10 free AWS DOP-C02 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 460 questions. Work through them, then open each answer to check your reasoning.
Get all 460 questions (US$39) · Download these 10 as a PDF
Question 1
A company has a mobile application that makes HTTP API calls to an Application Load Balancer (ALB). The ALB routes requests to an AWS Lambda function. Many different versions of the application are in use at any given time, including versions that are in testing by a subset of users. The version of the application is defined in the user-agent header that is sent with all requests to the API.
After a series of recent changes to the API, the company has observed issues with the application. The company needs to gather a metric for each API operation by response code for each version of the application that is in use. A DevOps engineer has modified the Lambda function to extract the API operation name, version information from the user-agent header and response code.
Which additional set of actions should the DevOps engineer take to gather the required metrics?
Show answer and explanation
Correct answer: A. Modify the Lambda function to write the API operation name, response code, and version number as a log line to an Amazon CloudWatch Logs log group. Configure a CloudWatch Logs metric filter that increments a metric for each API operation name. Specify response code and application version as dimensions for the metric.
The DevOps engineer needs to create custom metrics from Lambda function data by writing structured log lines to CloudWatch Logs and using metric filters. Option A correctly specifies writing the API operation name, response code, and version to a log group, then configuring a CloudWatch Logs metric filter to create a metric with response code and application version as dimensions. This approach directly tracks metrics per API operation by response code for each application version without additional infrastructure.
Why the other options are wrong
- B. CloudWatch Logs Insights is a query tool for analyzing logs, not for automatically populating metrics; metric filters are the proper mechanism for this continuous metric generation.
- C. ALB access logs are unnecessary since the Lambda function already has the required data; adding response metadata to ALB responses doesn't help with metric collection.
- D. X-Ray is useful for distributed tracing and service maps but adds complexity; CloudWatch metric filters provide a simpler, more direct solution for this straightforward metric aggregation requirement.
Question 2
A company provides an application to customers. The application has an Amazon API Gateway REST API that invokes an AWS Lambda function.
On initialization, the Lambda function loads a large amount of data from an Amazon DynamoDB table. The data load process results in long cold-start times of 8-10 seconds. The DynamoDB table has DynamoDB Accelerator (DAX) configured.
Customers report that the application intermittently takes a long time to respond to requests. The application receives thousands of requests throughout the day. In the middle of the day, the application experiences 10 times more requests than at any other time of the day. Near the end of the day, the application's request volume decreases to 10% of its normal total.
A DevOps engineer needs to reduce the latency of the Lambda function at all times of the day.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Configure provisioned concurrency on the Lambda function. Configure AWS Application Auto Scaling on the Lambda function with provisioned concurrency values set to a minimum of 1 and a maximum of 100.
Provisioned concurrency keeps initialized execution environments ready, which removes the 8-10 second initialization penalty caused by loading the DynamoDB data at startup. Pairing provisioned concurrency with Application Auto Scaling lets the number of pr-armed environments grow for the 10x midday peak and shrink when volume drops to 10 percent, so latency stays low at every time of day while cost tracks demand. Keeping the DAX cluster also keeps the initialization work itself as fast as possible.
Why the other options are wrong
- A. A fixed provisioned concurrency of one cannot absorb thousands of requests or the midday spike, and deleting the DAX cluster slows the data load that causes the cold start in the first place.
- B. Setting reserved concurrency to zero caps the function at zero concurrent executions, which throttles every invocation and stops the application from running at all.
- D. Reserved concurrency only partitions and limits the concurrency pool and never pr-nitializes environments, and API Gateway has no reserved concurrency setting to scale.
Question 3
A company is adopting AWS CodeDeploy to automate its application deployments for a Java-Apache Tomcat application with an Apache Webserver. The development team started with a proof of concept, created a deployment group for a developer environment, and performed functional tests within the application. After completion, the team will create additional deployment groups for staging and production.
The current log level is configured within the Apache settings, but the team wants to change this configuration dynamically when the deployment occurs, so that they can set different log level configurations depending on the deployment group without having a different application revision for each group.
How can these requirements be met with the LEAST management overhead and without requiring different script versions for each deployment group?
Show answer and explanation
Correct answer: B. Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_ NAME to identify which deployment group the instance is part of. Use this information to configure the log level settings. Reference this script as part of the BeforeInstall lifecycle hook in the appspec.yml file.
CodeDeploy automatically exports DEPLOYMENT_GROUP_NAME to every lifecycle event script, so a single script in the application revision can branch on the group name and write the correct Apache log level. Placing the script in the BeforeInstall hook sets the configuration before the application files land, and one script version serves developer, staging, and production. No tagging, API calls, or extra variable management are required.
Why the other options are wrong
- A. Calling the instance metadata service and the EC2 API to resolve tags adds IAM permissions, code, and tag maintenance that the built-in environment variable already makes unnecessary.
- C. CodeDeploy does not support user-defined environment variables for lifecycle scripts, and ValidateService runs after the application has already started with the wrong log level.
- D. The Install lifecycle event is reserved for the CodeDeploy agent to copy revision files and cannot run a custom script, and matching on the opaque deployment group ID is harder to maintain than the group name.
Question 4
A company requires its developers to tag all Amazon Elastic Block Store (Amazon EBS) volumes in an account to indicate a desired backup frequency. This requirement Includes EBS volumes that do not require backups. The company uses custom tags named Backup_Frequency that have values of none, dally, or weekly that correspond to the desired backup frequency. An audit finds that developers are occasionally not tagging the EBS volumes.
A DevOps engineer needs to ensure that all EBS volumes always have the Backup_Frequency tag so that the company can perform backups at least weekly unless a different value is specified.
Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Set up AWS Config in the account. Use a managed rule that returns a compliance failure for EC2::Volume resources that do not have a Backup Frequency tag applied. Configure a remediation action that uses a custom AWS Systems Manager Automation runbook to apply the Backup_Frequency tag with a value of weekly.
AWS Config managed rules (including ones for tagging compliance) evaluate resources continuously across the account. A managed rule detects non-compliant EBS volumes lacking the Backup_Frequency tag, and automatic remediation through a Systems Manager runbook applies the default 'weekly' value. This ensures compliance for all volumes, including those created before the policy was enacted, without requiring even-riven triggers.
Why the other options are wrong
- A. A custom rule requires more maintenance than a managed rule and provides no additional benefit for this straightforward tagging requirement.
- C. CloudTrail and EventBridge only detect new CreateVolume events; volumes that were already created and lack tags would never be remediated.
- D. Even with CreateVolume and ModifyVolume events, this approach still misses all existing untagged volumes and adds unnecessary operational overhead compared to Config's continuous compliance evaluation.
Question 5
A company is using an Amazon Aurora cluster as the data store for its application. The Aurora cluster is configured with a single DB instance. The application performs read and write operations on the database by using the cluster's instance endpoint.
The company has scheduled an update to be applied to the cluster during an upcoming maintenance window. The cluster must remain available with the least possible interruption during the maintenance window.
What should a DevOps engineer do to meet these requirements?
Show answer and explanation
Correct answer: A. Add a reader instance to the Aurora cluster. Update the application to use the Aurora cluster endpoint for write operations. Update the Aurora cluster's reader endpoint for reads.
Adding a reader instance creates a multi-instance Aurora cluster. During maintenance, the single instance is updated while the reader handles read traffic, minimizing downtime. The application uses the cluster endpoint for writes (which routes to the primary) and the reader endpoint for reads, enabling read operations to continue on the replica during maintenance.
Why the other options are wrong
- B. Custom ANY endpoints do not provide automatic failover capability and do not address the maintenance window requirement.
- C. Multi-AZ primarily addresses failure scenarios but does not automatically failover during scheduled maintenance; a reader instance is still needed for read availability.
- D. Multi-AZ without an additional reader instance still requires the primary to be updated, causing write unavailability; custom ANY endpoints do not improve this situation.
Question 6
A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.
The company has created an AWS Key Management Service (AWS KMS) key in the source account.
Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)
Show answer and explanation
Correct answer: A, D, F
A. In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action. D. In the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role. F. In the source account, share the encrypted AMI with the target account. Copy the unencrypted AMI in the source account and specify the company KMS key in the copy operation to produce an encrypted AMI. Then update that key's policy in the source account so the target account can create grants, and have the target account create a grant for the Auto Scaling service-linked role so scaling activities can decrypt the snapshots. Finally share the encrypted AMI with the target account so the Auto Scaling group can launch from it.
Why the other options are wrong
- B. The default EBS encryption key is an AWS managed key that cannot be shared across accounts, so the target account could never launch instances from the copied AMI.
- C. The grant for the Auto Scaling service-linked role must be created by the target account after the source account key policy permits it, so a grant created solely in the source account does not complete the cross-account setup.
- E. Sharing the AMI while it is still unencrypted breaks the requirement that all shared AMIs be encrypted.
Question 7
A company uses AWS CodePipeline pipelines to automate releases of its application A typical pipeline consists of three stages build, test, and deployment. The company has been using a separate AWS CodeBuild project to run scripts for each stage. However, the company now wants to use AWS CodeDeploy to handle the deployment stage of the pipelines.
The company has packaged the application as an RPM package and must deploy the application to a fleet of Amazon EC2 instances. The EC2 instances are in an EC2 Auto Scaling group and are launched from a common AMI.
Which combination of steps should a DevOps engineer perform to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D
A. Create a new version of the common AMI with the CodeDeploy agent installed. Update the IAM role of the EC2 instances to allow access to CodeDeploy. D. Create an application in CodeDeploy. Configure an in-place deployment type. Specify the Auto Scaling group as the deployment target. Update the CodePipeline pipeline to use the CodeDeploy action to deploy the application. CodeDeploy requires the agent to be running on every target instance, so baking the agent into the common AMI and giving the instance profile permission to communicate with CodeDeploy prepares the fleet. Creating a CodeDeploy application with an in-place deployment that targets the Auto Scaling group means new instances launched by scaling are covered automatically, and replacing the CodeBuild deploy stage with a CodeDeploy action in CodePipeline completes the pipeline change.
Why the other options are wrong
- B. The AppSpec file is authored and packaged inside the application revision rather than baked into the AMI, and it grants no IAM permissions because the instance profile does that.
- C. EC2 Image Builder and a new AMI per release are unnecessary because CodeDeploy installs the RPM onto running instances.
- E. Targeting a static list of EC2 instances leaves instances added later by the Auto Scaling group without the new application version.
Question 8
A company’s security team requires that all external Application Load Balancers (ALBs) and Amazon API Gateway APIs are associated with AWS WAF web ACLs. The company has hundreds of AWS accounts, all of which are included in a single organization in AWS Organizations. The company has configured AWS Config for the organization. During an audit, the company finds some externally facing ALBs that are not associated with AWS WAF web ACLs.
Which combination of steps should a DevOps engineer take to prevent future violations? (Choose two.)
Show answer and explanation
Correct answer: A, C
A. Delegate AWS Firewall Manager to a security account. C. Create an AWS Firewall Manager policy to attach AWS WAF web ACLs to any newly created ALBs and API Gateway APIs. AWS Firewall Manager must be delegated to a security account to manage WAF policies across the organization (option A). Then, an AWS Firewall Manager policy is created to automatically attach WAF web ACLs to newly created ALBs and API Gateway APIs (option C). This provides centralized, organization-wide enforcement without requiring individual AWS Config rules in each account.
Why the other options are wrong
- B. Amazon GuardDuty is for threat detection and cannot enforce WAF policy application.
- D. GuardDuty policies do not exist and cannot attach WAF web ACLs; this service is not designed for compliance enforcement.
- E. AWS Config alone cannot enforce policy application across the organization; Firewall Manager is the correct service for centralized WAF policy management across accounts.
Question 9
A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days.
Which solution will accomplish this?
Show answer and explanation
Correct answer: C. Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
AWS Config custom rules can evaluate the age of KMS keys and trigger remediation actions. A custom rule can be configured to check when KMS keys haven't been rotated in 90 days and publish notifications to SNS. This provides the monitoring and alerting capability needed for compliance tracking. AWS KMS itself does not have built-in publish functionality for key age metrics, EventBridge and Trusted Advisor are not designed for this specific KMS key rotation use case, and Security Hub primarily aggregates findings rather than performing custom key rotation monitoring.
Why the other options are wrong
- A. AWS KMS does not have native functionality to publish to SNS based on key rotation age.
- B. Trusted Advisor API does not provide detailed KMS key rotation tracking at the individual key level.
- D. Security Hub is designed for security findings aggregation, not custom KMS key rotation monitoring.
Question 10
A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.
How can this issue be corrected in the MOST secure manner?
Show answer and explanation
Correct answer: C. Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script.
The most secure approach combines removing unauthenticated access via bucket policy, granting the CodeBuild service role S3 permissions through IAM, and using the AWS CLI which automatically handles authentication through the role's credentials. This follows the principle of least privilege by using temporary credentials from the service role rather than storing long-term access keys, eliminates unauthenticated access entirely, and uses secure AWS tools. Using long-term IAM access keys and secret access keys is less secure than relying on service role credentials, and HTTPS basic authentication is not an S3 standard feature.
Why the other options are wrong
- A. AllowedBuckets is not a standard CodeBuild setting; this doesn't properly address the authentication requirement.
- B. S3 does not support HTTPS basic authentication with tokens; this is not a valid S3 security mechanism.
- D. Using explicit IAM access keys and secret access keys is less secure than leveraging temporary credentials from the CodeBuild service role.
That was 10 of 460.
The full AWS DOP-C02 pack has all 460 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.