AWS DOP-C02 · Updated 2026
Free AWS DevOps Engineer Professional Practice Exam (DOP-C02)
Full-length DOP-C02 mock exams with the same number of questions and time as the real exam. CI/CD, infrastructure as code, resilience, monitoring, incident response and security scenarios, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
75 questions · 3 hours · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 8
🏆
Question 1SDLC Automation
A fintech company runs CodePipeline in a tooling account and deploys a CloudFormation stack into a separate production account. The artifact bucket uses default S3 encryption with the AWS managed aws/s3 key. The deploy action fails because the production account role cannot read the input artifact. Which change BEST fixes the problem?
Correct answer: C. Encrypt artifacts with a customer managed KMS key and grant the production role access in the key policy and bucket policy.
AWS managed keys cannot have their key policies edited, so they cannot be shared with another account. A customer managed key lets you grant the production role decrypt access, and the bucket policy grants read access to the objects. Disabling encryption would break the company's security posture and is not required.
AWS managed keys cannot have their key policies edited, so they cannot be shared with another account. A customer managed key lets you grant the production role decrypt access, and the bucket policy grants read access to the objects. Disabling encryption would break the company's security posture and is not required.
Question 2Incident & Event Response
Northwind Analytics uses AWS Organizations with 30 member accounts. The security team wants EC2 instance state-change events from every member account delivered to a custom event bus in a central monitoring account. New accounts join the organization every month, and the team wants the least ongoing maintenance. Which solution BEST meets these requirements?
Correct answer: B. Allow events:PutEvents on the central bus with an aws:PrincipalOrgID condition, and use StackSets to deploy member rules that target it.
A resource policy scoped by aws:PrincipalOrgID automatically covers new accounts, and StackSets with automatic deployment adds the forwarding rule to each new account. Listing account IDs works but requires a policy edit for every new account, which adds ongoing maintenance.
A resource policy scoped by aws:PrincipalOrgID automatically covers new accounts, and StackSets with automatic deployment adds the forwarding rule to each new account. Listing account IDs works but requires a policy edit for every new account, which adds ongoing maintenance.
Question 3Resilient Solutions
A media company runs a video transcoding fleet in an Auto Scaling group. When the group scales in, instances are terminated while jobs are still writing output, and local log files are lost. The company needs each instance to finish its current job and copy its logs to Amazon S3 before termination, which can take up to 20 minutes. Which solution BEST meets these requirements?
Correct answer: D. Add a termination lifecycle hook with a 30-minute timeout and complete the action after logs upload.
A termination lifecycle hook holds the instance in the Terminating:Wait state so it can finish work and upload logs, then signal completion. Deregistration delay only drains connections at the load balancer and does not run or wait for batch work or log copying.
A termination lifecycle hook holds the instance in the Terminating:Wait state so it can finish work and upload logs, then signal completion. Deregistration delay only drains connections at the load balancer and does not run or wait for batch work or log copying.
Question 4SDLC Automation
A healthcare SaaS provider deploys to production through CodePipeline. Compliance requires that a release manager explicitly approve each production deployment and that approvers are notified by email. Developers must not be able to approve their own releases. Which solution BEST meets these requirements?
Correct answer: A. Add a manual approval action with an SNS notification before production and allow only release managers to call PutApprovalResult.
A manual approval action pauses the pipeline, can publish to SNS for email notification, and is approved through the PutApprovalResult API, which IAM can restrict to release managers. Disabling stage transitions works mechanically but provides no built-in approval record or notification. Pull request rules control merges, not production deployment approvals.
A manual approval action pauses the pipeline, can publish to SNS for email notification, and is approved through the PutApprovalResult API, which IAM can restrict to release managers. Disabling stage transitions works mechanically but provides no built-in approval record or notification. Pull request rules control merges, not production deployment approvals.
Question 5Incident & Event Response
A logistics company processes shipment updates from an Amazon SQS standard queue with a Lambda consumer. A faulty release caused about 40,000 messages to move to the queue's dead-letter queue. The bug is now fixed, and the team must reprocess the messages with the least operational effort. Which solution BEST meets these requirements?
Correct answer: B. Start a dead-letter queue redrive to move the messages from the dead-letter queue back to the source queue.
SQS supports a managed redrive that moves messages from a dead-letter queue back to its source queue with no custom code. A custom script would also work, but it adds code to write, test, and run, which is more effort than the built-in redrive.
SQS supports a managed redrive that moves messages from a dead-letter queue back to its source queue with no custom code. A custom script would also work, but it adds code to write, test, and run, which is more effort than the built-in redrive.
Question 6Resilient Solutions
A research company runs an application on EC2 instances in an Auto Scaling group. Each new instance runs a 12-minute bootstrap script that installs packages and downloads large reference files to its EBS volume, so scale-out cannot keep up with sudden demand. The company wants faster scale-out without paying for extra running instances. Which solution BEST meets these requirements?
Correct answer: A. Configure a warm pool that keeps pre-initialized instances in the Stopped state.
A warm pool keeps instances that have already run their bootstrap in a Stopped state, so the company pays mainly for EBS storage and the instances start quickly on scale-out. Predictive scaling helps with forecastable patterns but does not help with sudden, unpredictable spikes.
A warm pool keeps instances that have already run their bootstrap in a Stopped state, so the company pays mainly for EBS storage and the instances start quickly on scale-out. Predictive scaling helps with forecastable patterns but does not help with sudden, unpredictable spikes.
Question 7SDLC Automation
A media company stores application code in GitHub and connects it to CodePipeline through AWS CodeConnections. The team wants the production pipeline to start only when a Git tag that matches the pattern v* is pushed. Commits to branches must not start the pipeline. Which approach BEST meets this requirement with the least operational overhead?
Correct answer: D. Use a V2 pipeline with a trigger that filters on Git tags matching v* and disable change detection on push.
V2 pipelines support triggers with filters on Git tags, branches and file paths for connection-based sources such as GitHub. This is native and needs no custom code. V1 pipelines do not support trigger filters, and EventBridge repository events apply to CodeCommit rather than GitHub.
V2 pipelines support triggers with filters on Git tags, branches and file paths for connection-based sources such as GitHub. This is native and needs no custom code. V1 pipelines do not support trigger filters, and EventBridge repository events apply to CodeCommit rather than GitHub.
Question 8Incident & Event Response
A media company runs an AWS Step Functions Standard workflow that calls a Lambda function to transcode video files. During peak hours the function is sometimes throttled, and the execution fails. The team wants throttled calls retried with growing delays, and any other error must send a notification and end the execution cleanly. Which solution BEST meets these requirements?
Correct answer: A. Add a Retry on Lambda.TooManyRequestsException with a backoff rate, plus a Catch on States.ALL that goes to an SNS publish state.
A Retry with a backoff rate retries throttling errors with increasing delays, and a Catch on States.ALL routes all remaining errors to a notification state. A Lambda dead-letter queue only applies to asynchronous invocations, and Step Functions invokes the task synchronously, so it would capture nothing.
A Retry with a backoff rate retries throttling errors with increasing delays, and a Catch on States.ALL routes all remaining errors to a notification state. A Lambda dead-letter queue only applies to asynchronous invocations, and Step Functions invokes the task synchronously, so it would capture nothing.
Question 9Resilient Solutions
An ecommerce company runs its web tier on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Sometimes the application process hangs, and the load balancer marks the instance unhealthy, but the instance keeps running and is never replaced. The company wants these instances replaced automatically. Which solution BEST meets this requirement?
Correct answer: C. Turn on Elastic Load Balancing health checks for the Auto Scaling group.
By default an Auto Scaling group uses only EC2 status checks, which still pass when an application process hangs. Adding ELB health checks makes the group replace instances that the load balancer reports as unhealthy, while a StatusCheckFailed alarm would never fire for an application hang.
By default an Auto Scaling group uses only EC2 status checks, which still pass when an application process hangs. Adding ELB health checks makes the group replace instances that the load balancer reports as unhealthy, while a StatusCheckFailed alarm would never fire for an application hang.
Question 10SDLC Automation
A retail company uses CodeBuild to build container images from a Dockerfile and push them to Amazon ECR. The build uses a standard managed image and fails with an error saying it cannot connect to the Docker daemon. The buildspec and IAM permissions are otherwise correct. What should a DevOps engineer do to fix the build?
Correct answer: A. Enable privileged mode in the CodeBuild project environment settings.
Building Docker images inside CodeBuild requires privileged mode so the build container can run the Docker daemon. Starting the service manually still fails without privileged access. ECR permissions affect pushing images, not connecting to the daemon.
Building Docker images inside CodeBuild requires privileged mode so the build container can run the Docker daemon. Starting the service manually still fails without privileged access. ECR permissions affect pushing images, not connecting to the daemon.
Question 11SDLC Automation
An insurance company runs integration tests in CodeBuild against an Amazon RDS database in private subnets. The tests must reach the database, and the build must also download packages from the internet. Security policy does not allow the database to be publicly accessible. Which configuration BEST meets these requirements?
Correct answer: D. Configure the build project with the VPC, private subnets with a route to a NAT gateway, and a security group allowed by the database.
CodeBuild in a VPC needs private subnets with a NAT gateway route for internet access, and its security group must be allowed by the database. CodeBuild does not assign public IP addresses, so public subnets do not provide internet access. Allowing service IP ranges would require exposing the private database.
CodeBuild in a VPC needs private subnets with a NAT gateway route for internet access, and its security group must be allowed by the database. CodeBuild does not assign public IP addresses, so public subnets do not provide internet access. Allowing service IP ranges would require exposing the private database.
Question 12Incident & Event Response
A retail company must make sure that no security group in its production account allows SSH from 0.0.0.0/0. If such a rule appears, it must be removed within minutes without human action. The team wants to use AWS managed components and avoid custom code. Which solution BEST meets these requirements?
Correct answer: B. Use the restricted-ssh AWS Config managed rule with automatic remediation through the AWS-DisablePublicAccessForSecurityGroup runbook.
The managed Config rule detects the open SSH rule, and automatic remediation runs an AWS managed SSM Automation runbook that removes it with no custom code. Sending notifications to the operations team still depends on a person to fix the rule, so it does not meet the no human action requirement.
The managed Config rule detects the open SSH rule, and automatic remediation runs an AWS managed SSM Automation runbook that removes it with no custom code. Sending notifications to the operations team still depends on a person to fix the rule, so it does not meet the no human action requirement.
Question 13Resilient Solutions
A travel booking company serves its website from an Application Load Balancer in us-east-1. During a Regional outage, it wants Amazon Route 53 to send users to a static maintenance page hosted on an S3 website endpoint in us-west-2. The switch must happen automatically and must revert when the primary site recovers. Which solution BEST meets these requirements?
Correct answer: C. Use failover routing with a health check on the primary ALB record and S3 as the secondary.
Failover routing answers with the primary record while its health check passes and switches to the secondary when it fails, then switches back after recovery. Latency routing would send some users to the maintenance page even when the primary site is healthy.
Failover routing answers with the primary record while its health check passes and switches to the secondary when it fails, then switches back after recovery. Latency routing would send some users to the maintenance page even when the primary site is healthy.
Question 14SDLC Automation
A logistics company runs Java builds in CodeBuild several times a day, and each build spends six minutes downloading the same Maven dependencies. Builds often run hours apart, so they rarely land on the same build host. The team wants to reduce build time reliably. Which solution BEST meets this requirement?
Correct answer: B. Enable Amazon S3 caching on the build project and list the Maven repository directory under cache paths in the buildspec.
An S3 cache persists between builds regardless of which host runs them, so it suits builds that run hours apart. Local caches are best effort and only help when builds run on the same host shortly after each other. Committing dependencies bloats the repository and is hard to maintain.
An S3 cache persists between builds regardless of which host runs them, so it suits builds that run hours apart. Local caches are best effort and only help when builds run on the same host shortly after each other. Committing dependencies bloats the repository and is hard to maintain.
Question 15Incident & Event Response
A team updated an AWS CloudFormation stack and the update failed. During rollback, the stack entered UPDATE_ROLLBACK_FAILED because an engineer had manually deleted an Amazon DynamoDB table that the stack manages. The team must return the stack to a working state without deleting the other resources in it. Which solution BEST meets these requirements?
Correct answer: D. Run continue-update-rollback and list the deleted table as a resource to skip.
ContinueUpdateRollback with resources to skip lets CloudFormation finish the rollback and reach UPDATE_ROLLBACK_COMPLETE while keeping the other resources. Stack updates and change sets cannot run while a stack is in UPDATE_ROLLBACK_FAILED, and deleting the stack would remove the resources the team must keep.
ContinueUpdateRollback with resources to skip lets CloudFormation finish the rollback and reach UPDATE_ROLLBACK_COMPLETE while keeping the other resources. Stack updates and change sets cannot run while a stack is in UPDATE_ROLLBACK_FAILED, and deleting the stack would remove the resources the team must keep.
Question 16Resilient Solutions
A gaming startup stores player session data in a DynamoDB table that uses provisioned capacity with auto scaling. When a new game launches, traffic jumps from a few hundred to several thousand requests per second within minutes, and requests are throttled before auto scaling reacts. Traffic is unpredictable, and the team wants to stop doing capacity planning. Which solution BEST meets these requirements?
Correct answer: B. Switch the table to on-demand capacity mode.
On-demand mode adapts to traffic changes without any capacity settings, which fits unpredictable spikes and removes capacity planning. A lower target utilization still depends on provisioned capacity and the delay of auto scaling, so it does not remove planning or fully prevent throttling.
On-demand mode adapts to traffic changes without any capacity settings, which fits unpredictable spikes and removes capacity planning. A lower target utilization still depends on provisioned capacity and the delay of auto scaling, so it does not remove planning or fully prevent throttling.
Question 17SDLC Automation
A software vendor runs unit tests in CodeBuild that produce JUnit XML files. Developers currently read raw build logs to find failing tests. The team wants pass and fail trends for each test to appear in the CodeBuild console. Which solution BEST meets this requirement with the least effort?
Correct answer: C. Add a reports section to the buildspec that points to the JUnit XML files.
The buildspec reports section tells CodeBuild to create a report group and display test results and trends in the console. JUnit XML is a supported format, so no extra tooling is needed. QuickSight or custom metrics add work and do not give per-test reporting in CodeBuild.
The buildspec reports section tells CodeBuild to create a report group and display test results and trends in the console. JUnit XML is a supported format, so no extra tooling is needed. QuickSight or custom metrics add work and do not give per-test reporting in CodeBuild.
Question 18Incident & Event Response
A company deploys an application to Amazon EC2 with AWS CodeDeploy in-place deployments. A previous revision shipped a broken ApplicationStop script, so every new deployment now fails at the ApplicationStop event on all instances. The team has a fixed revision ready and wants to deploy it without logging in to the instances. Which solution BEST meets these requirements?
Correct answer: A. Redeploy the fixed revision with the option to ignore ApplicationStop failures turned on for that deployment.
The ApplicationStop event runs the script from the previously deployed revision, so the new revision cannot fix it, but the deployment can be told to ignore ApplicationStop failures. Removing the hook from the new AppSpec file does not help because CodeDeploy still runs the old revision's broken script.
The ApplicationStop event runs the script from the previously deployed revision, so the new revision cannot fix it, but the deployment can be told to ignore ApplicationStop failures. Removing the hook from the new AppSpec file does not help because CodeDeploy still runs the old revision's broken script.
Question 19SDLC Automation
A travel company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. Deployments must not reduce capacity during the rollout, and the old instances must stay available for a short time for quick rollback. Which deployment approach BEST meets these requirements?
Correct answer: D. Use a CodeDeploy blue/green deployment that copies the Auto Scaling group and keeps the original instances for a wait period before termination.
A blue/green deployment launches a full replacement fleet, shifts traffic at the load balancer, and keeps the original instances for a configurable time for rollback. In-place deployments take instances out of service while they update, which reduces capacity. An instance refresh at 50 percent also reduces capacity and has no quick rollback to the old fleet.
A blue/green deployment launches a full replacement fleet, shifts traffic at the load balancer, and keeps the original instances for a configurable time for rollback. In-place deployments take instances out of service while they update, which reduces capacity. An instance refresh at 50 percent also reduces capacity and has no quick rollback to the old fleet.
Question 20Resilient Solutions
A news website uses an Aurora MySQL DB cluster with one writer and one Aurora Replica. During breaking news, read traffic rises sharply and the replica's CPU reaches 95 percent, while write traffic barely changes. The company wants read capacity to grow and shrink automatically with minimal application changes. Which solution BEST meets these requirements?
Correct answer: A. Use Aurora Auto Scaling for replicas based on CPU and send reads to the reader endpoint.
Aurora Auto Scaling adds and removes Aurora Replicas based on a metric such as CPU, and the reader endpoint balances connections across them with no code change. A larger writer is a fixed cost that does not scale down and puts read load on the instance that handles writes.
Aurora Auto Scaling adds and removes Aurora Replicas based on a metric such as CPU, and the reader endpoint balances connections across them with no code change. A larger writer is a fixed cost that does not scale down and puts read load on the instance that handles writes.
Question 21Incident & Event Response
A fintech company runs a service on Amazon ECS with AWS Fargate and rolling updates. Last week a bad image caused new tasks to fail health checks, and the deployment kept launching replacement tasks for hours. The team wants failing deployments detected and returned to the last working version automatically, with minimal setup. Which solution BEST meets these requirements?
Correct answer: C. Enable the ECS deployment circuit breaker with the rollback option on the service.
The deployment circuit breaker stops a rolling deployment that cannot reach a steady state and, with rollback enabled, returns the service to the last completed deployment. Blue/green with a custom hook can also roll back, but it requires much more setup and custom code.
The deployment circuit breaker stops a rolling deployment that cannot reach a steady state and, with rollback enabled, returns the service to the last completed deployment. Blue/green with a custom hook can also roll back, but it requires much more setup and custom code.
Question 22SDLC Automation
A gaming company deploys an AWS Lambda function with AWS SAM and CodeDeploy. The team wants 10 percent of traffic to go to the new version for 5 minutes, then the rest. If the function error rate rises during the deployment, traffic must return to the old version without human action. Which configuration BEST meets these requirements?
Correct answer: D. Use the Canary10Percent5Minutes deployment preference and configure a CloudWatch alarm on errors with automatic rollback.
Canary10Percent5Minutes shifts 10 percent of traffic, waits 5 minutes, and then shifts the rest. Associating a CloudWatch alarm with the deployment lets CodeDeploy roll back automatically when the alarm fires. The linear option shifts traffic in ten steps, which does not match the required pattern.
Canary10Percent5Minutes shifts 10 percent of traffic, waits 5 minutes, and then shifts the rest. Associating a CloudWatch alarm with the deployment lets CodeDeploy roll back automatically when the alarm fires. The linear option shifts traffic in ten steps, which does not match the required pattern.
Question 23Resilient Solutions
A ticketing company's order API sends requests directly to a licensed backend system that can process 500 orders per second and cannot be scaled out. During on-sale events, requests spike to 5,000 per second for a few minutes, and the backend drops orders. Every order must be processed eventually, and a short delay is acceptable. Which solution BEST meets these requirements?
Correct answer: D. Place an SQS queue between the API and the backend, and have workers poll at a steady rate.
An SQS queue stores the burst of orders durably and lets workers feed the backend at the rate it can handle, so no orders are lost. Throttling at API Gateway protects the backend but rejects orders, which breaks the requirement that every order is processed.
An SQS queue stores the burst of orders durably and lets workers feed the backend at the rate it can handle, so no orders are lost. Throttling at API Gateway protects the backend but rejects orders, which breaks the requirement that every order is processed.
Question 24SDLC Automation
A streaming company runs an Amazon ECS service on AWS Fargate and uses CodeDeploy blue/green deployments with an Application Load Balancer. Before production traffic shifts, the team wants automated smoke tests to run against the new task set. A failed test must stop the deployment. Which solution BEST meets these requirements?
Correct answer: B. Configure a test listener and use a Lambda function in the AfterAllowTestTraffic hook to run the tests and report the result.
In ECS blue/green deployments, the test listener sends traffic to the replacement task set, and the AfterAllowTestTraffic hook runs before production traffic shifts. If the hook Lambda reports failure, CodeDeploy stops and rolls back. A CodeBuild action after the stage runs too late because production traffic has already moved.
In ECS blue/green deployments, the test listener sends traffic to the replacement task set, and the AfterAllowTestTraffic hook runs before production traffic shifts. If the hook Lambda reports failure, CodeDeploy stops and rolls back. A CodeBuild action after the stage runs too late because production traffic has already moved.
Question 25Incident & Event Response
A SaaS company wants a standard response whenever the error-rate alarm for its checkout API goes into ALARM. The response must open an incident, page the on-call engineer through an escalation plan, start a chat channel, and run an SSM Automation runbook that gathers diagnostics. The company prefers a managed AWS solution. Which solution BEST meets these requirements?
Correct answer: C. Create an Incident Manager response plan with an escalation plan, a chat channel, and a runbook, and start it from the alarm.
An Incident Manager response plan brings together engagement of contacts through escalation plans, a chat channel, and an Automation runbook, and an alarm can start it. An OpsItem with email has no escalation plan or chat channel, and a custom Lambda function is not a managed solution.
An Incident Manager response plan brings together engagement of contacts through escalation plans, a chat channel, and an Automation runbook, and an alarm can start it. An OpsItem with email has no escalation plan or chat channel, and a custom Lambda function is not a managed solution.
Question 26Resilient Solutions
A retail company runs a Java Lambda function behind API Gateway. Every weekday at 9 AM traffic rises sharply, and users see multi-second latency from cold starts during the first several minutes. The company wants consistent low latency during business hours while keeping costs low outside those hours. Which solution BEST meets these requirements?
Correct answer: D. Use scheduled Application Auto Scaling actions to set provisioned concurrency on an alias before 9 AM.
Provisioned concurrency keeps initialized execution environments ready, and scheduled scaling raises it before the morning peak and lowers it after hours to control cost. Reserved concurrency only guarantees and caps capacity, and it does not pre-initialize any environments.
Provisioned concurrency keeps initialized execution environments ready, and scheduled scaling raises it before the morning peak and lowers it after hours to control cost. Reserved concurrency only guarantees and caps capacity, and it does not pre-initialize any environments.
Question 27SDLC Automation
A bank runs an application on 20 EC2 instances and deploys with CodeDeploy in-place deployments. At least 15 instances must remain healthy at all times. The team also wants each deployment to finish as quickly as possible. Which deployment configuration BEST meets these requirements?
Correct answer: C. Create a custom deployment configuration with minimum healthy hosts set to 75 percent.
A custom configuration with 75 percent minimum healthy hosts keeps 15 of 20 instances serving while updating 5 at a time. OneAtATime meets the health rule but is much slower. HalfAtATime and AllAtOnce allow more than 5 instances to be out of service.
A custom configuration with 75 percent minimum healthy hosts keeps 15 of 20 instances serving while updating 5 at a time. OneAtATime meets the health rule but is much slower. HalfAtATime and AllAtOnce allow more than 5 instances to be out of service.
Question 28Incident & Event Response
A company often receives AWS Health scheduled events about upcoming EC2 instance retirement for its EBS-backed instances. The operations team wants each affected instance stopped and started automatically as soon as the event arrives, so it moves to healthy hardware. The team wants the least custom code. Which solution BEST meets these requirements?
Correct answer: B. Create an EventBridge rule for aws.health EC2 retirement events that targets the AWS-RestartEC2Instance Automation runbook.
AWS Health sends events to EventBridge, and a rule can pass the instance ID to an AWS managed Automation runbook that stops and starts the instance with no custom code. A recover action only reacts after a system status check fails, so it does not act on the scheduled event in advance.
AWS Health sends events to EventBridge, and a rule can pass the instance ID to an AWS managed Automation runbook that stops and starts the instance with no custom code. A recover action only reacts after a system status check fails, so it does not act on the scheduled event in advance.
Question 29SDLC Automation
An e-commerce company builds Node.js services in many accounts. Developers pull packages directly from the public npm registry, and an outage of that registry recently blocked all builds. The company wants a private cache of public packages with minimal maintenance. Which solution BEST meets these requirements?
Correct answer: C. Create a CodeArtifact repository with an external connection to public npm and use it as an upstream for the team repositories.
CodeArtifact external connections fetch packages from public npm on demand and retain copies, so builds keep working when the public registry is down. Using it as an upstream lets team repositories share the cache. Nightly mirrors and self-managed proxies add significant maintenance.
CodeArtifact external connections fetch packages from public npm on demand and retain copies, so builds keep working when the public registry is down. Using it as an upstream lets team repositories share the cache. Nightly mirrors and self-managed proxies add significant maintenance.
Question 30Resilient Solutions
A payments company runs an Aurora PostgreSQL database in eu-west-1. A new DR policy requires an RPO of about 1 second and an RTO of a few minutes if the primary Region fails. The secondary Region must also serve low-latency reads to local users during normal operations. Which solution BEST meets these requirements?
Correct answer: A. Create an Aurora Global Database with a secondary cluster in another Region and fail over to it.
Aurora Global Database replicates with typical lag under a second, serves reads in the secondary Region, and can be failed over in minutes. Hourly cross-Region snapshots give an RPO of up to an hour and a much longer restore time.
Aurora Global Database replicates with typical lag under a second, serves reads in the secondary Region, and can be failed over in minutes. Hourly cross-Region snapshots give an RPO of up to an hour and a much longer restore time.
Question 31Incident & Event Response
An ecommerce company runs an order API on Amazon API Gateway that invokes several Lambda functions, which call Amazon DynamoDB and a third-party payment service. Customers report slow checkouts, but the average Duration metrics for most functions look normal. The team must find which downstream call adds the latency with the least effort. Which solution BEST meets these requirements?
Correct answer: B. Enable X-Ray active tracing on the API stage and the functions, then review the trace map and segment timings.
X-Ray traces show each downstream call as a subsegment with its own timing, so the slow dependency stands out on the trace map. A dashboard of average Duration metrics hides slow individual requests and does not show which downstream call is slow.
X-Ray traces show each downstream call as a subsegment with its own timing, so the slow dependency stands out on the trace map. A dashboard of average Duration metrics hides slow individual requests and does not show which downstream call is slow.
Question 32SDLC Automation
A data company pushes container images to Amazon ECR on every commit, and storage costs are growing. Untagged images should be removed after 14 days. Images tagged with the prefix release- must be kept, but only the 30 most recent. Which solution BEST meets these requirements?
Correct answer: A. Create an ECR lifecycle policy that expires untagged images after 14 days and keeps the 30 newest release- images.
ECR lifecycle policies support rules based on tag status, tag prefix, image age and image count. Two rules cover both requirements with no custom code. ECR manages its own storage, so S3 Lifecycle rules cannot be applied to it.
ECR lifecycle policies support rules based on tag status, tag prefix, image age and image count. Two rules cover both requirements with no custom code. ECR manages its own storage, so S3 Lifecycle rules cannot be applied to it.
Question 33Resilient Solutions
A healthcare company uses AWS Organizations. Its compliance team requires that EBS and RDS backups from all workload accounts be copied to a separate backup account in a second Region, so backups survive a compromised workload account or a Regional outage. The solution must be centrally managed with the least operational overhead. Which solution BEST meets these requirements?
Correct answer: C. Use Organizations backup policies with a copy rule to a vault in the backup account's second Region.
Organization backup policies apply backup plans to every member account centrally, and a cross-account, cross-Region copy rule places copies in an isolated backup account. Copying to another Region in the same account protects against a Regional outage but not against a compromised workload account.
Organization backup policies apply backup plans to every member account centrally, and a cross-account, cross-Region copy rule places copies in an isolated backup account. Copying to another Region in the same account protects against a Regional outage but not against a compromised workload account.
Question 34SDLC Automation
A SaaS company builds container images in us-east-1 and runs Amazon ECS services in us-east-1 and eu-west-1. Tasks in eu-west-1 pull images across Regions, which slows scaling. The company wants images available in both Regions automatically after each push. Which solution BEST meets this requirement with the least operational overhead?
Correct answer: D. Configure ECR private registry replication with a cross-Region rule to eu-west-1.
ECR registry replication copies images to other Regions automatically after each push, with optional repository filters. A pipeline stage that re-pushes images works but adds steps to maintain. ECR storage is not exposed as an S3 bucket, so S3 replication is not possible.
ECR registry replication copies images to other Regions automatically after each push, with optional repository filters. A pipeline stage that re-pushes images works but adds steps to maintain. ECR storage is not exposed as an S3 bucket, so S3 replication is not possible.
Question 35Security & Compliance
A DevOps team gave an AWS CodeBuild service role the AdministratorAccess policy to get a new pipeline working quickly. The pipeline has now run in production for 30 days without changes. The security team wants the role reduced to only the actions the pipeline actually uses, with the least manual analysis. Which solution BEST meets these requirements?
Correct answer: D. Use IAM Access Analyzer to generate a policy from the role's CloudTrail activity, then replace the admin policy with it.
IAM Access Analyzer policy generation reviews CloudTrail logs for the role and builds a policy based on the actions it actually used. PowerUserAccess is still far broader than the pipeline needs, so it does not meet least privilege.
IAM Access Analyzer policy generation reviews CloudTrail logs for the role and builds a policy based on the actions it actually used. PowerUserAccess is still far broader than the pipeline needs, so it does not meet least privilege.
Question 36Resilient Solutions
A manufacturing company runs 40 on-premises Windows and Linux servers that host a legacy ERP system. It needs a DR site on AWS with an RPO measured in seconds and an RTO measured in minutes. Standby costs must stay low, and the application cannot be changed. Which solution BEST meets these requirements?
Correct answer: A. Use AWS Elastic Disaster Recovery to replicate the servers and launch recovery instances on failover.
Elastic Disaster Recovery continuously replicates block data to a low-cost staging area, which gives an RPO of seconds and launches recovery instances in minutes. Nightly backups give an RPO of up to a day, which does not meet the requirement.
Elastic Disaster Recovery continuously replicates block data to a low-cost staging area, which gives an RPO of seconds and launches recovery instances in minutes. Nightly backups give an RPO of up to a day, which does not meet the requirement.
Question 37SDLC Automation
A fintech company deploys ECS services by referencing the latest tag in task definitions. A recent incident occurred because the latest tag was overwritten while a deployment was in progress, so two task sets ran different code. The company needs every deployment to be traceable to a single commit. Which solution BEST meets this requirement?
Correct answer: B. Tag each image with the Git commit ID, reference that tag in task definitions, and enable tag immutability.
Tagging images with the commit ID ties each image to exact source code, and tag immutability prevents a tag from being overwritten. Task definitions that reference that tag always run the same image. Logging PutImage calls records changes but does not stop the tag from moving.
Tagging images with the commit ID ties each image to exact source code, and tag immutability prevents a tag from being overwritten. Task definitions that reference that tag always run the same image. Logging PutImage calls records changes but does not stop the tag from moving.
Question 38Security & Compliance
Developers at Quillon Software submit IAM policy changes through a CloudFormation pipeline. Security wants the pipeline to automatically block any change that grants new public or cross-account access compared with the current policy, without writing custom parsing code. What should the DevOps engineer add?
Correct answer: D. An IAM Access Analyzer custom policy check such as check-no-new-access in a CodeBuild stage
Access Analyzer custom policy checks compare a proposed policy with a reference and fail when new access is granted, so the pipeline blocks the change before deployment. A Config rule only detects the problem after the change is already live.
Access Analyzer custom policy checks compare a proposed policy with a reference and fail when new access is granted, so the pipeline blocks the change before deployment. A Config rule only detects the problem after the change is already live.
Question 39SDLC Automation
A healthcare company stores application images in Amazon ECR. Security requires scanning of both operating system and programming language packages. Images that are already stored must be rescanned when new vulnerabilities are published, and findings must alert the security team. Which solution BEST meets these requirements?
Correct answer: C. Enable Amazon Inspector enhanced scanning with continuous scanning and route findings to the team through EventBridge.
Amazon Inspector enhanced scanning covers OS and language packages and continuously rescans images when new CVEs are published. Findings are sent to EventBridge, where a rule can notify the security team. Basic scanning only scans at push or on demand, and a CodeBuild scanner never rescans stored images.
Amazon Inspector enhanced scanning covers OS and language packages and continuously rescans images when new CVEs are published. Findings are sent to EventBridge, where a rule can notify the security team. Basic scanning only scans at push or on demand, and a CodeBuild scanner never rescans stored images.
Question 40Monitoring & Logging
An operations team manages 300 EC2 Linux instances across several accounts. They need memory utilization and disk space metrics in CloudWatch to drive alarms, but these metrics do not appear in the default EC2 namespace. The team wants one consistent configuration with minimal manual work. Which solution BEST meets these requirements?
Correct answer: B. Install the CloudWatch agent with Systems Manager using a shared configuration in Parameter Store.
Memory and disk usage are visible only inside the guest OS, so the CloudWatch agent must collect them, and Systems Manager can install it with one shared configuration from Parameter Store. Detailed monitoring only raises the frequency of the standard hypervisor metrics and adds no memory or disk space metrics.
Memory and disk usage are visible only inside the guest OS, so the CloudWatch agent must collect them, and Systems Manager can install it with one shared configuration from Parameter Store. Detailed monitoring only raises the frequency of the standard hypervisor metrics and adds no memory or disk space metrics.
Question 41Security & Compliance
A company lets developers create IAM roles for their Lambda functions so they do not have to wait for the platform team. Security requires that no role a developer creates can ever have more than a defined set of permissions, even if the developer attaches a broad policy to it. Which solution BEST meets these requirements?
Correct answer: C. Allow iam:CreateRole only with an iam:PermissionsBoundary condition that requires the approved boundary policy.
Requiring the iam:PermissionsBoundary condition means every role a developer creates must carry the approved boundary, which caps its effective permissions. A boundary on the developer's own role does not carry over to the roles that developer creates.
Requiring the iam:PermissionsBoundary condition means every role a developer creates must carry the approved boundary, which caps its effective permissions. A boundary on the developer's own role does not carry over to the roles that developer creates.
Question 42SDLC Automation
A retail company has a pipeline that runs a 40 minute load test first, then integration tests, then unit tests. Developers wait almost an hour to learn about simple coding errors. The company wants faster feedback while still running every test type before production. Which pipeline design BEST meets this requirement?
Correct answer: A. Run unit tests in the build stage, integration tests after a staging deploy, and load tests in a pre-production stage.
Fast, cheap tests should run first so that common errors fail the pipeline within minutes. Slower integration and load tests then run in their own environments before production. Running tests after the production deployment or in production exposes users to defects.
Fast, cheap tests should run first so that common errors fail the pipeline within minutes. Slower integration and load tests then run in their own environments before production. Running tests after the production deployment or in production exposes users to defects.
Question 43Monitoring & Logging
A delivery company runs Lambda functions that publish custom business metrics, such as orders per restaurant, with dimensions for city and restaurant. Calling PutMetricData inside the function adds latency and has caused throttling at peak times. The company wants to publish these metrics asynchronously and keep the detailed records searchable in logs. Which solution BEST meets these requirements?
Correct answer: B. Write the metrics to standard output using the CloudWatch embedded metric format.
With embedded metric format, the function writes structured JSON to its logs and CloudWatch extracts the metrics asynchronously, while the full records stay searchable in CloudWatch Logs. Batching PutMetricData still makes synchronous API calls and does not keep the detailed records in logs.
With embedded metric format, the function writes structured JSON to its logs and CloudWatch extracts the metrics asynchronously, while the full records stay searchable in CloudWatch Logs. Batching PutMetricData still makes synchronous API calls and does not keep the detailed records in logs.
Question 44Config Management & IaC
A company uses AWS Organizations and must deploy a CloudTrail and AWS Config baseline to every account in a Security OU. New accounts added to that OU must receive the baseline without manual steps. The team does not want to create IAM roles in each account. Which solution BEST meets these requirements?
Correct answer: A. Use CloudFormation StackSets with service-managed permissions targeting the OU and enable automatic deployment.
Service-managed StackSets use Organizations to create the needed roles and can target an OU. With automatic deployment enabled, accounts that join the OU get the stack instances automatically. Self-managed permissions require IAM roles in each account and manual targeting.
Service-managed StackSets use Organizations to create the needed roles and can target an OU. With automatic deployment enabled, accounts that join the OU get the stack instances automatically. Self-managed permissions require IAM roles in each account and manual targeting.
Question 45Security & Compliance
A company has 45 AWS accounts in AWS Organizations and uses Okta as its corporate identity provider. Engineers currently have separate IAM users in each account. The company wants single sign-on, automatic user provisioning and removal when staff join or leave, and central access assignment per account. Which solution BEST meets these requirements?
Correct answer: C. Connect IAM Identity Center to Okta with SAML and SCIM, then assign permission sets to groups in each account.
IAM Identity Center federates with Okta for sign-in, uses SCIM to provision and remove users automatically, and assigns permission sets to accounts centrally. Per-account SAML providers work for sign-in but must be maintained in all 45 accounts and do not provision users centrally.
IAM Identity Center federates with Okta for sign-in, uses SCIM to provision and remove users automatically, and assigns permission sets to accounts centrally. Per-account SAML providers work for sign-in but must be maintained in all 45 accounts and do not provision users centrally.
Question 46Monitoring & Logging
A SaaS company has separate CloudWatch alarms for high API latency, high 5XX error rate, and low healthy host count. During incidents all three fire and the on-call engineer gets three pages for the same problem, while a latency spike alone is often harmless. The company wants one page only when latency is high and either errors are high or healthy hosts are low. Which solution BEST meets these requirements?
Correct answer: B. Create a composite alarm with the rule latency AND (errors OR hosts) and notify only from it.
A composite alarm combines existing alarm states with AND and OR logic, so it pages once only for the exact condition, and the child alarms can have their actions turned off. Adding unrelated metrics with metric math produces a meaningless sum and cannot express the required logic.
A composite alarm combines existing alarm states with AND and OR logic, so it pages once only for the exact condition, and the child alarms can have their actions turned off. Adding unrelated metrics with metric math produces a meaningless sum and cannot express the required logic.
Question 47Config Management & IaC
A DevOps engineer needs to change the engine version and storage type of a production Amazon RDS instance defined in CloudFormation. The team must know before the update whether CloudFormation will replace the database. No changes can be applied during the review. Which approach BEST meets this requirement?
Correct answer: D. Create a change set for the stack and review the Replacement field for the database resource.
A change set previews the update and shows whether each resource will be modified or replaced, without making changes. Drift detection compares live resources with the current template, not with proposed changes. ValidateTemplate only checks syntax.
A change set previews the update and shows whether each resource will be modified or replaced, without making changes. Drift detection compares live resources with the current template, not with proposed changes. ValidateTemplate only checks syntax.
Question 48Security & Compliance
A company's application on Amazon ECS connects to an Amazon RDS for PostgreSQL database. The database password is stored as a plaintext environment variable in the task definition. Auditors require the password to rotate every 30 days, and the team does not want to write or maintain rotation code. Which solution BEST meets these requirements?
Correct answer: A. Store the credential in Secrets Manager with a 30-day schedule using an AWS provided rotation function, and read it at runtime.
Secrets Manager rotates RDS credentials on a schedule using rotation functions that AWS provides, so the team writes no rotation code. Parameter Store SecureString parameters are encrypted but have no built-in rotation feature.
Secrets Manager rotates RDS credentials on a schedule using rotation functions that AWS provides, so the team writes no rotation code. Parameter Store SecureString parameters are encrypted but have no built-in rotation feature.
Question 49Config Management & IaC
A company defines an Amazon RDS instance in CloudFormation. Data must be preserved if the resource is deleted from the template. It must also be preserved if an update forces CloudFormation to replace the database with a new physical resource. Which template configuration BEST meets these requirements?
Correct answer: B. Set DeletionPolicy to Snapshot and UpdateReplacePolicy to Snapshot on the database resource.
DeletionPolicy controls what happens when a resource is removed, and UpdateReplacePolicy controls what happens to the old resource during replacement. Setting both to Snapshot keeps a backup in both cases. A stack policy blocks replacement but does not preserve data if the resource is deleted.
DeletionPolicy controls what happens when a resource is removed, and UpdateReplacePolicy controls what happens to the old resource during replacement. Setting both to Snapshot keeps a backup in both cases. A stack policy blocks replacement but does not preserve data if the resource is deleted.
Question 50Monitoring & Logging
A company with 50 AWS accounts in AWS Organizations must send application logs from CloudWatch Logs in every account to one S3 bucket in a central log archive account. Logs must arrive in near real time, and workload account teams must not be able to delete the archived copies. Which solution BEST meets these requirements?
Correct answer: D. Create a Logs destination backed by Firehose in the log account and add subscription filters in each account.
Subscription filters stream log events in near real time to a cross-account CloudWatch Logs destination, and Firehose delivers them to a bucket that only the log archive account controls. Daily export tasks are batch jobs, so they do not meet the near real-time requirement.
Subscription filters stream log events in near real time to a cross-account CloudWatch Logs destination, and Firehose delivers them to a bucket that only the log archive account controls. Daily export tasks are batch jobs, so they do not meet the near real-time requirement.
Question 51Security & Compliance
A team's buildspec file contains a hard-coded API token for a third-party package repository. Security wants the token removed from source control, encrypted at rest, and available to the build only at run time. The team wants the smallest change to the build process. Which solution BEST meets these requirements?
Correct answer: D. Store the token in Secrets Manager, reference it in the buildspec env secrets-manager section, and grant the build role access.
The buildspec secrets-manager section injects the secret as an environment variable at build time, and Secrets Manager encrypts it at rest. A plaintext project environment variable is not encrypted as a secret and is visible to anyone who can view the project.
The buildspec secrets-manager section injects the secret as an environment variable at build time, and Secrets Manager encrypts it at rest. A plaintext project environment variable is not encrypted as a secret and is visible to anyone who can view the project.
Question 52Config Management & IaC
A company launches EC2 instances with CloudFormation and installs packages and configuration files at boot. The stack sometimes reports CREATE_COMPLETE before the application is ready, and some instances finish with broken configuration. The stack should succeed only after the configuration succeeds. Which solution BEST meets this requirement?
Correct answer: A. Define the configuration in AWS::CloudFormation::Init metadata, run cfn-init, then call cfn-signal, and add a CreationPolicy.
cfn-init applies the metadata configuration and cfn-signal reports its exit status. A CreationPolicy makes CloudFormation wait for the success signal and fail the resource if the signal is a failure or times out. DependsOn only controls creation order and does not wait for software setup.
cfn-init applies the metadata configuration and cfn-signal reports its exit status. A CreationPolicy makes CloudFormation wait for the success signal and fail the resource if the signal is a failure or times out. DependsOn only controls creation order and does not wait for software setup.
Question 53Monitoring & Logging
A web application writes JSON log events to CloudWatch Logs with fields named clientIp and status. During an incident, an engineer must quickly find the 10 client IP addresses that caused the most HTTP 500 responses in the past hour, without moving the data elsewhere. Which approach BEST meets this requirement?
Correct answer: C. Run a Logs Insights query: filter status = 500 | stats count(*) as hits by clientIp | sort hits desc | limit 10
CloudWatch Logs Insights queries existing log data in place, and this query filters, groups, sorts, and limits the results in one step. A new metric filter only counts events that arrive after it is created, so it cannot answer a question about the past hour.
CloudWatch Logs Insights queries existing log data in place, and this query filters, groups, sorts, and limits the results in one step. A new metric filter only counts events that arrive after it is created, so it cannot answer a question about the past hour.
Question 54Config Management & IaC
A team manages a production stack that contains an Amazon DynamoDB table and many Lambda functions. Developers update the functions often. The company wants to prevent any stack update from modifying or replacing the table by mistake, while still allowing updates to other resources. Which solution BEST meets this requirement?
Correct answer: A. Apply a stack policy that allows all updates but denies Update:* on the table resource.
A stack policy controls which resources can be updated during stack updates, so denying Update actions on the table protects it while other resources stay updatable. DeletionPolicy only applies when the resource is removed or the stack is deleted. Termination protection only stops stack deletion.
A stack policy controls which resources can be updated during stack updates, so denying Update actions on the table protects it while other resources stay updatable. DeletionPolicy only applies when the resource is removed or the stack is deleted. Termination protection only stops stack deletion.
Question 55Security & Compliance
A company uses Amazon GuardDuty in all accounts with a delegated administrator. When GuardDuty reports that an EC2 instance is communicating with a known command-and-control server, the security team wants the instance cut off from the network within minutes. The instance and its disks must be kept for forensic analysis. Which solution BEST meets these requirements?
Correct answer: B. Use an EventBridge rule on that finding type to invoke a Lambda function that moves the instance to an isolation security group.
GuardDuty findings arrive in EventBridge, and a Lambda function can replace the instance's security groups with one that allows no traffic, which isolates it while keeping it intact. Terminating the instance stops the threat but destroys the evidence the team must keep.
GuardDuty findings arrive in EventBridge, and a Lambda function can replace the instance's security groups with one that allows no traffic, which isolates it while keeping it intact. Terminating the instance stops the threat but destroys the evidence the team must keep.
Question 56Monitoring & Logging
Application logs at Brightfield Health sometimes contain patient email addresses and phone numbers, which must not be visible to most engineers who use CloudWatch Logs Insights. The team cannot change the application code this quarter. What should the DevOps engineer configure?
Correct answer: B. A CloudWatch Logs data protection policy that masks the sensitive data
CloudWatch Logs data protection policies detect and mask sensitive data such as emails and phone numbers, and only principals with the unmask permission can see the original values. Denying FilterLogEvents for everyone removes the logs' usefulness entirely.
CloudWatch Logs data protection policies detect and mask sensitive data such as emails and phone numbers, and only principals with the unmask permission can see the original values. Denying FilterLogEvents for everyone removes the logs' usefulness entirely.
Question 57Config Management & IaC
A company uses the AWS CDK in a central tooling account to deploy stacks into three workload accounts through a pipeline. Deployments to the workload accounts fail because the required staging bucket and deployment roles do not exist there. Which action BEST fixes the problem?
Correct answer: C. Bootstrap each workload account with the --trust option set to the tooling account ID.
Every target account and Region must be bootstrapped, and the --trust option lets the tooling account assume the deployment roles that bootstrap creates. Bootstrapping only the tooling account leaves the workload accounts without assets storage or roles. Granting administrator access does not create the bootstrap resources.
Every target account and Region must be bootstrapped, and the --trust option lets the tooling account assume the deployment roles that bootstrap creates. Bootstrapping only the tooling account leaves the workload accounts without assets storage or roles. Granting administrator access does not create the bootstrap resources.
Question 58Security & Compliance
A company aggregates AWS Security Hub findings from 60 accounts into a delegated administrator account. Findings for one control are expected in sandbox accounts and create noise for analysts. The company still wants these findings recorded for audits, but marked as suppressed automatically when they arrive, without writing code. Which solution BEST meets these requirements?
Correct answer: B. Create a Security Hub automation rule that matches the control and sandbox account IDs and sets the workflow status to SUPPRESSED.
Security Hub automation rules update finding fields such as workflow status as findings are created or updated, with no code. An EventBridge rule with Lambda can do the same, but it requires custom code, and disabling Security Hub would remove the audit record.
Security Hub automation rules update finding fields such as workflow status as findings are created or updated, with no code. An EventBridge rule with Lambda can do the same, but it requires custom code, and disabling Security Hub would remove the audit record.
Question 59Config Management & IaC
A company manages 800 Amazon Linux and Windows EC2 instances. Security patches must be approved automatically 7 days after release and installed during a weekly window on Sunday nights. Compliance reports must show which instances are missing patches. Which solution BEST meets these requirements?
Correct answer: D. Use Patch Manager baselines that auto-approve patches after 7 days and a Sunday maintenance window running AWS-RunPatchBaseline.
Patch Manager baselines support auto-approval delays, and maintenance windows run AWS-RunPatchBaseline on a schedule. Patch Manager also reports patch compliance per instance. Plain Run Command updates install everything without approval rules or compliance reporting.
Patch Manager baselines support auto-approval delays, and maintenance windows run AWS-RunPatchBaseline on a schedule. Patch Manager also reports patch compliance per instance. Plain Run Command updates install everything without approval rules or compliance reporting.
Question 60Monitoring & Logging
A company runs 40 microservices on an Amazon ECS cluster with the Fargate launch type. The operations team needs CPU, memory, network, and storage metrics at the cluster, service, and task level, along with prebuilt dashboards. The setup effort must be minimal. Which solution BEST meets these requirements?
Correct answer: A. Enable CloudWatch Container Insights on the ECS cluster.
Container Insights collects cluster, service, and task metrics for ECS on Fargate and provides prebuilt dashboards with a single setting. Fargate does not give access to the underlying hosts, so installing an agent on each host is not possible.
Container Insights collects cluster, service, and task metrics for ECS on Fargate and provides prebuilt dashboards with a single setting. Fargate does not give access to the underlying hosts, so installing an agent on each host is not possible.
Question 61Security & Compliance
An organization with 200 accounts found that a developer in a member account stopped CloudTrail logging to hide test activity. Security wants to make it impossible for anyone in member accounts to stop, delete or modify the organization trail. What should the DevOps engineer do?
Correct answer: C. Attach an SCP that denies cloudtrail:StopLogging, DeleteTrail and UpdateTrail
An SCP denying those CloudTrail actions prevents any principal in member accounts, including administrators, from tampering with logging. Log file validation and alarms detect problems after the fact but do not stop the action.
An SCP denying those CloudTrail actions prevents any principal in member accounts, including administrators, from tampering with logging. Log file validation and alarms detect problems after the fact but do not stop the action.
Question 62Config Management & IaC
A company stores application settings in Systems Manager Parameter Store under paths such as /prod/payments/ and /dev/payments/. The payments service must load all of its settings for one environment in a single call. Its production role must not read any parameters outside /prod/payments/. Which solution BEST meets these requirements?
Correct answer: A. Call GetParametersByPath on /prod/payments/ and restrict the role with an IAM policy scoped to that path ARN.
GetParametersByPath returns every parameter under a hierarchy in one call, with paging. IAM policies can scope ssm:GetParametersByPath and related actions to a specific path ARN. A single large parameter is hard to maintain and does not use the hierarchy.
GetParametersByPath returns every parameter under a hierarchy in one call, with paging. IAM policies can scope ssm:GetParametersByPath and related actions to a specific path ARN. A single large parameter is hard to maintain and does not use the hierarchy.
Question 63Monitoring & Logging
An online bank wants to detect problems with its login and account summary pages before customers report them. A check must run every 5 minutes from outside the application, step through the login flow in a headless browser, capture screenshots, and raise an alarm on failure. Which solution BEST meets these requirements?
Correct answer: D. Create a CloudWatch Synthetics canary with a browser script and alarm on its success metric.
Synthetics canaries run scripted headless browser steps on a schedule, capture screenshots, and publish success metrics that alarms can use. CloudWatch RUM depends on real user sessions, so it cannot detect a failure before customers are affected.
Synthetics canaries run scripted headless browser steps on a schedule, capture screenshots, and publish success metrics that alarms can use. CloudWatch RUM depends on real user sessions, so it cannot detect a failure before customers are affected.
Question 64Security & Compliance
A company must keep all workloads in its organization in us-east-1 and us-west-2 for data residency reasons. Global services such as IAM, AWS Organizations, and Amazon CloudFront must keep working. Account administrators must not be able to bypass the control. Which solution BEST meets these requirements?
Correct answer: A. Attach an SCP that denies requests where aws:RequestedRegion is outside the two Regions, with global services exempted.
An SCP applies to all principals in member accounts, including administrators, and exempting global services keeps IAM, Organizations, and CloudFront working. An SCP with no exceptions would block global services, whose requests are made through us-east-1 or are not tied to an allowed Region.
An SCP applies to all principals in member accounts, including administrators, and exempting global services keeps IAM, Organizations, and CloudFront working. An SCP with no exceptions would block global services, whose requests are made through us-east-1 or are not tied to an allowed Region.
Question 65Config Management & IaC
A company wants developers to launch approved Amazon EMR clusters on demand. Developers must not have direct IAM permissions to create EMR, EC2 or IAM resources. Central IT wants to own and version the templates. Which solution BEST meets these requirements?
Correct answer: C. Create a Service Catalog EMR product in a portfolio with a launch constraint that specifies a provisioning role.
Service Catalog products give governed self-service, and a launch constraint lets the product launch with a specified role instead of the user's permissions. Central IT can manage product versions in the portfolio. Sharing templates still requires developers to hold the underlying permissions.
Service Catalog products give governed self-service, and a launch constraint lets the product launch with a specified role instead of the user's permissions. Central IT can manage product versions in the portfolio. Sharing templates still requires developers to hold the underlying permissions.
Question 66Config Management & IaC
A company uses AWS Control Tower to create new accounts. Every new account must start with a standard VPC and a set of IAM roles defined in CloudFormation. The platform team wants these resources applied as part of the Account Factory vending process from the Control Tower console. Which solution BEST meets this requirement?
Correct answer: D. Use Account Factory Customization with a blueprint stored as a Service Catalog product in a hub account.
Account Factory Customization applies a blueprint, defined as a Service Catalog product in a hub account, when accounts are created or updated through Account Factory. This provisions the VPC and roles during vending. Controls and SCPs restrict or detect actions but cannot create resources.
Account Factory Customization applies a blueprint, defined as a Service Catalog product in a hub account, when accounts are created or updated through Account Factory. This provisions the VPC and roles during vending. Controls and SCPs restrict or detect actions but cannot create resources.
Question 67Monitoring & Logging
A company's observability team uses a third-party monitoring platform and needs near-real-time CloudWatch metrics from 50 accounts delivered to it continuously, without polling the CloudWatch API. What should the DevOps engineer set up?
Correct answer: D. CloudWatch metric streams delivering through Amazon Data Firehose
Metric streams push CloudWatch metrics continuously through Firehose to destinations such as third-party platforms, with low latency and no polling. A Lambda poller adds cost, API throttling risk and custom code.
Metric streams push CloudWatch metrics continuously through Firehose to destinations such as third-party platforms, with low latency and no polling. A Lambda poller adds cost, API throttling risk and custom code.
Question 68Security & Compliance
A company with 80 AWS accounts must record management events from every current and future account in all Regions. The logs must be delivered to a central log archive account. Auditors must be able to prove that log files were not changed after AWS delivered them. Which solution BEST meets these requirements?
Correct answer: B. Create a multi-Region organization trail that delivers to the log archive bucket with log file validation turned on.
An organization trail automatically covers all current and future accounts, a multi-Region trail covers every Region, and log file validation uses signed digest files to prove integrity. S3 versioning keeps old object versions but does not provide a cryptographic way to prove files were not changed.
An organization trail automatically covers all current and future accounts, a multi-Region trail covers every Region, and log file validation uses signed digest files to prove integrity. S3 versioning keeps old object versions but does not provide a cryptographic way to prove files were not changed.
Question 69Config Management & IaC
A mobile company wants to turn a new checkout feature on for users gradually without redeploying code. If the error alarm for the checkout service fires during the change, the feature must turn off automatically. Which solution BEST meets these requirements?
Correct answer: C. Store the flag as an AppConfig feature flag and deploy it with a gradual deployment strategy and a CloudWatch alarm monitor.
AppConfig feature flags can roll out gradually with a deployment strategy, and a CloudWatch alarm monitor makes AppConfig roll back the configuration automatically. No code redeploy is needed. Environment variable changes require function updates, and a custom Lambda reset adds code to maintain.
AppConfig feature flags can roll out gradually with a deployment strategy, and a CloudWatch alarm monitor makes AppConfig roll back the configuration automatically. No code redeploy is needed. Environment variable changes require function updates, and a custom Lambda reset adds code to maintain.
Question 70Monitoring & Logging
A food delivery app's order volume follows a strong daily and weekly pattern, peaking at lunch and dinner and dropping overnight. A static threshold alarm on the OrdersPlaced metric either misses real drops at peak hours or fires falsely overnight. The team wants an alarm that adapts to the expected pattern automatically. Which solution BEST meets these requirements?
Correct answer: B. Create a CloudWatch alarm based on an anomaly detection band for the metric.
Anomaly detection learns hourly, daily, and weekly patterns and builds an expected band, so the alarm adapts to peaks and quiet hours. Scheduled static alarms are manual to maintain and break when the pattern shifts.
Anomaly detection learns hourly, daily, and weekly patterns and builds an expected band, so the alarm adapts to peaks and quiet hours. Scheduled static alarms are manual to maintain and break when the pattern shifts.
Question 71Security & Compliance
A platform team wants every CloudFormation template in its pipelines checked against company rules, such as requiring encryption on S3 buckets and blocking security groups that are open to 0.0.0.0/0. Noncompliant templates must stop the pipeline automatically before any resources are created. Which solution BEST meets these requirements?
Correct answer: C. Add a CodeBuild stage that runs cfn-guard with the company rule set against the templates and fails on violations.
cfn-guard evaluates templates against custom policy-as-code rules and returns a failure that stops the pipeline before deployment. cfn-lint checks templates against the CloudFormation resource specification and best practices, not against a company's own security rules by default.
cfn-guard evaluates templates against custom policy-as-code rules and returns a failure that stops the pipeline before deployment. cfn-lint checks templates against the CloudFormation resource specification and best practices, not against a company's own security rules by default.
Question 72Config Management & IaC
A company manages hundreds of CloudFormation stacks across several accounts. Engineers sometimes change resources in the console, which causes failures during later stack updates. The company wants stacks with drift flagged automatically and continuously, with minimal custom code. Which solution BEST meets this requirement?
Correct answer: B. Deploy the AWS Config managed rule cloudformation-stack-drift-detection-check and send noncompliant results to the team.
The cloudformation-stack-drift-detection-check managed rule runs drift detection and marks drifted stacks as noncompliant, so the team gets automatic alerts. Stack policies only apply to updates made through CloudFormation, not console changes. Weekly log searches are manual and slow.
The cloudformation-stack-drift-detection-check managed rule runs drift detection and marks drifted stacks as noncompliant, so the team gets automatic alerts. Stack policies only apply to updates made through CloudFormation, not console changes. Weekly log searches are manual and slow.
Question 73Monitoring & Logging
A company uses AWS Organizations with 30 workload accounts. Its central operations team wants to search logs, view metrics, and examine X-Ray traces from all workload accounts in one monitoring account. The team does not want to copy the data or switch roles between accounts. Which solution BEST meets these requirements?
Correct answer: C. Set up CloudWatch cross-account observability with a monitoring account sink and source links.
CloudWatch cross-account observability links source accounts to a monitoring account sink so their metrics, logs, and traces can be viewed there in place. Assuming roles in each account works but requires switching roles, which the team wants to avoid.
CloudWatch cross-account observability links source accounts to a monitoring account sink so their metrics, logs, and traces can be viewed there in place. Assuming roles in each account works but requires switching roles, which the team wants to avoid.
Question 74Security & Compliance
A data platform writes millions of small objects per day to an S3 bucket that uses SSE-KMS with a customer managed key. AWS KMS request costs have grown sharply. The company must keep encrypting the objects with its own customer managed key. Which solution BEST meets these requirements?
Correct answer: A. Enable S3 Bucket Keys on the bucket so S3 uses a bucket-level key and makes fewer KMS requests.
S3 Bucket Keys let S3 generate data keys from a short-lived bucket-level key, which greatly reduces calls to KMS while still using the customer managed key. Switching to SSE-S3 removes the KMS cost but breaks the requirement to use the company's own key.
S3 Bucket Keys let S3 generate data keys from a short-lived bucket-level key, which greatly reduces calls to KMS while still using the customer managed key. Switching to SSE-S3 removes the KMS cost but breaks the requirement to use the company's own key.
Question 75Config Management & IaC
A company must keep a hardened SSH configuration on all Linux EC2 instances. Administrators sometimes change the setting by hand, and new instances launch often. The company wants the configuration reapplied on a schedule and to new instances automatically. Which solution BEST meets this requirement?
Correct answer: D. Create a Systems Manager State Manager association that targets instances by tag and runs on a schedule.
A State Manager association applies a document to instances that match its targets, including new ones, and reapplies it on a schedule to correct drift. Run Command is a one-time action. UserData runs only at first boot, so later manual changes are never corrected.
A State Manager association applies a document to instances that match its targets, including new ones, and reapplies it on a schedule to correct drift. Run Command is a one-time action. UserData runs only at first boot, so later manual changes are never corrected.
The real AWS DevOps Engineer Professional exam at a glance
75questions
3htime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS Cloud Practitioner Practice Test65 questions · CLF-C02AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Associate Practice Test65 questions · SAA-C03AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS Security Specialty Practice Test65 questions · SCS-C03AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS DevOps Engineer Professional exam. They are not real exam questions. AWS DevOps Engineer Professional and Amazon Web Services are trademarks of their owners. Real exam format: 75 questions (65 scored, 10 unscored) · 180 minutes · passing score 750 on a 100-1000 scale.