Get Your CertDOP-C02PlayCompete
‹ DOP-C02 tests

AWS Certified DevOps Engineer – Professional (DOP-C02) practice questions

100 questions in 10 tests. Open one to answer it on its own, or take a whole test.

Test 1

Take Test 1 ›
  1. A payments team deploys an AWS Lambda function through AWS CodePipeline with a CodeDeploy deploy action. Leadership requires that a new function version receive a small slice of… · SDLC Automation
  2. A central Tooling account hosts an AWS CodePipeline pipeline that must deploy into separate Dev, Staging, and Production accounts in the same AWS Organization. An engineer adds a… · SDLC Automation
  3. Builds in an AWS CodeBuild project take roughly 14 minutes, and the build logs show that about 9 of those minutes are spent re-downloading the same third-party dependency… · SDLC Automation
  4. A platform team must guarantee that every account in the Workloads organizational unit (OU) of an AWS Organization has an identical baseline stack: a logging role, a Config… · Configuration Management and IaC
  5. Before applying a template change to a production CloudFormation stack, a release engineer needs to know whether the update will replace the stack's Amazon RDS DB instance, a… · Configuration Management and IaC
  6. An Amazon ECS service behind an Application Load Balancer is deployed by CodeDeploy using the blue/green deployment type. The team needs to run an automated smoke-test suite… · Resilient Cloud Solutions
  7. Forty application accounts each write structured application logs to CloudWatch Logs. A central Security account must receive a continuous, near-real-time copy of every… · Monitoring and Logging
  8. On-call engineers are paged several times a week because a fleet of EC2 instances fills its /var/log volume. The documented fix is a fixed six-step procedure: capture a… · Incident and Event Response
  9. An external CI system (GitHub Actions) currently deploys to AWS using an IAM user's long-lived access keys stored as repository secrets. A security review demands that no… · Security and Compliance
  10. An auditor requires that management-event API activity from every account in an AWS Organization (including accounts created after the control is put in place) be captured in a… · Security and Compliance

Test 2

Take Test 2 ›
  1. A team defines its delivery pipeline with the AWS CDK v2 pipelines.CodePipeline construct. A year ago, while iterating on the pipeline, an engineer set selfMutation: false and… · SDLC Automation
  2. An AWS CodeBuild project runs integration tests that need a third-party API token. Today the token is written in plain text under env/variables in the buildspec.yml committed to… · SDLC Automation
  3. An organization has about 300 AWS accounts, and AWS Config recording is already on in every account and Region in use. The security team wants a standard set of Config rules for… · Configuration Management and IaC
  4. A trading platform runs active-passive in two AWS Regions behind Amazon Route 53 failover records. After a past incident in which flapping health checks caused repeated automatic… · Resilient Cloud Solutions
  5. Instances in an Amazon EC2 Auto Scaling group process jobs from a queue and buffer application logs locally. When a target tracking policy scales in, instances are terminated… · Resilient Cloud Solutions
  6. An application has 40 CloudWatch metric alarms, one per microservice, each sending to an on-call Amazon SNS topic. When a shared dependency fails, all 40 alarms fire and the… · Monitoring and Logging
  7. An e-commerce site's checkout is a multi-step browser flow: sign in, add an item to the cart, and pay with a test card. Twice this quarter a front-end release broke the payment… · Monitoring and Logging
  8. A CloudFormation stack that holds a production Amazon RDS database and its supporting resources fails an update, and the stack then shows UPDATE_ROLLBACK_FAILED. The stack events… · Incident and Event Response
  9. An AWS Lambda function is invoked asynchronously by Amazon EventBridge to process order events. Occasionally an event fails every retry and is silently discarded, and the on-call… · Incident and Event Response
  10. Application teams submit CloudFormation templates that include IAM roles with inline identity policies, and a central pipeline deploys them. The security team rules that no such… · Security and Compliance

Test 3

Take Test 3 ›
  1. A team deploys a web application to an Amazon EC2 fleet with AWS CodeDeploy in-place deployments. During an incident, an engineer manually cleaned up disk space on a subset of… · SDLC Automation
  2. A team's release pipeline in AWS CodePipeline takes its input from a versioned Amazon S3 object that a build job uploads. Developers complain that after the object is uploaded it… · SDLC Automation
  3. A deployment pipeline creates an AWS CloudFormation stack that provisions an Auto Scaling group of six Amazon EC2 instances. User data installs and configures the application… · Configuration Management and IaC
  4. A regulated company runs 500 Amazon EC2 managed nodes. Auditors require a daily report of which approved patches are missing from every node. Change management forbids installing… · Configuration Management and IaC
  5. An Auto Scaling group of 40 instances behind an Application Load Balancer must be moved to a new Amazon Machine Image. The Auto Scaling group is created and managed by a… · Resilient Cloud Solutions
  6. An application writes structured JSON log events to a single Amazon CloudWatch Logs log group. The operations team must be paged within five minutes whenever more than 10 events… · Monitoring and Logging
  7. An operations team needs CloudWatch alarms on memory utilization and free disk space for a fleet of Amazon EC2 Linux instances. In the CloudWatch console they can find… · Monitoring and Logging
  8. A legacy licensed application runs on a single Amazon EBS-backed EC2 instance. The vendor license is bound to the instance ID, and other systems reach the application by its… · Incident and Event Response
  9. A company runs about 60 accounts in AWS Organizations with all features enabled. An organization trail delivers CloudTrail logs to a bucket in the Log Archive account. After an… · Security and Compliance
  10. A containerized service reads an Amazon Aurora PostgreSQL credential from AWS Secrets Manager and caches it in memory for one hour. Secrets Manager rotates the secret every 30… · Security and Compliance

Test 4

Take Test 4 ›
  1. A team enabled Amazon VPC access on an AWS CodeBuild project so that integration tests could reach a private Amazon RDS database. The tests now connect to the database… · SDLC Automation
  2. An Amazon ECS service on AWS Fargate uses the rolling update (ECS) deployment controller behind an Application Load Balancer. When a bad task definition is deployed, tasks crash… · SDLC Automation
  3. A CloudFormation template registers each new environment with a third-party monitoring SaaS that has no CloudFormation resource type, and deregisters it when the stack is… · Configuration Management and IaC
  4. A CloudFormation template provisions an Amazon RDS database and an Amazon ECS task definition that needs the database password. Today the password is a template parameter… · Configuration Management and IaC
  5. A three-tier application runs on Amazon EC2 behind an Application Load Balancer with an Amazon Aurora PostgreSQL cluster in a single Region. The business sets a 30-minute RTO and… · Resilient Cloud Solutions
  6. An application is built from Amazon API Gateway, an AWS Lambda function, two internal services running on Amazon ECS, and an Amazon DynamoDB table. Users report that a small… · Monitoring and Logging
  7. A company must protect backups of Amazon EBS volumes, Amazon RDS databases, and Amazon DynamoDB tables against two scenarios: a full compromise of the production AWS account, and… · Resilient Cloud Solutions
  8. An organization runs 30 AWS CodePipeline pipelines across one account. The on-call team wants to be notified the moment any build or deploy action in any of those pipelines… · Incident and Event Response
  9. An automated response to an Amazon GuardDuty finding must snapshot the affected instance's Amazon EBS volumes, replace the instance's security group with an isolation group, open… · Incident and Event Response
  10. A platform team wants application teams to create their own IAM roles for AWS Lambda functions in a sandbox account so they stop filing tickets for every function. The platform… · Security and Compliance

Test 5

Take Test 5 ›
  1. A pipeline builds an application and deploys it to a staging environment automatically. Compliance now requires that a named release manager sign off before anything reaches… · SDLC Automation
  2. Builds run in private subnets and pull open-source npm packages from the public npm registry through a NAT gateway. Two problems have surfaced: a transient outage at the public… · SDLC Automation
  3. A platform team builds a hardened golden AMI by hand every month: launch an instance from the latest base image, run configuration scripts, work through a manual test checklist… · Configuration Management and IaC
  4. Security requires that a specific CloudWatch agent configuration file and a host firewall rule be present on every Amazon EC2 managed node in an account, including nodes that… · Configuration Management and IaC
  5. A session store runs on an Amazon DynamoDB table in us-east-1. The company is launching in Europe and needs low-latency reads and writes from eu-west-1 as well as us-east-1, with… · Resilient Cloud Solutions
  6. An Auto Scaling group runs a JVM application whose instances take about 12 minutes from launch to being able to serve traffic, because each one writes a large reference dataset… · Resilient Cloud Solutions
  7. A nightly batch job publishes a custom ProcessingErrors metric to Amazon CloudWatch, but only emits a data point while it is actually processing records. An alarm on that metric… · Monitoring and Logging
  8. AWS occasionally schedules retirements and maintenance for the Amazon EC2 instances that a team runs. Today the team only finds out when someone happens to read the notification… · Incident and Event Response
  9. A pipeline builds container images, pushes them to Amazon ECR, and deploys them to Amazon ECS. Security has two requirements. First, a deployment must be blocked if the image… · Security and Compliance
  10. An audit flagged the way engineers reach production Amazon EC2 instances: two bastion hosts with a shared SSH key pair, port 22 open to the corporate CIDR, and no record of what… · Security and Compliance

Test 6

Take Test 6 ›
  1. A regulated company requires that every commit merged to the production branch be built and deployed through every stage of its CodePipeline pipeline, in the exact order the… · SDLC Automation
  2. A team deploys a new application version to a production Elastic Beanstalk environment several times a week. They want any deployment that fails its health checks to roll back… · SDLC Automation
  3. A CloudFormation template provisions a production RDS DB instance. Operators need two independent guarantees for that resource. First, if a future stack update ever forces… · Configuration Management and IaC
  4. A platform team wants application teams to be able to self-provision a standard set of resources (a VPC, an RDS instance and an Application Load Balancer) through AWS Service… · Configuration Management and IaC
  5. A company uses AWS Organizations with 20 member accounts. A group of auditors needs read-only access to all resources in every one of those accounts. The security team wants to… · Security and Compliance
  6. A company runs AWS Organizations with dozens of member accounts spread across three Regions. Security Hub CSPM is already enabled independently in each account and Region. The… · Security and Compliance
  7. A company runs an Amazon Aurora Global Database with a primary cluster in us-east-1 and a secondary cluster in eu-west-1. As part of a planned quarterly disaster recovery… · Resilient Cloud Solutions
  8. A developer needs to find the 10 slowest requests logged by a Lambda function in the last hour. The function writes structured JSON log entries to a CloudWatch Logs log group… · Monitoring and Logging
  9. A team discovers that a bug in one of its event consumers caused every event matching a particular EventBridge rule to be processed incorrectly over the last six hours. The bug… · Incident and Event Response
  10. A single CodeBuild project runs a batch build that compiles three components: A, B, and C. Component C's build task consumes artifacts produced by A and B, so it must not start… · SDLC Automation

Test 7

Take Test 7 ›
  1. A fleet of 20 EC2 instances behind a load balancer runs a monolithic application that is deployed with CodeDeploy using the EC2/On-Premises compute platform. The operations team… · SDLC Automation
  2. A company stores container images in an Amazon ECR private repository and wants to guarantee that a released image tag, such as v1.4.0, can never be overwritten by a later push… · SDLC Automation
  3. An engineer suspects that someone manually changed a security group rule that was originally created by a CloudFormation stack, bypassing the stack's template. Which… · Configuration Management and IaC
  4. A team manually created an S3 bucket and a DynamoDB table two years ago, and both resources now hold production data that cannot be recreated. The team wants to bring both… · Configuration Management and IaC
  5. A company runs workloads in a VPC that reaches Amazon S3 only through a gateway VPC endpoint. The security team wants to build a data perimeter so that principals in the VPC can… · Security and Compliance
  6. A security team wants to guarantee that only Lambda deployment packages built and signed by the company's trusted CI pipeline can ever be deployed to a set of production… · Security and Compliance
  7. An application's primary Region publishes a custom CloudWatch metric that reflects a downstream dependency's error rate, a signal that a plain HTTP endpoint health check cannot… · Resilient Cloud Solutions
  8. A team's application already writes structured JSON log entries to CloudWatch Logs for every request, including latency and business fields. The team wants CloudWatch to… · Monitoring and Logging
  9. An operations team wants a critical CloudWatch alarm on an EC2 instance to trigger an automatic response without any custom code or servers. When the alarm enters the ALARM… · Incident and Event Response
  10. A DevOps team is designing a chaos engineering experiment with AWS Fault Injection Service to terminate a percentage of EC2 instances in an Auto Scaling group during business… · Incident and Event Response

Test 8

Take Test 8 ›
  1. A team's application repository lives on GitHub and is connected to a V2 type CodePipeline pipeline through a CodeStar connection. They want the pipeline to start only when a… · SDLC Automation
  2. An Elastic Beanstalk environment runs a web application with an RDS database that was created inside the environment. The team wants to move to a blue/green deployment model… · SDLC Automation
  3. A company runs a V2 type CodePipeline pipeline that deploys to production through a Deploy stage. When a bad release causes the Deploy stage to fail, an engineer currently has to… · SDLC Automation
  4. A fleet of long-running EC2 instances is configured through AWS::CloudFormation::Init metadata on their launch template's underlying CloudFormation resource: a config set… · Configuration Management and IaC
  5. A "network" stack exports its VPC ID and subnet IDs with Export names, and three separate application stacks import those values with Fn::ImportValue. A platform engineer now… · Configuration Management and IaC
  6. A security team wants ongoing, automated visibility into IAM roles that have not been used recently, IAM user access keys and passwords that have gone unused, and permissions… · Security and Compliance
  7. A platform team onboards a new project team roughly every week. Each project gets its own set of EC2 instances, and every engineer assigned to a project must be able to start… · Security and Compliance
  8. A worker fleet consumes messages from a standard SQS queue. A small percentage of messages contain malformed data that always causes the consumer to throw an exception and let… · Resilient Cloud Solutions
  9. An e-commerce order processing service has request latency that is naturally much higher every weekday between 9 AM and 11 AM and every night during a nightly batch job, both… · Monitoring and Logging
  10. A company uses an AWS Config managed rule to detect Amazon EBS volumes that are not encrypted. When the rule marks a volume noncompliant, the team wants AWS Config itself, with… · Incident and Event Response

Test 9

Take Test 9 ›
  1. A company runs a fleet of on-premises servers in a data center that has no plans to migrate to EC2 in the near term. The DevOps team wants to use AWS CodeDeploy to deploy… · SDLC Automation
  2. A team runs unit tests during the build phase of a CodeBuild project and wants the pass/fail results and duration of each test case to appear in the CodeBuild console as a… · SDLC Automation
  3. A platform team wants to stop noncompliant infrastructure before it is ever created, not clean it up afterward. Specifically, whenever any team in the organization submits a… · Configuration Management and IaC
  4. A team maintains a large CloudFormation template with dozens of near-identical resource blocks that differ only by a handful of parameters. They want to author a compact, custom… · Configuration Management and IaC
  5. A company stores customer records in several Amazon S3 buckets and needs an automated way to scan the objects in those buckets, identify content such as national ID numbers and… · Security and Compliance
  6. An application currently runs only in us-east-1 and retrieves its database credentials from AWS Secrets Manager. The company is building a warm standby of the application in… · Security and Compliance
  7. A synchronous API backed by an AWS Lambda function suffers noticeable cold-start latency during sudden traffic spikes that do not follow a predictable daily schedule. The team… · Resilient Cloud Solutions
  8. A company runs a fleet of physical servers in an on-premises data center and needs a disaster recovery target on AWS with a recovery time measured in minutes. The solution must… · Resilient Cloud Solutions
  9. An application log group occasionally receives log lines that include customer social security numbers and credit card numbers because of an upstream logging defect that the team… · Monitoring and Logging
  10. A DevOps engineer needs to send a Systems Manager Run Command document to 2,000 managed instances to restart an agent process. To avoid overwhelming the fleet and to stop the… · Incident and Event Response

Test 10

Take Test 10 ›
  1. A pipeline defined in us-east-1 must deploy a CloudFormation stack to eu-west-1 as one of its stages. The team wrote the pipeline in a single CloudFormation template and the… · SDLC Automation
  2. A team ships a new checkout feature behind a flag that is read by a Lambda function on every invocation. They want to enable the flag for 10% of traffic, then 25%, 50%, and 100%… · SDLC Automation
  3. A StackSet deploys a security baseline to 60 accounts across three Regions. A DevOps engineer must update the StackSet so that: a bad template is caught early and the rollout… · Configuration Management and IaC
  4. A central tooling account runs a CDK Pipelines pipeline that deploys stacks into a separate production account. A DevOps engineer needs the production account to allow the… · Configuration Management and IaC
  5. A public API behind an Application Load Balancer is being hit by a single client IP address that sends an abnormally high volume of requests per minute, degrading response times… · Security and Compliance
  6. A company's AWS Organization already uses service control policies (SCPs) to restrict what IAM principals inside member accounts are allowed to do. A security review finds a gap… · Security and Compliance
  7. A latency-sensitive TCP application runs behind Network Load Balancers in two Regions. The company needs client traffic to keep using the same two static IP addresses no matter… · Resilient Cloud Solutions
  8. An operations team runs several services on Amazon ECS on Fargate. They currently have no visibility into per-task CPU and memory utilization, and cannot tell which service in a… · Monitoring and Logging
  9. A security team needs to identify which IAM principal deleted a specific Amazon EBS volume two weeks ago, across an organization with dozens of accounts. They want to run a… · Monitoring and Logging
  10. An operations team receives operational problems from several sources: CloudWatch alarms firing on production services, AWS Config rules reporting noncompliant resources, and… · Incident and Event Response