CLOUDPUZ
AWS Certified
DevOps Engineer -
Professional
DOP-C02
150 Practice Questions
Answers & Detailed Explanations
2 practice tests • 75 questions per test • English
Independent study material for certification preparation. This publication is not affiliated with or endorsed by Amazon Web
Services. AWS and related names are trademarks of their respective owners.
Practice questions for learning and revision; no claim is made that these are live certification exam questions.
CLOUDPUZ | DOP-C02 | Practice questions & answers 1
, How to use this question bank
Complete each practice test before consulting its answer key. Select one answer unless the
question specifies multiple answers. Review the explanations for every option, then revisit the
topics you missed.
Each test has three sections: Questions, Quick answer key, and Answers with explanations.
Question numbering restarts at 1 for Test 2.
The questions and explanations retain the content of the Cloudpuz source question banks. Official reference links supplied
in those banks are preserved for further study. Service capabilities and exam objectives may evolve.
CLOUDPUZ | DOP-C02 | Practice questions & answers 2
, Practice Test 1
Questions 1-75
Question 1 | Incident and Event Response
An EventBridge target repeatedly fails and the team needs to preserve undelivered events after
retries are exhausted. What should be configured?
A. Unlimited retries with no visibility
B. A supported dead-letter queue and monitored retry policy
C. Only a longer rule description
D. A dashboard screenshot as the event backup
Select 1 answer.
Question 2 | Incident and Event Response
A remediation Lambda fixes a resource, and the resulting change event invokes the same
remediation again indefinitely. What should prevent this loop?
A. Disable all audit logging
B. Increase Lambda concurrency to process the loop faster
C. Filter irrelevant self-generated events and make the action conditional on actual
noncompliance
D. Always write a new timestamp even when no change is needed
Select 1 answer.
Question 3 | Monitoring and Logging
An application includes raw passwords in trace annotations. What should change?
A. Copy the same annotations into public dashboards
B. Remove or redact secrets and use non-sensitive diagnostic attributes
C. Keep passwords because traces are operational data
D. Encode passwords as hexadecimal and retain them
Select 1 answer.
CLOUDPUZ | DOP-C02 | Practice questions & answers 3
, Question 4 | Configuration Management and IaC
A StackSet update succeeds in some accounts and fails in others because of a regional resource
quota. What should the engineer do?
A. Inspect failed stack instances, address quota or template constraints, and retry the affected
scope
B. Change only the StackSet display name
C. Mark all accounts compliant because one succeeded
D. Delete all successful instances immediately without a recovery plan
Select 1 answer.
Question 5 | Security and Compliance
A web application needs protection against common malicious HTTP request patterns. Which
service is most directly relevant?
A. Only a subnet network ACL for application payload inspection
B. Only an S3 lifecycle rule
C. Only a database sort key
D. AWS WAF with appropriately tested web ACL rules
Select 1 answer.
Question 6 | Configuration Management and IaC
A team wants developers to launch approved infrastructure products with standardized security
controls. Which service fits?
A. Amazon Macie
B. CloudWatch Logs Insights
C. AWS Service Catalog
D. Amazon SQS
Select 1 answer.
Question 7 | Incident and Event Response
An ECS service repeatedly replaces tasks. What evidence should the responder inspect first?
A. Only the repository's README heading
B. Only the cluster's display name
C. Service events, task stopped reasons, container logs, and health-check results
D. Delete the service immediately before collecting evidence
Select 1 answer.
CLOUDPUZ | DOP-C02 | Practice questions & answers 4
AWS Certified
DevOps Engineer -
Professional
DOP-C02
150 Practice Questions
Answers & Detailed Explanations
2 practice tests • 75 questions per test • English
Independent study material for certification preparation. This publication is not affiliated with or endorsed by Amazon Web
Services. AWS and related names are trademarks of their respective owners.
Practice questions for learning and revision; no claim is made that these are live certification exam questions.
CLOUDPUZ | DOP-C02 | Practice questions & answers 1
, How to use this question bank
Complete each practice test before consulting its answer key. Select one answer unless the
question specifies multiple answers. Review the explanations for every option, then revisit the
topics you missed.
Each test has three sections: Questions, Quick answer key, and Answers with explanations.
Question numbering restarts at 1 for Test 2.
The questions and explanations retain the content of the Cloudpuz source question banks. Official reference links supplied
in those banks are preserved for further study. Service capabilities and exam objectives may evolve.
CLOUDPUZ | DOP-C02 | Practice questions & answers 2
, Practice Test 1
Questions 1-75
Question 1 | Incident and Event Response
An EventBridge target repeatedly fails and the team needs to preserve undelivered events after
retries are exhausted. What should be configured?
A. Unlimited retries with no visibility
B. A supported dead-letter queue and monitored retry policy
C. Only a longer rule description
D. A dashboard screenshot as the event backup
Select 1 answer.
Question 2 | Incident and Event Response
A remediation Lambda fixes a resource, and the resulting change event invokes the same
remediation again indefinitely. What should prevent this loop?
A. Disable all audit logging
B. Increase Lambda concurrency to process the loop faster
C. Filter irrelevant self-generated events and make the action conditional on actual
noncompliance
D. Always write a new timestamp even when no change is needed
Select 1 answer.
Question 3 | Monitoring and Logging
An application includes raw passwords in trace annotations. What should change?
A. Copy the same annotations into public dashboards
B. Remove or redact secrets and use non-sensitive diagnostic attributes
C. Keep passwords because traces are operational data
D. Encode passwords as hexadecimal and retain them
Select 1 answer.
CLOUDPUZ | DOP-C02 | Practice questions & answers 3
, Question 4 | Configuration Management and IaC
A StackSet update succeeds in some accounts and fails in others because of a regional resource
quota. What should the engineer do?
A. Inspect failed stack instances, address quota or template constraints, and retry the affected
scope
B. Change only the StackSet display name
C. Mark all accounts compliant because one succeeded
D. Delete all successful instances immediately without a recovery plan
Select 1 answer.
Question 5 | Security and Compliance
A web application needs protection against common malicious HTTP request patterns. Which
service is most directly relevant?
A. Only a subnet network ACL for application payload inspection
B. Only an S3 lifecycle rule
C. Only a database sort key
D. AWS WAF with appropriately tested web ACL rules
Select 1 answer.
Question 6 | Configuration Management and IaC
A team wants developers to launch approved infrastructure products with standardized security
controls. Which service fits?
A. Amazon Macie
B. CloudWatch Logs Insights
C. AWS Service Catalog
D. Amazon SQS
Select 1 answer.
Question 7 | Incident and Event Response
An ECS service repeatedly replaces tasks. What evidence should the responder inspect first?
A. Only the repository's README heading
B. Only the cluster's display name
C. Service events, task stopped reasons, container logs, and health-check results
D. Delete the service immediately before collecting evidence
Select 1 answer.
CLOUDPUZ | DOP-C02 | Practice questions & answers 4
