Online Access Free Amazon.DOP-C02.v2026-03-12.q166 Practice Test (Page 16)

DOP-C02 Exam Question 71

A DevOps engineer used an AWS Cloud Formation custom resource to set up AD Connector. The AWS Lambda function ran and created AD Connector, but Cloud Formation is not transitioning from CREATE_IN_PROGRESS to CREATE_COMPLETE.
Which action should the engineer take to resolve this issue?

A.Ensure the Lambda function code has exited successfully.

B.Ensure the Lambda function code returns a response to the pre-signed URL.

C.Ensure the Lambda function IAM role has cloudformation UpdateStack permissions for the stack ARN.

D.Ensure the Lambda function IAM role has ds ConnectDirectory permissions for the AWS account.

DOP-C02 Exam Question 72

A company runs an application with an Amazon EC2 and on-premises configuration. A DevOps engineer needs to standardize patching across both environments. Company policy dictates that patching only happens during non-business hours.
Which combination of actions will meet these requirements? (Choose three.)

A.Add the physical machines into AWS Systems Manager using Systems Manager Hybrid Activations.

B.Attach an IAM role to the EC2 instances, allowing them to be managed by AWS Systems Manager.

C.Create IAM access keys for the on-premises machines to interact with AWS Systems Manager.

D.Run an AWS Systems Manager Automation document to patch the systems every hour.

E.Use Amazon EventBridge scheduled events to schedule a patch window.

F.Use AWS Systems Manager Maintenance Windows to schedule a patch window.

DOP-C02 Exam Question 73

A development team manually builds an artifact locally and then places it in an Amazon S3 bucket. The application has a local cache that must be cleared when a deployment occurs. The team runs a command to do this downloads the artifact from Amazon S3 and unzips the artifact to complete the deployment.
A DevOps team wants to migrate to a CI/CD process and build in checks to stop and roll back the deployment when a failure occurs. This requires the team to track the progression of the deployment.
Which combination of actions will accomplish this? (Select THREE)

A.Set up AWS CodePipeline to deploy the application Allow developers to check the code into a code repository as a source tor the pipeline.

B.Use AWS CodeBuild to build the artifact and place it in Amazon S3 Use AWS CodeDeploy to deploy the artifact to Amazon EC2 instances.

C.Use AWS Systems Manager to fetch the artifact from Amazon S3 and deploy it to all the instances.

D.Create user data for each Amazon EC2 instance that contains the clear cache script Once deployed test the application If it is not successful deploy it again.

E.Create a custom script to clear the cache Specify the script in the Beforelnstall lifecycle hook in the AppSpec file.

F.Allow developers to check the code into a code repository Using Amazon EventBridge on every pull into the mam branch invoke an AWS Lambda function to build the artifact and store it in Amazon S3.

DOP-C02 Exam Question 74

A company has 20 service learns Each service team is responsible for its own microservice. Each service team uses a separate AWS account for its microservice and a VPC with the 192 168 0 0/22 CIDR block. The company manages the AWS accounts with AWS Organizations.
Each service team hosts its microservice on multiple Amazon EC2 instances behind an Application Load Balancer. The microservices communicate with each other across the public internet. The company's security team has issued a new guideline that all communication between microservices must use HTTPS over private network connections and cannot traverse the public internet.
A DevOps engineer must implement a solution that fulfills these obligations and minimizes the number of changes for each service team.
Which solution will meet these requirements?

A.Create a new AWS account in AWS Organizations Create a VPC in this account and use AWS Resource Access Manager to share the private subnets of this VPC with the organization Instruct the service teams to launch a new. Network Load Balancer (NLB) and EC2 instances that use the shared private subnets Use the NLB DNS names for communication between microservices.

B.Create a Network Load Balancer (NLB) in each of the microservice VPCs Use AWS PrivateLink to create VPC endpoints in each AWS account for the NLBs Create subscriptions to each VPC endpoint in each of the other AWS accounts Use the VPC endpoint DNS names for communication between microservices.

C.Create a Network Load Balancer (NLB) in each of the microservice VPCs Create VPC peering connections between each of the microservice VPCs Update the route tables for each VPC to use the peering links Use the NLB DNS names for communication between microservices.

D.Create a new AWS account in AWS Organizations Create a transit gateway in this account and use AWS Resource Access Manager to share the transit gateway with the organization. In each of the microservice VPCs. create a transit gateway attachment tothe shared transit gateway Update the route tables of each VPC to use the transit gateway Create a Network Load Balancer (NLB) in each of the microservice VPCs Use the NLB DNS names for communication between microservices.

DOP-C02 Exam Question 75

A company uses an organization in AWS Organizations to manage several AWS accounts that the company's developers use. The company requires all data to be encrypted in transit.
Multiple Amazon S3 buckets that were created in developer accounts allow unencrypted connections. A DevOps engineer must enforce encryption of data in transit for all existing S3 buckets that are created in accounts in the organization.
Which solution will meet these requirements?

A.Use AWS Cloud Formation StackSets to deploy an AWS Network Firewall firewall to each account.
Route all outbound requests from the AWS environment through the firewall. Deploy a policy to block access to all outbound requests on port 80.

B.Use AWS CloudFormation StackSets to deploy an AWS Network Firewall firewall to each account.
Route all inbound requests to the AWS environment through the firewall. Deploy a policy to block access to all inbound requests on port 80.

C.Turn on AWS Config for the organization. Deploy a conformance pack that uses the s3-bucket-ssi- requests-only managed rule and an AWS Systems Manager Automation runbook. Use a runbook that adds a bucket policy statement to deny access to an S3 bucket when the value of the aws:
SecureTransport condition key is false.

D.Turn on AWS Config for the organization. Deploy a conformance pack that uses the s3-buckot-ssl- requests-only managed rule and an AWS Systems Manager Automation runbook. Use a runbook that adds a bucket policy statement to deny access to an S3 bucket when the value of the s3:x-amz-server- side-encryption-aws-kms-key-id condition key is null.

Correct Answer: C

Step 1: Enabling AWS Config for the OrganizationThe first step is to enable AWS Config across the AWS Organization. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. By enabling AWS Config, you can ensure that all S3 buckets within the organization are tracked and evaluated according to compliance rules.
Action: Turn on AWS Config for all AWS accounts in the organization.
Why: AWS Config will help monitor all resources (like S3 buckets) in real time to detect whether they are compliant with security policies.
Reference: AWS documentation on Configuring AWS Config.
Step 2: Deploying a Conformance Pack with Managed RulesAfter AWS Config is enabled, you need to deploy a conformance pack that contains the s3-bucket-ssi-requests-only managed rule. This rule enforces that all S3 buckets only allow requests using Secure Socket Layer (SSL) connections (HTTPS).
Action: Deploy a conformance pack that uses the s3-bucket-ssi-requests-only rule. This rule ensures that only SSL connections (for encrypted data in transit) are allowed when accessing S3.
Why: This rule guarantees that data is encrypted in transit by enforcing SSL connections to the S3 buckets.
Reference: AWS documentation on Conformance Packs.
Step 3: Using an AWS Systems Manager Automation RunbookTo automatically remediate the compliance issues, such as S3 buckets allowing non-SSL requests, a Systems Manager Automation runbook is deployed.
The runbook will automatically add a bucket policy that denies access to any requests that do not use SSL.
Action: Use a Systems Manager Automation runbook that adds a bucket policy statement to deny access when the aws:SecureTransport condition key is false.
Why: This ensures that all S3 buckets across the organization comply with the policy of enforcing encrypted data in transit.
Reference: AWS documentation on AWS Config Managed Rules.
This corresponds to Option C: Turn on AWS Config for the organization. Deploy a conformance pack that uses the s3-bucket-ssi-requests-only managed rule and an AWS Systems Manager Automation runbook. Use a runbook that adds a bucket policy statement to deny access to an S3 bucket when the value of the aws:
SecureTransport condition key is false.

Other Version: 222Amazon.DOP-C02.v2026-07-25.q201; 1293Amazon.DOP-C02.v2025-11-21.q140; 2221Amazon.DOP-C02.v2024-12-30.q117; 1678Amazon.DOP-C02.v2024-09-14.q103; 1480Amazon.DOP-C02.v2024-01-26.q82; 1245Amazon.DOP-C02.v2023-11-18.q59; 1195Amazon.DOP-C02.v2023-11-08.q77; 854Amazon.DOP-C02.v2023-08-28.q37; 936Amazon.DOP-C02.v2023-06-26.q32

Latest Upload: 251Amazon.SAA-C03.v2026-07-25.q425; 139SAP.C_S4PM.v2026-07-25.q43; 265Google.Professional-Data-Engineer.v2026-07-25.q215; 239Microsoft.AZ-104.v2026-07-25.q227; 222Amazon.DOP-C02.v2026-07-25.q201; 154EMC.NCP-AII.v2026-07-25.q60; 170CheckPoint.156-561.v2026-07-25.q83; 231Amazon.AIF-C01.v2026-07-24.q158; 164WGU.Applied-Algebra.v2026-07-24.q46; 161Oracle.1Z0-948.v2026-07-24.q60

DOP-C02 Exam Question 71

DOP-C02 Exam Question 72

DOP-C02 Exam Question 73

DOP-C02 Exam Question 74

DOP-C02 Exam Question 75

Download PDF File