AWS Certified DevOps Engineer Professional DOP-C02 practice test

A company uses AWS CodePipeline with a multi-branch strategy. A new feature branch triggers a pipeline that runs unit tests and deploys to a test environment. The deployment step uses AWS CodeDeploy with a deployment group configured for in-place deployment to Amazon EC2 instances. The deployment fails intermittently with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The instances are healthy and pass health checks. What is the most likely cause?

Trap 1: The pipeline has a failed execution that is blocking subsequent…

CodePipeline allows concurrent executions unless specifically configured to block.

Trap 2: The CodeDeploy agent on the instances is not running, causing the…

If the agent were not running, instances would fail health checks and show specific errors.

Trap 3: The pipeline is configured with a high frequency of changes,…

CodePipeline throttles are rare and would produce a different error.

A
The pipeline has a failed execution that is blocking subsequent executions.
Why wrong: CodePipeline allows concurrent executions unless specifically configured to block.
B
The CodeDeploy agent on the instances is not running, causing the deployment to fail.
Why wrong: If the agent were not running, instances would fail health checks and show specific errors.
C
The pipeline is configured with a high frequency of changes, causing throttling from CodePipeline.
Why wrong: CodePipeline throttles are rare and would produce a different error.
D
A previous deployment is still in progress or frozen in the CodeDeploy deployment group.
CodeDeploy limits concurrent deployments per deployment group; a frozen deployment prevents new ones.

Question 2easymultiple choice

A development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?

Trap 1: Move the build process to a local developer machine to avoid…

Local builds are not a scalable or consistent solution.

Trap 2: Reduce the number of unit tests executed in the build phase.

This compromises quality and may not be acceptable.

Trap 3: Increase the compute type of the build environment to a larger…

While faster compute helps, it does not address the dependency download overhead.

A
Configure CodeBuild to cache dependencies in an Amazon S3 bucket.
Caching avoids re-fetching dependencies every build.
B
Move the build process to a local developer machine to avoid CodeBuild overhead.
Why wrong: Local builds are not a scalable or consistent solution.
C
Reduce the number of unit tests executed in the build phase.
Why wrong: This compromises quality and may not be acceptable.
D
Increase the compute type of the build environment to a larger instance.
Why wrong: While faster compute helps, it does not address the dependency download overhead.

Question 3hardmultiple choice

A company uses AWS CodePipeline with multiple stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The build stage runs a series of tests, and if they pass, the pipeline proceeds to deploy. Recently, a developer committed a change that passed all tests but caused a production outage. The team wants to add an approval step before the deploy stage, but they also want to ensure that only changes from specific branches can be deployed. What is the MOST secure and maintainable way to enforce this?

Trap 1: Use a Lambda function in the pipeline to check the branch name and…

The Lambda function can be modified by anyone with pipeline edit permissions.

Trap 2: Add a manual approval step in the pipeline and rely on the approver…

Manual approval does not prevent a developer from approving their own change.

Trap 3: Tag the source artifacts with the branch name and use a condition…

CodePipeline does not support conditions on artifact tags.

A
Use a Lambda function in the pipeline to check the branch name and fail if not allowed.
Why wrong: The Lambda function can be modified by anyone with pipeline edit permissions.
B
Add a manual approval step in the pipeline and rely on the approver to verify the branch.
Why wrong: Manual approval does not prevent a developer from approving their own change.
C
Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.
Isolating pipelines prevents direct deployment from unauthorized branches.
D
Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.
Why wrong: CodePipeline does not support conditions on artifact tags.

Question 4mediummultiple choice

A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled JARs) to the repository, causing the repository size to grow rapidly and slowing down clone operations. The team wants to enforce a policy to reject pushes that contain files larger than 50 MB. Which approach should be used?

Trap 1: Set up an Amazon CloudWatch Events rule to monitor repository size…

This is reactive, not preventive.

Trap 2: Create an IAM policy that denies the `codecommit:GitPush` action if…

IAM policies cannot evaluate file sizes.

Trap 3: Use a pre-receive hook in the repository to reject large files by…

Pre-receive hooks are not natively supported in CodeCommit.

A
Configure a CodeCommit trigger that invokes an AWS Lambda function to validate file sizes and reject the push.
CodeCommit triggers allow custom validation before accepting a push.
B
Set up an Amazon CloudWatch Events rule to monitor repository size and alert when it exceeds a threshold.
Why wrong: This is reactive, not preventive.
C
Create an IAM policy that denies the `codecommit:GitPush` action if the file size exceeds 50 MB.
Why wrong: IAM policies cannot evaluate file sizes.
D
Use a pre-receive hook in the repository to reject large files by generating an S3 pre-signed URL.
Why wrong: Pre-receive hooks are not natively supported in CodeCommit.

Question 5hardmultiple choice

An organization uses AWS CodePipeline to orchestrate deployments to multiple environments (dev, test, prod). Each environment uses a different AWS account. The pipeline uses cross-account actions with IAM roles. Recently, the pipeline failed at the deploy stage for the prod account with the error 'Access Denied' when assuming the cross-account role. The role ARN is correct and the trust policy allows the pipeline's service role. What is the MOST likely cause?

Trap 1: The EC2 instances in the prod account do not have an appropriate…

The pipeline does not run on EC2 instances.

Trap 2: The cross-account role's permissions boundary denies the deploy…

Permissions boundary affects what the role can do after assuming it, not the assumption itself.

Trap 3: The pipeline's service role does not have permission to perform the…

The error occurs when assuming the role, not during the deploy action itself.

A
The EC2 instances in the prod account do not have an appropriate instance profile.
Why wrong: The pipeline does not run on EC2 instances.
B
The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.
The service role needs explicit permission to assume the cross-account role.
C
The cross-account role's permissions boundary denies the deploy action.
Why wrong: Permissions boundary affects what the role can do after assuming it, not the assumption itself.
D
The pipeline's service role does not have permission to perform the deploy action in the prod account.
Why wrong: The error occurs when assuming the role, not during the deploy action itself.

Question 6mediummultiple choice

A company uses AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific attribute in their SAML assertion can decrypt the data. Which KMS key policy should be used?

Trap 1: Create an S3 bucket policy that denies kms:Decrypt unless the…

S3 bucket policies cannot deny KMS actions.

Trap 2: Attach a resource-based policy to the S3 bucket that allows…

S3 bucket policies do not control KMS decryption permissions.

Trap 3: Use an IAM policy that grants kms:Decrypt only if the user has the…

IAM policies cannot evaluate SAML attributes directly; KMS key policies can.

A
Create an S3 bucket policy that denies kms:Decrypt unless the request includes a specific tag.
Why wrong: S3 bucket policies cannot deny KMS actions.
B
Modify the KMS key policy to include a condition that allows kms:Decrypt only if the SAML assertion contains the specific attribute.
KMS key policies can use conditions based on SAML attributes to control decryption.
C
Attach a resource-based policy to the S3 bucket that allows decryption only for users with the specific attribute.
Why wrong: S3 bucket policies do not control KMS decryption permissions.
D
Use an IAM policy that grants kms:Decrypt only if the user has the specific attribute.
Why wrong: IAM policies cannot evaluate SAML attributes directly; KMS key policies can.