100% Free Amazon DOP-C02 Practice Test Questions

Question 1

An insurance firm has recently undergone digital transformation and AWS cloud adoption. Its app development team has four environments, namely DEV, TEST, PRE-PROD, and PROD, for its flagship application that is configured with AWS CodePipeline. After several weeks, they noticed that there were several outages caused by misconfigured files or faulty code blocks that were deployed into the PROD environment. A DevOps Engineer has been assigned to add the required steps to identify issues in the application before it is released.

Which of the following is the MOST appropriate combination of steps that the Engineer should implement to identify functional issues during the deployment process? (Select TWO.)

A : In the pipeline, add an AWS CodeDeploy action to deploy the latest version of the application to the PRE-PROD environment. Set up a manual approval action in the pipeline so that the QA team can perform the required tests. Add another CodeDeploy action that deploys the verified code to the PROD environment after the manual approval action.

B : Migrate the pipeline from CodePipeline to AWS Data Pipeline to enable more CI/CD features. Add a test action that uses Amazon Macie to the pipeline. Run an assessment using the Runtime Behavior Analysis rules package to verify that the deployed code complies with the strict security standards of the company before deploying it to the PROD environment.

C : Add a test action that uses Amazon GuardDuty to the pipeline. Run an assessment using the Runtime Behavior Analysis rules package to verify that the deployed code complies with the strict security standards of the company before deploying it to the PROD environment.

D : Add a test action to the pipeline to run both the unit and functional tests using AWS CodeBuild. Verify that the test results passed before deploying the new application revision to the PROD environment.

E : Add a test action that uses Amazon Inspector to the pipeline. Run an assessment using the Runtime Behavior Analysis rules package to verify that the deployed code complies with the strict security standards of the company before deploying it to the PROD environment.

Answer: A,D

Question 2

A company is using AWS to run digital workloads. Each application team in the company has its own AWS account for application hosting. The accounts are consolidated in an organization in AWS Organizations. The company wants to enforce security standards across the entire organization. To avoid noncompliance because of security misconfiguration, the company has enforced the use of AWS CloudFormation. A production support team can modify resources in the production environment by using the AWS Management Console to troubleshoot and resolve application-related issues. A DevOps engineer must implement a solution to identify in near real time any AWS service misconfiguration that results in noncompliance. The solution must automatically remediate the issue within 15 minutes of identification. The solution also must track noncompliant resources and events in a centralized dashboard with accurate timestamps. Which solution will meet these requirements with the LEAST development overhead?

A : Use CloudFormation drift detection to identify noncompliant resources. Use drift detection events from CloudFormation to invoke an AWS Lambda function for remediation. Configure the Lambda function to publish logs to an Amazon CloudWatch Logs log group. Configure an Amazon CloudWatch dashboard to use the log group for tracking.

B : Turn on AWS CloudTrail in the AWS accounts. Analyze CloudTrail logs by using Amazon Athena to identify noncompliant resources. Use AWS Step Functions to track query results on Athena for drift detection and to invoke an AWS Lambda function for remediation. For tracking, set up an Amazon QuickSight dashboard that uses Athena as the data source.

C : Turn on the configuration recorder in AWS Config in all the AWS accounts to identify noncompliant resources. Enable AWS Security Hub with the ~no-enable-default-standards option in all the AWS accounts. Set up AWS Config managed rules and custom rules. Set up automatic remediation by using AWS Config conformance packs. For tracking, set up a dashboard on Security Hub in a designated Security Hub administrator account.

D : Turn on AWS CloudTrail in the AWS accounts. Analyze CloudTrail logs by using Amazon CloudWatch Logs to identify noncompliant resources. Use CloudWatch Logs filters for drift detection. Use Amazon EventBridge to invoke the Lambda function for remediation. Stream filtered CloudWatch logs to Amazon OpenSearch Service. Set up a dashboard on OpenSearch Service for tracking.

Answer: C

Question 3

A DevOps engineer is building the infrastructure for an application. The application needs to run on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that includes Amazon EC2 instances. The EC2 instances need to use an Amazon Elastic File System (Amazon EFS) file system as a storage backend. The Amazon EFS Container Storage Interface (CSI) driver is installed on the EKS cluster.

When the DevOps engineer starts the application, the EC2 instances do not mount the EFS file system.

Which solutions will fix the problem? (Choose three.)

A : Switch the EKS nodes from Amazon EC2 to AWS Fargate.

B : Add an inbound rule to the EFS file system’s security group to allow NFS traffic from the EKS cluster.

C : Create an IAM role that allows the Amazon EFS CSI driver to interact with the file system

D : Set up AWS DataSync to configure file transfer between the EFS file system and the EKS nodes.

E : Create a mount target for the EFS file system in the subnet of the EKS nodes.

F : Disable encryption or the EFS file system.

Answer: B,C,F

Question 4

A leading software development company has various web applications hosted in an Auto Scaling group of EC2 instances which are designed for high availability and fault tolerance. They are using AWS CloudFormation to easily manage their cloud infrastructure as code as well as for deployment. Currently, they have to manually update their CloudFormation templates for every new available AMI of their application. This procedure is prone to human errors and entails a high management overhead on their deployment process.

Which of the following is the MOST suitable and cost-effective solution that the DevOps engineer should implement to automate this process?

A : Pull the new AMI IDs using an AWS Lambda-backed custom resource in the CloudFormation template. Reference the AMI ID that the custom resource fetched in the launch configuration resource block.

B : Configure the CloudFormation template to use AMI mappings. Integrate AWS Lambda and Amazon CloudWatch Events to create a function that regularly runs every hour to detect new AMIs as well as update the mapping in the template. Reference the AMI mappings in the launch configuration resource block.

C : Configure the AWS CloudFormation template to use conditional statements to check if new AMIs are available. Fetch the new AMI ID using the cfn-init helper script and reference it in the launch configuration resource block.

D : Launch an EC2 instance to run a custom shell script every hour to check for new AMIs. The script should update the launch configuration resource block of the CloudFormation template with the new AMI ID if there are new ones available.

Answer: A

Question 5

A software team is using AWS CodePipeline to automate its Java application release pipeline. The pipeline consists of a source stage, then a build stage, and then a deploy stage. Each stage contains a single action that has a runOrder value of 1.

The team wants to integrate unit tests into the existing release pipeline. The team needs a solution that deploys only the code changes that pass all unit tests.

Which solution will meet these requirements?

A : Modify the build stage. Add a test action that has a runOrder value of 1. Use AWS CodeDeploy as the action provider to run unit tests.

B : Modify the build stage. Add a test action that has a runOrder value of 2. Use AWS CodeBuild as the action provider to run unit tests.

C : Modify the deploy stage. Add a test action that has a runOrder value of 1. Use AWS CodeDeploy as the action provider to run unit tests.

D : Modify the deploy stage. Add a test action that has a runOrder value of 2. Use AWS CodeBuild as the action provider to run unit tests.

Answer: C

Free Practice Amazon DOP-C02 Exam Questions 2025