take to meet these requirements? (Choose two.)

A. Modify the CloudFormation template to include a parameter for the Lambda function code's zip file location

B. Create a new CloudFormation deploy action for us-east-1 in the pipeline

C. Create an S3 bucket in us-east-1

D. Create an S3 bucket in us-east-1

E. Modify the pipeline to include the S3 bucket for us-east-1 as an artifact store

View answer

Correct Answer: CE

Question #43

A company is using Amazon S3 buckets to store important documents. The company discovers that some S3 buckets are not encrypted. Currently, the company's IAM users can create new S3 buckets without encryption. The company is implementing a new requirement that all S3 buckets must be encrypted.A DevOps engineer must implement a solution to ensure that server-side encryption is enabled on all existing S3 buckets and all new S3 buckets. The encryption must be enabled on new S3 buckets as soon as the S3 buckets are created. The default encryption type must be 256-bit Advanced Encryption Standard (AES-256).Which solution will meet these requirements?

A. Create an AWS Lambda function that is invoked periodically by an Amazon EventBridge scheduled rule

B. Set up and activate the s3-bucket-server-side-encryption-enabled AWS Config managed rule

C. Create an AWS Lambda function that is invoked by an Amazon EventBridge event rule

D. Configure an IAM policy that denies the s3:CreateBucket action if the s3:x-amz-server-side-encryption condition key has a value that is not AES-256

View answer

Correct Answer: D

Question #44

A company recently launched an application that is more popular than expected. The company wants to ensure the application can scale to meet increasing demands and provide reliability using multiple Availability Zones (AZs). The application runs on a eet of Amazon EC2 instances behind an Application LoadBalancer (ALB). A DevOps engineer has created an Auto Scaling group across multiple AZs for the application. Instances launched in the newly added AZs are not receiving any tra c for the application.What is likely causing this issue?

A. Auto Scaling groups can create new instances in a single AZ only

B. The EC2 instances have not been manually associated to the AL

C. The ALB should be replaced with a Network Load Balancer (NLB)

D. The new AZ has not been added to the ALB

View answer

Correct Answer: D

Question #45

A company has an application that runs on Amazon EC2 instances that are in an Auto Scaling group. When the application starts up, the application needs to process data from an Amazon S3 bucket before the application can start to serve requests.The size of the data that is stored in the S3 bucket is growing. When the Auto Scaling group adds new instances, the application now takes several minutes to download and process the data before the application can serve requests. The company must reduce the time that elapses before new EC2 instances are ready to serve requests.Which solution is the MOST cost-effective way to reduce the application startup time?

A. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Stopped state

B. Increase the maximum instance count of the Auto Scaling group

C. Configure a warm pool for the Auto Scaling group with warmed EC2 instances in the Running state

D. Increase the maximum instance count of the Auto Scaling group

View answer

Correct Answer: A

Question #46

An application running on a set of Amazon EC2 instances in an Auto Scaling group requires a configuration file to operate. The instances are created and maintained with AWS CloudFormation. A DevOps engineer wantsthe instances to have the latest configuration file when launched, and wants changes to the configuration file to be reflected on all the instances with a minimal delay when the CloudFormation template is updated. Company policy requires that application configuration files be maintained along with AWS infrastructure configuration files in source control.Which solution will accomplish this?

A. In the CloudFormation template, add an AWS Config rule

B. In the CloudFormation template, add an EC2 launch template resource

C. In the CloudFormation template, add an EC2 launch template resource

D. In the CloudFormation template, add CloudFormation init metadata

View answer

Correct Answer: D

Question #47

A company has chosen AWS to host a new application. The company needs to implement a multi-account strategy. A DevOps engineer creates a new AWS account and an organization in AWS Organizations. The DevOps engineer also creates the OU structure for the organization and sets up a landing zone by using AWS Control Tower.The DevOps engineer must implement a solution that automatically deploys resources for new accounts that users create through AWS Control Tower Account Factory. When a user creates a new account, the solution must apply AWS CloudFormation templates and SCPs that are customized for the OU or the account to automatically deploy all the resources that are attached to the account. All the OUs are enrolled in AWS Control Tower.Which solution will meet these requirements in the MOST automated way?

A. Use AWS Service Catalog with AWS Control Tower

B. Deploy CloudFormation stack sets by using the required templates

C. Create an Amazon EventBridge rule to detect the CreateManagedAccount event

D. Deploy the Customizations for AWS Control Tower (CfCT) solution

View answer

Correct Answer: D

Question #48

A DevOps Engineer has several legacy applications that all generate different log formats. The Engineer must standardize the formats before writing them toAmazon S3 for querying and analysis.How can this requirement be met at the LOWEST cost?

A. Have the application send its logs to an Amazon EMR cluster and normalize the logs before sending them to Amazon S3

B. Have the application send its logs to Amazon QuickSight, then use the Amazon QuickSight SPICE engine to normalize the logs

C. Keep the logs in Amazon S3 and use Amazon Redshift Spectrum to normalize the logs in place

D. Use Amazon Kinesis Agent on each server to upload the logs and have Amazon Kinesis Data Firehose use an AWS Lambda function to normalize the logs before writing them to Amazon S3

View answer

Correct Answer: D

Question #49

A company is performing vulnerability scanning for all Amazon EC2 instances across many accounts. The accounts are in an organization in AWS Organizations. Each account's VPCs are attached to a shared transit gateway. The VPCs send traffic to the internet through a central egress VPC. The company has enabled Amazon Inspector in a delegated administrator account and has enabled scanning for all member accounts.A DevOps engineer discovers that some EC2 instances are listed in the "not scanning" tab in Amazon Inspector.Which combination of actions should the DevOps engineer take to resolve this issue? (Choose three.)

A. Verify that AWS Systems Manager Agent is installed and is running on the EC2 instances that Amazon Inspector is not scanning

B. Associate the target EC2 instances with security groups that allow outbound communication on port 443 to the AWS Systems Manager service endpoint

C. Grant inspector:StartAssessmentRun permissions to the IAM role that the DevOps engineer is using

D. Configure EC2 Instance Connect for the EC2 instances that Amazon Inspector is not scanning

E. Associate the target EC2 instances with instance profiles that grant permissions to communicate with AWS Systems Manager

F. Create a managed-instance activation

View answer

Correct Answer: ABE

Question #50

A developer is maintaining a fleet of 50 Amazon EC2 Linux servers. The servers are part of an Amazon EC2Auto Scaling group, and also use Elastic Load Balancing for load balancing.Occasionally, some application servers are being terminated after failing ELB HTTP health checks. The developer would like to perform a root cause analysis on the issue, but before being able to access application logs, the server is terminated.How can log collection be automated?

A. Use Auto Scaling lifecycle hooks to put instances in a Pending:Wait state

B. Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state

C. Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state

D. Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state

View answer

Correct Answer: D

Question #51

A DevOps engineer has automated a web service deployment by using AWS CodePipeline with the following steps:1. An AWS CodeBuild project compiles the deployment artifact and runs unit tests.2. An AWS CodeDeploy deployment group deploys the web service to Amazon EC2 instances in the staging environment.3. A CodeDeploy deployment group deploys the web service to EC2 instances in the production environment.The quality assurance (QA) team requests permission to inspect the build artifact before the deployment to the production environment occurs. The QA team wants to run an internal penetration testing tool to conduct manual tests. The tool will be invoked by a REST API call.Which combination of actions should the DevOps engineer take to fulfill this request? (Choose two.)

A. Insert a manual approval action between the test actions and deployment actions of the pipeline

B. Modify the buildspec

C. Update the CodeDeploy deployment groups so that they require manual approval to proceed

D. Update the pipeline to directly call the REST API for the penetration testing tool

E. Update the pipeline to invoke an AWS Lambda function that calls the REST API for the penetration testing tool

View answer

Correct Answer: AE

Question #52

A company has an application that runs on a fleet of Amazon EC2 instances. The application requires frequent restarts. The application logs contain error messages when a restart is required. The application logs are published to a log group in Amazon CloudWatch Logs.

A. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances

B. Create an AWS Lambda function that restarts the application on the instances

C. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances

D. Configure an AWS Systems Manager Automation runbook that runs a script to restart the application on the instances

View answer

Correct Answer: D

Question #53

A developer is maintaining a fleet of 50 Amazon EC2 Linux servers. The servers are part of an Amazon EC2Auto Scaling group, and also use Elastic Load Balancing for load balancing.Occasionally, some application servers are being terminated after failing ELB HTTP health checks. The developer would like to perform a root cause analysis on the issue, but before being able to access application logs, the server is terminated.How can log collection be automated?

A. Use Auto Scaling lifecycle hooks to put instances in a Pending:Wait state

B. Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state

C. Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state

D. Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state

View answer

Correct Answer: D

Question #54

A company wants to use AWS development tools to replace its current bash deployment scripts. The company currently deploys a LAMP application to a group of Amazon EC2 instances behind an Application Load Balancer (ALB). During the deployments, the company unit tests the committed application, stops and starts services, unregisters and re-registers instances with the load balancer, and updates file permissions. The company wants to maintain the same deployment functionality through the shift to using AWS services.Which solution will meet these requirements?

A. Use AWS CodeBuild to test the application

B. Use AWS CodePipeline to move the application from the AWS CodeCommit repository to AWS CodeDeploy

C. Use AWS CodePipeline to move the application source code from the AWS CodeCommit repository to AWS CodeDeploy

D. Use AWS CodePipeline to trigger AWS CodeBuild to test the application

View answer

Correct Answer: D

Question #55

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #56

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts.The buildspec.yml file contains the following:The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts.What steps should the DevOps engineer take to stop this?

A. Modify the post_build command to use --acl public-read and configure a bucket policy that grants read access to the relevant AWS accounts only

B. Configure a default ACL for the S3 bucket that defines the set of authenticated users as the relevant AWS accounts only and grants read-only access

C. Create an S3 bucket policy that grants read access to the relevant AWS accounts and denies read access to the principal "*"

D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy that allows read access to the relevant AWS accounts only

View answer

Correct Answer: D

Question #57

A company has 100 GB of log data in an Amazon S3 bucket stored in .csv format. SQL developers want to query this data and generate graphs to visualize it.They also need an e cient, automated way to store metadata from the .csv le. Which combination of steps should be taken to meet these requirements with the LEAST amount of effort? (Choose three.)

A. Filter the data through AWS X-Ray to visualize the data

B. Filter the data through Amazon QuickSight to visualize the data

C. Query the data with Amazon Athena

D. Query the data with Amazon Redshift

E. Use AWS Glue as the persistent metadata store

F. Use Amazon S3 as the persistent metadata store

View answer

Correct Answer: BCE

Question #58

A company has containerized all of its in-house quality control applications. The company is running Jenkins on Amazon EC2 instances, which require patching and upgrading. The compliance officer has requested a DevOps engineer begin encrypting build artifacts since they contain company intellectual property.What should the DevOps engineer do to accomplish this in the MOST maintainable manner?

A. Automate patching and upgrading using AWS Systems Manager on EC2 instances and encrypt Amazon EBS volumes by default

B. Deploy Jenkins to an Amazon ECS cluster and copy build artifacts to an Amazon S3 bucket with default encryption enabled

C. Leverage AWS CodePipeline with a build action and encrypt the artifacts using AWS Secrets Manager

D. Use AWS CodeBuild with artifact encryption to replace the Jenkins instance running on EC2 instances

View answer

Correct Answer: D

Question #59

A DevOps team manages an API running on-premises that serves as a backend for an Amazon API Gateway endpoint. Customers have been complaining about high response latencies, which the development team has verified using the API Gateway latency metrics in Amazon CloudWatch. To identify the cause, the team needs to collect relevant data without introducing additional latency.Which actions should be taken to accomplish this? (Choose two.)

A. Install the CloudWatch agent server side and configure the agent to upload relevant logs to CloudWatch

B. Enable AWS X-Ray tracing in API Gateway, modify the application to capture request segments, and upload those segments to X-Ray during each request

C. Enable AWS X-Ray tracing in API Gateway, modify the application to capture request segments, and use the X-Ray daemon to upload segments to X-Ray

D. Modify the on-premises application to send log information back to API Gateway with each request

E. Modify the on-premises application to calculate and upload statistical data relevant to the API service requests to CloudWatch metrics

View answer

Correct Answer: AC

Question #60

A development team is using AWS CodeCommit to version control application code and AWS CodePipeline to orchestrate software deployments. The team has decided to use a remote main branch as the trigger for the pipeline to integrate code changes. A developer has pushed code changes to the CodeCommit repository, but noticed that the pipeline had no reaction, even after 10 minutes.Which of the following actions should be taken to troubleshoot this issue?

A. Check that an Amazon EventBridge rule has been created for the main branch to trigger the pipeline

B. Check that the CodePipeline service role has permission to access the CodeCommit repository

C. Check that the developer's IAM role has permission to push to the CodeCommit repository

D. Check to see if the pipeline failed to start because of CodeCommit errors in Amazon CloudWatch Logs

View answer

Correct Answer: A

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free AWS DOP-C02 Practice Questions & Answers 2026 Part5

View The Updated DOP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free AWS DOP-C02 Practice Questions & Answers 2026 Part5

View The Updated DOP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now