DOP-C02 Practice Test 12 — 15 Questions

Question 1

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service can be used to achieve this?

Accepted Answer

Use AWS Config with a custom Lambda function to rotate keys when they are older than 90 days.. AWS IAM does not have a built-in automatic rotation feature for access keys. AWS Secrets Manager can store secrets and rotate them, but it does not natively rotate IAM access keys; it supports rotation for RDS, Redshift, and DocumentDB, but not IAM. AWS CloudTrail is a logging service and cannot rotate keys. However, AWS Config can be used with a custom AWS Lambda function to create a rule that triggers rotation when access keys are older than 90 days. Therefore, option D is the correct answer.

Answer

Store the access keys in AWS Secrets Manager and enable automatic rotation.

Answer

Use AWS CloudTrail to detect old keys and send notifications to administrators.

Answer

Use IAM's built-in access key rotation feature.

Question 2

A company runs a critical application on Amazon ECS with Fargate. The application emits structured logs in JSON format. The DevOps team wants to monitor for specific error codes and receive near-real-time alerts. The team also needs to retain logs for 5 years for compliance. Which TWO steps should the team implement?

Accepted Answer

Create a CloudWatch Logs metric filter to count occurrences of specific error codes and create an alarm. CloudWatch Logs metric filters can parse JSON-structured logs to count occurrences of specific error codes, and you can create a CloudWatch alarm on that metric to trigger near-real-time notifications via SNS. This is a native, low-latency solution for monitoring specific patterns in ECS Fargate logs without additional infrastructure.

Answer

Use Amazon Kinesis Data Analytics to analyze logs in real-time and send alerts

Answer

Enable AWS CloudTrail to log the application's API calls

Answer

Stream logs to Amazon S3 via Amazon Kinesis Data Firehose and use S3 event notifications to trigger alerts

Question 3

A company uses AWS CloudFormation to provision infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the stack to change the DB instance class from db.t2.micro to db.t3.medium. Which THREE of the following must be true for the update to succeed? (Choose three.)

Accepted Answer

The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.. CloudFormation stacks in a terminal failure state like ROLLBACK_COMPLETE cannot be updated; they must be deleted and recreated. This is a fundamental constraint of the CloudFormation service, as the stack is considered non-functional and unable to process further operations.

Answer

Deletion protection must be disabled on the DB instance.

Answer

A change set must be created and executed for the update.

Question 4

A DevOps team is investigating a performance issue where an application's response time spiked during a deployment. The deployment used AWS CodeDeploy to update an Auto Scaling group. Which THREE actions should the team take to identify the root cause? (Choose THREE.)

Accepted Answer

Review the CodeDeploy deployment logs for errors.. CodeDeploy deployment logs contain detailed information about the deployment process, including any errors or failed steps that could impact performance. Option B is correct because application logs on the new EC2 instances can reveal errors, misconfigurations, or resource contention that may have caused the spike. Option E is correct because comparing CloudWatch metrics (e.g., CPU utilization, latency, request count) before and after the deployment helps pinpoint changes that correlate with the performance issue. Option C is wrong because reviewing the deployment group configuration—which defines how deployments occur (e.g., traffic routing, instance selection)—is unlikely to directly identify the root cause of a performance spike; it is more relevant for deployment strategy issues. Option D is wrong because AWS CloudTrail records API calls for auditing and security, not application performance; unauthorized API calls are unlikely to cause a transient performance spike during deployment.

Answer

Review the CodeDeploy deployment group configuration.

Answer

Check AWS CloudTrail for any unauthorized API calls during the deployment.

Question 5

A company's DevOps team is designing a disaster recovery plan for a critical application. The application runs on EC2 instances with an RDS MySQL database. The Recovery Time Objective (RTO) is 15 minutes, and the Recovery Point Objective (RPO) is 1 hour. Which approach BEST meets these requirements?

Accepted Answer

Use a multi-Region application with Route 53 latency-based routing and RDS read replicas in the DR Region.. The best approach for a multi-Region disaster recovery with RTO of 15 minutes and RPO of 1 hour. By deploying the application in multiple regions and using RDS cross-Region read replicas, data is asynchronously replicated with an RPO typically within seconds to minutes, well within 1 hour. In the event of a failure, the read replica can be promoted to a primary instance, and Route 53 routing (preferably failover routing, but latency-based routing can also redirect traffic) can shift traffic to the DR region. This failover can be completed within a few minutes, meeting the 15-minute RTO. Option A fails because daily snapshots exceed the 1-hour RPO and restore times exceed the RTO. Option C incorrectly relies on RDS Multi-AZ, which is a single-region high-availability feature and does not provide cross-region replication; thus it cannot serve as a disaster recovery solution across regions. Option D, pilot light with snapshots, has a longer RTO as it requires restoring instances from snapshots and starting them, likely exceeding 15 minutes.

Answer

Use backup and restore with daily snapshots stored in S3 and cross-Region replication.

Answer

Use a warm standby strategy with a scaled-down copy of the production environment in the DR Region, and replicate data using RDS Multi-AZ with synchronous replication.

Answer

Use a pilot light strategy with EC2 instances stopped and RDS snapshots copied to the DR Region.

Question 6

A company wants to ensure its data in Amazon S3 is protected against accidental deletion. The bucket stores critical documents. Which approach provides the HIGHEST level of resilience?

Accepted Answer

Enable versioning and MFA delete on the bucket.. Enabling versioning and MFA delete provides protection against both accidental overwrites and malicious deletions. Versioning allows recovery of deleted or overwritten objects, while MFA delete adds an extra layer of security by requiring multi-factor authentication for permanent deletions. Option A is incorrect because a bucket policy that denies s3:DeleteObject can prevent deletions but does not allow recovery if the policy is bypassed or changed. Option B is incorrect because lifecycle policies archive objects to Glacier, which reduces costs but does not prevent or recover from accidental deletion. Option D is incorrect because cross-region replication protects against regional failures but does not protect against accidental deletion within the source bucket.

Answer

Apply a bucket policy that denies s3:DeleteObject for all users.

Answer

Enable S3 lifecycle policies to archive objects to Glacier.

Answer

Configure cross-region replication (CRR) to another bucket.

Question 7

Which TWO approaches can be used to automatically roll back a failed deployment in AWS CodeDeploy? (Choose two.)

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails. AWS CodeDeploy allows you to configure a deployment group to automatically roll back a deployment when it fails. This is a native feature that can be enabled in the deployment group settings, ensuring that if a deployment fails (e.g., due to health check failures or script errors), CodeDeploy automatically reverts to the last known good revision without manual intervention.

Answer

Use a CloudWatch Events rule to trigger a rollback when a deployment fails

Answer

Attach an IAM policy to the CodeDeploy service role that allows rollback actions

Answer

Specify a rollback revision in the AppSpec file

Question 8

Refer to the exhibit. A DevOps engineer is troubleshooting an issue where an IAM user is unable to stop an EC2 instance with the tag 'Environment: Development'. The attached IAM policy is shown. Which statement explains the failure?

Accepted Answer

The Allow statement only grants ec2:DescribeInstances, not start/stop.. The IAM policy in the exhibit only grants ec2:DescribeInstances and explicitly denies ec2:RunInstances with a condition. It does not include an Allow for ec2:StopInstances. By default, IAM denies any action that is not explicitly allowed. Therefore, the user lacks permission to stop instances, including the Development-tagged instance. Option C correctly identifies this as the reason for the failure. Option D is incorrect because the policy itself denies stop implicitly due to the missing Allow; it is not necessary to invoke another policy or SCP.

Answer

The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.

Answer

The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.

Answer

The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.

Question 9

A company uses AWS CodePipeline with a GitHub source action. The pipeline is configured to trigger on changes to the main branch. After a recent commit, the pipeline did not trigger. The DevOps engineer verified that the webhook is configured correctly and the IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The GitHub personal access token used for authentication has expired.. The most likely cause is that the GitHub personal access token used for authentication has expired. CodePipeline uses this token to authenticate with GitHub and trigger the webhook; when the token expires, GitHub rejects the webhook call, preventing the pipeline from starting even though the webhook configuration and IAM permissions are correct.

Answer

The pipeline is set to manual execution only.

Answer

The source action's branch filter is set to a different branch.

Answer

The GitHub webhook endpoint URL is incorrect.

Question 10

Which THREE considerations are important when designing a CI/CD pipeline for a microservices architecture using AWS CodePipeline? (Choose three.)

Accepted Answer

Include automated integration tests that validate service-to-service interactions.. In a microservices architecture, automated integration tests are essential to validate that service-to-service interactions (e.g., API calls, event-driven communication) work correctly after changes. AWS CodePipeline can run these tests in a dedicated stage using AWS CodeBuild or third-party tools, catching integration failures before deployment to production.

Answer

All microservices should be deployed using a single pipeline to ensure consistency.

Answer

Use manual approval gates at every stage to ensure quality.

Question 11

Refer to the exhibit. A CloudFormation stack has been deployed. A developer wants to use the S3 bucket name in a subsequent AWS CLI command. Which command will correctly retrieve the bucket name?

Accepted Answer

aws cloudformation describe-stacks --stack-name my-stack --query "Stacks[0].Outputs[?OutputKey=='BucketName'].OutputValue" --output text. The developer can use the --query parameter with the describe-stacks command to extract the OutputValue for the specific OutputKey 'BucketName'. Option C uses the correct JMESPath syntax with the filter [?OutputKey=='BucketName'] to select the matching output and then retrieves its OutputValue. Option A attempts to list all S3 buckets and grep for 'my-stack', which is unreliable and not the intended method. Option B uses describe-stack-resources but incorrectly assumes the bucket name is a physical resource ID when it is actually an output value. Option D uses incorrect JMESPath syntax (single bracket with equality) which is invalid.

Answer

aws s3 ls | grep my-stack

Answer

aws cloudformation describe-stack-resources --stack-name my-stack --logical-resource-id BucketName --query "StackResources[0].PhysicalResourceId" --output text

Answer

aws cloudformation describe-stacks --stack-name my-stack --query "Stacks[0].Outputs[OutputKey='BucketName'].OutputValue" --output text

Question 12

A DevOps engineer needs to automate the creation of a new AWS CodeCommit repository when a new project starts. The engineer wants to use infrastructure as code. Which service should be used?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define and provision AWS infrastructure as code using templates. You can declare an AWS::CodeCommit::Repository resource in a CloudFormation template, which will automatically create the CodeCommit repository when the stack is created, enabling fully automated and repeatable infrastructure deployment.

Answer

AWS CodePipeline

Answer

AWS CodeStar

Answer

AWS CodeBuild

Question 13

Refer to the exhibit. A developer is using this buildspec.yml in AWS CodeBuild to build and push a Docker image to Amazon ECR. The build fails with the error: 'Error: No region specified'. Which change should the developer make to resolve this error?

Accepted Answer

Set the AWS_DEFAULT_REGION environment variable in the CodeBuild project's environment configuration.. The error occurs because the $AWS_DEFAULT_REGION environment variable is not set in the CodeBuild project. The developer must explicitly set the AWS_DEFAULT_REGION environment variable in the CodeBuild project configuration.

Answer

Add a pre_build command to export AWS_DEFAULT_REGION using the AWS CLI.

Answer

Replace $AWS_DEFAULT_REGION with a hardcoded region like us-east-1.

Answer

Use the AWS_REGION environment variable instead of AWS_DEFAULT_REGION in the buildspec.

Question 14

Which TWO AWS services can be used to manage secrets and database credentials securely? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for securely storing, rotating, and managing secrets such as database credentials, API keys, and other sensitive data. It provides built-in integration with Amazon RDS, Redshift, and DocumentDB to automatically rotate credentials on a schedule, eliminating the need for manual updates. This makes it a correct choice for the question's requirement to manage secrets and database credentials securely.

Answer

AWS CloudFormation

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Question 15

An application running on EC2 needs to access an S3 bucket. To follow the principle of least privilege, what is the recommended approach?

Accepted Answer

Create an IAM role with a policy allowing only necessary S3 actions and attach it to the EC2 instance. The best practice is to create an IAM role with a policy that grants only the required S3 actions and attach the role to the EC2 instance. This avoids using long-term credentials. Access keys are long-term and insecure. Bucket policy can be used but is not the most secure for instance access. Security group is for network access, not API access.

Answer

Store AWS access keys in the application configuration

Answer

Use an S3 bucket policy to allow access from the EC2 instance's public IP

Answer

Configure the EC2 security group to allow outbound access to S3