DOP-C02 Practice Questions — Free

Question 1 of 25

A container image must be scanned for vulnerabilities before deployment. Where does this belong?

• A.A runtime check in production with no pipeline gate
• B.A review during the next monthly security audit cycle
• C.A scan run on the developer's laptop before committing
• D.A pipeline stage failing the build on critical scan findingsCorrect

Question 2 of 25

A team must guarantee that emergency changes are still recorded and reviewed. Which practice fits?

• A.A post-incident review with retrospective approval recordedCorrect
• B.Emergency changes exempted from any record or review
• C.Waiting for normal approval even during a live outage
• D.Recording the change only if someone remembers to

Question 3 of 25

A build's output differs between two runs of the same commit. Which cause is most likely?

• A.The pipeline having a different number of defined stages
• B.The artifact bucket being located in another Region
• C.The build agent running in a different Availability Zone
• D.Unpinned dependencies or non-deterministic build stepsCorrect

Question 4 of 25 · multiple response

Which of the following are appropriate reasons to fail a pipeline stage? (Select TWO)

• A.Automated tests failing or coverage dropping below the thresholdCorrect
• B.The deployment being requested late in the working day
• C.The change being authored by a junior engineer
• D.A security scan reporting findings above the agreed severityCorrect

Question 5 of 25

A build produces artifacts consumed by a later stage in a different Region. What is required?

• A.Rebuilding the artifact from source in the target Region
• B.Manual copying of the artifacts between the two Regions
• C.A regional artifact bucket per Region with cross-Region actionsCorrect
• D.A single artifact bucket in the pipeline's home Region only

Question 6 of 25

A CloudFormation stack update must be reviewed before it modifies production resources. What should be used?

• A.A change set showing the resource changes before executionCorrect
• B.Deleting and recreating the stack on every single change
• C.Manual console edits applied to the affected resources
• D.A direct stack update with automatic rollback disabled

Question 7 of 25

A team wants configuration values shared across environments without redeploying stacks. Which service fits?

• A.Values hard-coded into each application's container image
• B.Environment variables set by hand on each instance
• C.Parameter Store values read by the applications at runtimeCorrect
• D.A configuration file committed into the source repository

Question 8 of 25

A CloudFormation deployment failed and left the stack in UPDATE_ROLLBACK_FAILED. What is the appropriate action?

• A.Delete the entire AWS account and start again from scratch
• B.Edit the resources manually and ignore the stack's state
• C.Continue the rollback skipping stuck resources, then fix and retryCorrect
• D.Leave the stack in the failed state indefinitely

Question 9 of 25

An organisation must ensure resources are tagged with an owner for cost attribution. Which approach fits?

• A.An assumption that teams tag their own resources correctly
• B.A tagging convention documented in the engineering wiki
• C.A monthly report of untagged resources for teams to fix
• D.Tag enforcement at creation with detection and remediationCorrect

Question 10 of 25

A multi-tier application must limit the impact of one tenant's traffic on others. Which approach fits?

• A.Scaling the whole platform to suit the largest tenant
• B.A single shared pool with no per-tenant limits applied
• C.Rate limiting and per-tenant quotas at the entry pointCorrect
• D.Blocking every tenant when one exceeds its capacity

Question 11 of 25

An Auto Scaling group must replace instances gradually when a new AMI is released. Which capability fits?

• A.An instance refresh with a minimum healthy percentage setCorrect
• B.Leaving the older instances running indefinitely
• C.Manually replacing the instances one at a time by hand
• D.Terminating every instance at once and letting scaling recover

Question 12 of 25

A stateful workload must retain data when instances are replaced. Which approach fits?

• A.Recreate the state manually after every replacement
• B.Prevent the instances from ever being replaced at all
• C.Store state in a managed service or attached durable storageCorrect
• D.Keep the state on the instance's ephemeral local disk

Question 13 of 25

A team must verify their application behaves correctly when an Availability Zone is impaired. Which practice fits?

• A.Reading the architecture diagram to confirm zone coverage
• B.Assuming the load balancer handles zone failure correctly
• C.Counting the instances present in each Availability Zone
• D.A controlled experiment removing a zone's capacityCorrect

Question 14 of 25

A team wants to be alerted before a resource limit is reached rather than after. Which approach fits?

• A.An alarm that fires once the quota is fully exhausted
• B.Alarms on utilisation trending toward the quota with headroomCorrect
• C.A monthly review of the account's current service quotas
• D.A support ticket raised after the limit has been reached

Question 15 of 25

Which practice prevents log volume from growing without bound and cost with it?

• A.Retaining every single log line indefinitely by default
• B.Retention policies with sampling of low-value log dataCorrect
• C.Disabling logging whenever the monthly bill increases
• D.Storing the logs on instances rather than centrally

Question 16 of 25

Which metric best indicates whether an SQS-based system is keeping up with demand?

• A.The total size of the S3 artifact bucket
• B.The count of EC2 instances running in the Region
• C.ApproximateAgeOfOldestMessage on the queueCorrect
• D.The number of Lambda functions in the account

Question 17 of 25

A team must detect a gradual memory leak in a production service. Which approach fits?

• A.CPU utilization alarms configured on the load balancer
• B.Agent-collected guest memory metrics trended with a growth alarmCorrect
• C.A one-time memory check performed at deployment
• D.Billing alerts covering the account's monthly spend

Question 18 of 25

An S3 bucket unexpectedly becomes publicly accessible. Which automated response fits?

• A.A CloudWatch alarm monitoring the bucket's storage size
• B.A monthly review of bucket permissions by the security team
• C.An email alert with no automated remediation attached to it
• D.An EventBridge rule on the finding invoking remediationCorrect

Question 19 of 25

An automated response must not run repeatedly for the same recurring event. What should the design include?

• A.Idempotency and a suppression window preventing re-triggeringCorrect
• B.Disabling the rule permanently after its first execution
• C.Requiring manual approval before every automated response
• D.Running the response as many times as the event fires

Question 20 of 25

Which practice ensures the right people are informed during a customer-impacting incident?

• A.A plan with defined roles, channels, and update cadenceCorrect
• B.A single update posted once the incident has been resolved
• C.Individual engineers messaging whoever they think should know
• D.Waiting for stakeholders to ask about the impact

Question 21 of 25

An unhealthy instance must be replaced automatically without human action. Which capability fits?

• A.A weekly manual audit of every instance's health status
• B.Auto Scaling health checks with automatic instance replacementCorrect
• C.An email alert sent to the operations team mailbox
• D.A support ticket raised for an engineer to investigate

Question 22 of 25

A team must give a contractor temporary access to one account for two weeks. Which approach fits?

• A.Federated access with a time-bound, task-scoped roleCorrect
• B.Sharing an existing engineer's credentials temporarily
• C.Public access to the resources the contractor needs
• D.A permanent IAM user granted administrator access

Question 23 of 25

A team must limit which principals can invoke a production deployment. Which control fits?

• A.A naming convention identifying the production pipeline
• B.IAM policy and approval restricting who can trigger productionCorrect
• C.A calendar entry showing the planned release schedule
• D.An announcement posted in the team's chat channel

Question 24 of 25

An organisation must ensure a new service meets security requirements before launch. Which approach fits?

• A.A security review performed after the service goes live
• B.A general expectation that teams follow best practice
• C.A threat model and control checks in the design and pipelineCorrect
• D.An annual penetration test covering all of the services

Question 25 of 25

Which approach detects publicly exposed resources across many accounts continuously?

• A.Security Hub aggregating Config and access analyzer findingsCorrect
• B.A one-time review carried out before the annual audit
• C.A CloudWatch alarm on the organisation's total spend
• D.A spreadsheet of resources maintained by each team