Free DOP-C02 mock test – Exam 2

AWS Certified DevOps Engineer – Professional (DOP-C02) Practice Exam 2

Practice DevOps monitoring, IaC, EKS, security, and governance scenarios for DOP-C02.

This second AWS DevOps Engineer Professional practice exam adds scenario-based questions across CloudWatch Logs, Kinesis, CDK, EventBridge, CodeBuild reports, GuardDuty, EKS metrics, and IAM Identity Center.

10 new exam-style questions Select TWO and THREE practice included Instant option-by-option explanations No signup required

Start Practice Exam 2 below. For multi-select questions, choose the required number of answers before the explanation appears.

AWS Certified DevOps Engineer - Professional (DOP-C02) Practice Exam 2

Free AWS Certified DevOps Engineer - Professional DOP-C02 practice exam 2 with detailed explanations for every option.

1 / 10

Question

A company has an application that runs on AWS Lambda and sends logs to Amazon CloudWatch Logs. An Amazon Kinesis data stream is subscribed to the log groups in CloudWatch Logs. A single consumer Lambda function processes the logs from the data stream and stores the logs in an Amazon S3 bucket. The DevOps team has noticed high latency during the processing and ingestion of some logs. Which combination of steps will reduce the latency? (Select THREE.)

Which option meets the requirement?

A. Create a data stream consumer with enhanced fan-out. Set the Lambda function that processes the logs as the consumer.

B. Increase the ParallelizationFactor setting in the Lambda event source mapping.

C. Configure reserved concurrency for the Lambda function that processes the logs.

D. Increase the batch size in the Kinesis data stream.

E. Turn off the ReportBatchItemFailures setting in the Lambda event source mapping.

F. Increase the number of shards in the Kinesis data stream.

2 / 10

Question

A company has many AWS accounts. During account creation, automation creates a CloudWatch Logs log group in every AWS Region that the company operates in. New resources publish logs to the provisioned log groups in their Region. The company has created a logging account to centralize logging from all other accounts. A DevOps engineer needs to aggregate the log groups from all accounts to an existing S3 bucket in the logging account. Which solution is the most operationally efficient?

Which option meets the requirement?

A. In the logging account, create one CloudWatch Logs destination with a destination policy. Subscribe log groups from each account to the destination. Configure one Kinesis data stream and one Kinesis Data Firehose delivery stream to deliver logs to S3.

B. In the logging account, create a CloudWatch Logs destination with a destination policy for each Region. Subscribe log groups from each account to the destination. Configure one Kinesis data stream and one Kinesis Data Firehose delivery stream for all Regions.

C. In the logging account, create a CloudWatch Logs destination with a destination policy for each Region. Subscribe log groups from each account to the regional destination. Configure a Kinesis data stream and Kinesis Data Firehose delivery stream for each Region to deliver logs to S3.

D. In the logging account, create one CloudWatch Logs destination with a destination policy. Subscribe log groups from each account to the destination. Configure one Kinesis data stream to deliver logs from the destination to S3.

3 / 10

Question

A DevOps engineer is planning to use the AWS Cloud Development Kit (AWS CDK) to manage infrastructure as code for a microservices-based application. The engineer must create reusable components for common infrastructure patterns and apply the same cost allocation tags across different microservices. Which solution meets these requirements?

Which option meets the requirement?

A. Create a custom CDK construct library. Use TagManager to add cost allocation tags to the whole app. Use one higher-level construct that contains all microservices. Deploy all microservices as a single CDK stack.

B. Create a custom CDK construct library. Use the Tags class to add cost allocation tags to the whole app. Use higher-level constructs for each microservice. Deploy the microservices as separate CDK stacks with environment-specific configurations.

C. Create AWS Service Catalog products for common infrastructure. Use TagManager to add cost allocation tags to the whole app. Use Service Catalog products in one construct that contains all microservices. Deploy all microservices as one CDK stack.

D. Create AWS Service Catalog products for common infrastructure. Use the Tags class to add cost allocation tags to the whole app. Use Service Catalog products for each microservice. Deploy separate CDK stacks.

4 / 10

Question

A company uses AWS Organizations to manage its AWS accounts. An automation account contains a CI/CD pipeline that creates and configures new AWS accounts. Internal service teams operate from service accounts and want to receive a CloudTrail event in their service accounts when the CreateAccount API call creates a new account. How should the company share this CloudTrail event with the service accounts?

Which option meets the requirement?

A. Create an EventBridge rule in the automation account to send account creation events to the default event bus in the service accounts. Update the default event bus in the service accounts to allow events from the automation account.

B. Create a custom EventBridge event bus in the service accounts. Update the custom event bus to allow events from the automation account. Create a rule in the service account that directly listens to CloudTrail events from the automation account.

C. Create a custom EventBridge event bus in the automation account and the service accounts. Create an EventBridge rule and policy that connects the custom event buses.

D. Create a custom EventBridge event bus in the automation account. Create an EventBridge rule and policy that connects the custom event bus to the default event buses in the service accounts.

5 / 10

Question

A company has an application and a CI/CD pipeline that consists of CodePipeline and CodeBuild. The CodeBuild project runs tests as part of the build process and outputs a test report. The company must keep the test reports for 90 days. Which solution meets these requirements?

Which option meets the requirement?

A. Add a new CodePipeline stage after CodeBuild. Create an S3 bucket for reports. Configure an S3 deploy action in the new stage with the appropriate path and format for the reports.

B. Add a report group in the CodeBuild buildspec file. Create an S3 bucket. Configure EventBridge to invoke Lambda to copy reports to S3 when a build completes. Create an S3 Lifecycle rule to expire objects after 90 days.

C. Add a new CodePipeline stage. Configure a test action type with the report path and format. Configure the report expiration time to 90 days in the CodeBuild buildspec file.

D. Add a report group in the CodeBuild buildspec file with the report path and format. Create an S3 bucket for the report files. Configure the report files as build artifacts with the S3 bucket as the artifact destination. Set S3 object expiration to 90 days.

6 / 10

Question

A company gives employees limited rights in AWS. DevOps engineers can assume an administrator role. For tracking purposes, the security team wants a near-real-time notification when the administrator role is assumed. How should this be accomplished?

Which option meets the requirement?

A. Configure AWS Config to publish logs to S3. Use Athena to query the logs and send a notification when the administrator role is assumed.

B. Configure Amazon GuardDuty to monitor when the administrator role is assumed and send a notification to the security team.

C. Create an EventBridge rule using an AWS Management Console sign-in event pattern that publishes to SNS if the administrator role is assumed.

D. Create an EventBridge rule using a CloudTrail AWS API call event pattern for AssumeRole. Invoke Lambda to publish a message to an SNS topic.

7 / 10

Question

A company has multiple development groups working in one shared AWS account. A senior manager wants to be alerted by a third-party API call when resource creation approaches service limits for the account. Which solution accomplishes this with the least development effort?

Which option meets the requirement?

A. Create a scheduled EventBridge rule that invokes Lambda. Have Lambda evaluate the AWS environment and compare deployed resources to service limits.

B. Deploy a Lambda function that refreshes AWS Trusted Advisor checks on a schedule. Create another EventBridge rule for Trusted Advisor events and invoke Lambda to notify the manager.

C. Deploy a Lambda function that refreshes AWS Personal Health Dashboard checks on a schedule. Create another EventBridge rule for Personal Health Dashboard events and invoke Lambda to notify the manager.

D. Add an AWS Config custom rule that periodically checks service limit status and streams notifications to SNS. Subscribe Lambda to notify the manager.

8 / 10

Question

A company hired a penetration tester to simulate an internal security breach. The tester performed port scans on the company's EC2 instances. Existing security measures did not detect the scans. The company needs automatic notification when port scans are performed on EC2 instances and has created and subscribed to an SNS topic. What should the company do next?

Which option meets the requirement?

A. Ensure that Amazon GuardDuty is enabled. Create an EventBridge rule for GuardDuty EC2 port scan findings and connect the rule to the SNS topic.

B. Ensure that Amazon Inspector is enabled. Create an EventBridge event for network reachability findings that indicate port scans and connect the event to SNS.

C. Ensure that Amazon Inspector is enabled. Create an EventBridge event for CVEs that cause open port vulnerabilities and connect the event to SNS.

D. Ensure that CloudTrail is enabled. Create a Lambda function to analyze CloudTrail logs for unusual traffic from an IP range and connect Lambda to SNS.

9 / 10

Question

A company migrated an application to an Amazon EKS cluster that uses EC2 instances. The application scales based on CPU utilization, but it produces memory errors under heavy load and does not scale out enough. The company needs to collect and analyze memory metrics for the application over time. Which combination of steps will meet these requirements? (Select THREE.)

Which option meets the requirement?

A. Attach the CloudWatchAgentServerPolicy managed IAM policy to the IAM instance profile that the cluster uses.

B. Attach the CloudWatchAgentServerPolicy managed IAM policy to a service account role for the cluster.

C. Collect performance metrics by deploying the unified CloudWatch agent to the existing EC2 instances and adding the agent to the AMI for new EC2 instances.

D. Collect performance logs by deploying the AWS Distro for OpenTelemetry collector as a DaemonSet.

E. Analyze the pod_memory_utilization CloudWatch metric in the ContainerInsights namespace by using the Service dimension.

F. Analyze the node_memory_utilization CloudWatch metric in the ContainerInsights namespace by using the ClusterName dimension.

10 / 10

Question

An ecommerce company is building an AWS Control Tower landing zone. The DevOps team set IAM Identity Center to use an external identity provider with SAML 2.0. The team wants a robust least-privilege permission model that allows the team to build and manage only its own resources. Which combination of steps will meet these requirements? (Select THREE.)

Which option meets the requirement?

A. Create IAM policies that include the required permissions. Include the aws:PrincipalTag condition key.

B. Create permission sets. Attach an inline policy that includes the required permissions and uses the aws:PrincipalTag condition key to scope permissions.

C. Create a group in the IdP. Place users in the group. Assign the group to accounts and permission sets in IAM Identity Center.

D. Create a group in the IdP. Place users in the group. Assign the group to OUs and IAM policies.

E. Enable attributes for access control in IAM Identity Center. Apply tags to users. Map the tags as key-value pairs.

F. Enable attributes for access control in IAM Identity Center. Map attributes from the IdP as key-value pairs.

Your score is

What Practice Exam 2 covers

Kinesis, CloudWatch Logs, and centralized logging patterns
EventBridge, CloudTrail events, and cross-account notifications
EKS memory metrics, Container Insights, and ADOT collection
CDK constructs, CodeBuild reports, and S3 retention
IAM Identity Center ABAC and least-privilege permission models

Who should take this mock test

Use this practice exam if you are preparing for AWS Certified DevOps Engineer – Professional (DOP-C02) Practice Exam 2, especially if you already understand core AWS services and want to sharpen exam-style decision making.

Browse AWS practice exams Study AWS articles

FAQ

Is this DOP-C02 practice exam free?

Yes. This AWS DevOps Engineer Professional mock test is free to open and retake.

Does this replace hands-on AWS practice?

No. Use it with hands-on work in CI/CD, monitoring, Systems Manager, CloudFormation, and container workflows.

How should I review missed questions?

Read every option explanation, identify the AWS service pattern being tested, then practice the same workflow in a lab or review the official documentation.

AWS Certified DevOps Engineer Professional Practice Exam 2 | DOP-C02 Mock Test

Practice DevOps monitoring, IaC, EKS, security, and governance scenarios for DOP-C02.

Question

Correct Answer: A, B, F

Explanation

Question

Correct Answer: C

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: A

Explanation

Question

Correct Answer: D

Explanation

Question

Correct Answer: D

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: A

Explanation

Question

Correct Answer: B, D, E

Explanation

Question

Correct Answer: B, C, F

Explanation

What Practice Exam 2 covers

Who should take this mock test

FAQ

Is this DOP-C02 practice exam free?

Does this replace hands-on AWS practice?

How should I review missed questions?

Leave a Reply Cancel reply