Resilient Cloud Solutions — AWS Certified DevOps Engineer DOP-C02 practice questions

Which AWS service is BEST for chaos engineering experiments to validate resilience?

1. AWS Fault Injection Service (FIS, formerly Fault Injection
2. It only functions when all resources are in a single AZ zone
3. It writes findings to S3 only and cannot notify EventBridge
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: A — AWS Fault Injection Service (FIS, formerly Fault Injection

FIS: managed chaos engineering. Pre-built actions (stop instances, throttle, latency, etc.). Stop conditions for safety. Validates resilience assumptions in production-like environments. Modern DOP topic added to DOP-C02.

A team wants RTO of 5 minutes and RPO of 1 minute for a transactional Postgres workload across two regions. Which architecture is BEST?

1. Standard RDS Multi-AZ within a single region with automated backups
2. Aurora Global Database with managed cross-region replication (typically sub-second replica lag) and managed failover for fast RTO
3. Nightly cross-region snapshot copies with manual restore on failure
4. A read replica in a second region promoted manually after an outage is confirmed

Answer: B — Aurora Global Database with managed cross-region replication (typically sub-second replica lag) and managed failover for fast RTO

Aurora Global Database provides sub-second RPO and managed RTO. B is slower. C misses RPO. D is single-region.

A team's ASG mixes Spot and On-Demand instances using allocation strategy capacity-optimized. During a Spot reclaim, requests drop because in-flight requests don't drain. Which BEST mitigates?

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. It runs exclusively on Fargate and cannot target EC2 fleets
4. Enable Capacity Rebalance on the ASG so EC2 proactively replaces

Answer: D — Enable Capacity Rebalance on the ASG so EC2 proactively replaces

Capacity Rebalance + drain lifecycle hook is the documented Spot resilience pattern. B is expensive. C unsafe. D doesn't solve reclaim.

PREDICTIVE SCALING (ASG):

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. Uses ML to FORECAST capacity needs based on historical patterns
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: C — Uses ML to FORECAST capacity needs based on historical patterns

Predictive scaling: ML-based proactive scaling. Analyzes 14+ days of metrics. Generates daily forecast. Works alongside dynamic scaling (target tracking) as additional layer. Best for cyclical/predictable workloads (e-commerce, content sites). DOP advanced scaling.

AWS APP MESH for service mesh:

1. It only functions when all resources are in a single AZ zone
2. It writes findings to S3 only and cannot notify EventBridge
3. It runs exclusively on Fargate and cannot target EC2 fleets
4. Managed SERVICE MESH (control plane) within the DevOps workflow

Answer: D — Managed SERVICE MESH (control plane) within the DevOps workflow

App Mesh: AWS service mesh. mTLS via ACM. Traffic management: blue/green, canary at mesh level. Observability: X-Ray + CloudWatch + Prometheus. Limited compared to Istio + Linkerd in EKS. Often EKS uses Istio directly. DOP networking + microservices.

A team validates an in-place upgrade procedure with chaos testing. They want to inject API throttling to RDS for 5 minutes during peak. Which AWS service is the RIGHT primitive?

1. It only functions when all resources are in a single AZ zone
2. AWS Fault Injection Service with the aws:rds:reboot-db-instances
3. It writes findings to S3 only and cannot notify EventBridge
4. It runs exclusively on Fargate and cannot target EC2 fleets

Answer: B — AWS Fault Injection Service with the aws:rds:reboot-db-instances

FIS is the AWS chaos engineering service. C/B/D aren't injection primitives.

An EKS workload needs to survive an AZ outage. Which combination BEST achieves this?

1. A single node group in one Availability Zone with more nodes
2. A node group spread across 3 AZs combined with pod topology spread constraints and an ALB targeting healthy pods in all AZs
3. Fargate-only pods with no consideration of AZ placement
4. A cluster autoscaler configured to add capacity only after an AZ fails

Answer: B — A node group spread across 3 AZs combined with pod topology spread constraints and an ALB targeting healthy pods in all AZs

EKS resilience is multi-AZ at node, pod-scheduling, and LB layers. B/C/D defeat the goal.

An RDS Multi-AZ deployment fails over during an instance issue. Reads to the primary endpoint take ~60 seconds to recover. The app uses a connection pool with cached DNS. What is the BEST mitigation?

1. Increase the RDS instance size so failover completes faster
2. Disable Multi-AZ and rely on manual failover instead
3. Move the database to a single AZ with no failover at all
4. Reduce the DNS TTL in the application's resolver and use RDS Proxy, which maintains a stable endpoint and manages connections across the failover

Answer: D — Reduce the DNS TTL in the application's resolver and use RDS Proxy, which maintains a stable endpoint and manages connections across the failover

Multi-AZ failover swaps DNS; clients with cached DNS keep the old IP. RDS Proxy + short TTLs handle this. B reduces resilience. C is overkill. D doesn't exist.

A team uses cross-region S3 replication for DR. They notice that newly created objects replicate but DELETE markers don't, leading to stale objects in the DR bucket. Which setting CORRECTS this?

1. It works only for Windows Server instances in one region
2. It emits events only to Amazon SNS and never EventBridge
3. It requires manual approval on every deployment attempt
4. Enable delete marker replication in the replication rule

Answer: D — Enable delete marker replication in the replication rule

Delete marker replication is opt-in in the replication rule. B breaks replication. C/D unrelated.

Backup strategy automation?

AWS Backup with backup plans. Cross-region copy for DR.

Lambda Provisioned Concurrency?

Pre-warmed instances. Avoid cold starts. Billed even when idle.

Cross-region failover automation?

Route 53 health checks + DNS failover. Or Global Accelerator.

ASG warm pools?

Pre-initialized instances waiting. Faster scale-up.