Official Bank
0/419
Page
1/4
AWS Certified DevOps Engineer – Professional Exam (DOP-C02) - AWS Exam Questions
Last updated on June 20, 2026
97%
Exam Compliance
419
Total Questions
1
Question
A DevOps engineer used an AWS Cloud Formation custom resource to set up AD Connector. The AWS Lambda function ran and created AD Connector, but Cloud Formation is not transitioning from CREATE_IN_PROGRESS to CREATE_COMPLETE.
Which action should the engineer take to resolve this issue?
Which action should the engineer take to resolve this issue?
Options
A
Ensure the Lambda function IAM role has ds ConnectDirectory permissions for the AWS account.
B
Ensure the Lambda function code returns a response to the pre-signed URL.
C
Ensure the Lambda function IAM role has cloudformation UpdateStack permissions for the stack ARN.
D
Ensure the Lambda function code has exited successfully.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
2
Question
A company uses AWS Key Management Service (AWS KMS) keys and manual key rotation to meet regulatory compliance requirements. The security team wants to be notified when any keys have not been rotated after 90 days.
Which solution will accomplish this?
Which solution will accomplish this?
Options
A
Configure AWS Security Hub to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
B
Develop an AWS Config custom rule that publishes to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
C
Configure an Amazon EventBridge event to launch an AWS Lambda function to call the AWS Trusted Advisor API and publish to an Amazon Simple Notification Service (Amazon SNS) topic.
D
Configure AWS KMS to publish to an Amazon Simple Notification Service (Amazon SNS) topic when keys are more than 90 days old.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
3
Question
A company uses an organization in AWS Organizations with all features enabled to manage a fleet of AWS accounts. The company expects to create many new accounts for an upcoming project. The company wants to ensure that the new accounts will not have default VPCs and that users can develop only in specific AWS Regions. The company must monitor the new accounts for compliance with the Center for Internet Security (CIS) AWS Foundations Benchmark framework.
Which combination of solutions will meet these requirements with the LEAST operational effort? (Select TWO.)
Which combination of solutions will meet these requirements with the LEAST operational effort? (Select TWO.)
Select 2
Options
A
Activate the CIS AWS Foundations Benchmark framework on the Control Library panel in AWS Control Tower.
B
Activate AWS Security Hub at the organization level. Select the CIS AWS Foundations Benchmark framework, and apply the framework to the organization.
C
Activate AWS Control Tower. Install Customizations for AWS Control Tower (CfCT). Develop a custom AWS CloudFormation template to delete default VPCs. Configure Region denies, and ensure that users can access only the specified Regions.
D
Write an SCP that denies access to all Regions except the specified Regions. Create an AWS Lambda function that assumes an IAM role by using the Organizations default service role in each member account to identify and delete default VPCs. Create an Amazon EventBridge rule that invokes the Lambda function when the company creates a new AWS account.
E
Activate AWS Control Tower. Configure AWS Control Tower to disable internet-accessible subnets.
Set the maximum number of private subnets to zero. Configure Region denies, and ensure that users can access only the specified Regions.
Set the maximum number of private subnets to zero. Configure Region denies, and ensure that users can access only the specified Regions.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
4
Question
A DevOps engineer needs to install antivirus software on all Amazon EC2 instances in an AWS account. The EC2 instances run the most recent Amazon Linux version. The solution must detect all instances and use an AWS Systems Manager document to install the software if missing.
Which solution will meet these requirements?
Which solution will meet these requirements?
Options
A
Create an association in Systems Manager State Manager targeting all managed nodes. Include the software and Systems Manager document.
B
Use EventBridge to detect EC2 RunInstances events and trigger SSM automation.
C
Use AWS Config with a custom rule to check for antivirus installation. Configure automatic remediation using the Systems Manager document.
D
Use Amazon Inspector to detect missing software and associate with Systems Manager automation.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
5
Question
A company is implementing an Amazon Elastic Container Service (Amazon ECS) cluster to run its workload. The company architecture will run multiple ECS services on the cluster. The architecture includes an Application Load Balancer on the front end and uses multiple target groups to route traffic. A DevOps engineer must collect application and access logs. The DevOps engineer then needs to send the logs to an Amazon S3 bucket for near-real-time analysis.
Which combination of steps must the DevOps engineer take to meet these requirements? (Choose three.)
Which combination of steps must the DevOps engineer take to meet these requirements? (Choose three.)
Select 3
Options
A
Install the Amazon CloudWatch Logs agent on the ECS instances. Change the logging driver in the ECS task definition to awslogs.
B
Download the Amazon CloudWatch Logs container instance from AWS. Configure this instance as a task. Update the application service definitions to include the logging task.
C
Activate access logging on the ALB. Then point the ALB directly to the logging S3 bucket.
D
Create an Amazon Kinesis Data Firehose delivery stream that has a destination of the logging S3 bucket. Then create an Amazon CloudWatch Logs subscription filter for Kinesis Data Firehose.
E
Activate access logging on the target groups that the ECS services use. Then send the logs directly to the logging S3 bucket.
F
Use Amazon EventBridge to schedule an AWS Lambda function that will run every 60 seconds and will run the Amazon CloudWatch Logs create-export-task command. Then point the output to the logging S3 bucket.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
Finish Practice?
Are you sure you want to finish? This will end your practice session.