DOP-C02 Practice Test 13 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM roles in member accounts have a maximum session duration of 1 hour. They need a way to detect any roles that violate this policy. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config with the managed rule iam-role-max-session-duration to evaluate roles.. AWS Config provides a managed rule called `iam-role-max-session-duration` that specifically evaluates IAM roles to ensure their `MaxSessionDuration` setting does not exceed a specified threshold (default 1 hour). This rule can be deployed across all member accounts in AWS Organizations using a conformance pack or AWS Config aggregator, allowing the security team to continuously detect and report any roles that violate the policy without manual intervention.

Answer

Use IAM Access Analyzer to validate the roles against a policy template.

Answer

Run AWS Trusted Advisor and check the IAM report for roles with long session durations.

Answer

Enable AWS CloudTrail and create a metric filter to detect role creation with session duration greater than 1 hour.

Question 2

An organization is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target group is not configured correctly. Which CodeDeploy component is responsible for registering instances with the load balancer?

Accepted Answer

The deployment group configuration. The deployment group configuration in AWS CodeDeploy specifies the target group or load balancer for the deployment. CodeDeploy automatically registers instances in the Auto Scaling group with the specified target group as part of the deployment process. The AppSpec file hooks section defines custom lifecycle event hooks for scripts, but instance registration is handled by the CodeDeploy service based on the deployment group settings, not by hooks.

Answer

The CodeDeploy agent configuration

Answer

The AppSpec file hooks section

Answer

The application revision bundle

Question 3

Refer to the exhibit. A DevOps engineer deploys this CloudFormation template. The EC2 instance launches, but the httpd service does not start. The engineer connects to the instance and finds that the user data script did not run. What is the most likely cause?

Accepted Answer

The AMI does not have yum installed. The most likely cause is that the AMI does not have yum installed. The CloudFormation template's UserData script uses yum to install httpd, but if the AMI is based on a distribution that does not use yum (e.g., Amazon Linux 2023 uses dnf, or Ubuntu uses apt), the script will fail silently or not execute as intended. Since the script itself is valid and the instance launched, the failure is due to the package manager not being available, preventing the httpd service from starting.

Answer

The UserData is not base64 encoded correctly

Answer

The tags prevent user data from executing

Answer

The AMI uses a different init system than systemd

Question 4

A team uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests against a staging environment. Occasionally, the tests fail due to environment issues, not code issues. The team wants to automatically retry the Test stage up to two times if it fails, but not the Deploy stage. How can this be achieved?

Accepted Answer

Create a CloudWatch Events rule that triggers a Lambda function to retry the failed stage.. The correct approach is to use Amazon EventBridge (formerly CloudWatch Events) to detect a stage failure in CodePipeline and trigger an AWS Lambda function that calls the RetryStageExecution API. This provides automatic retries without manual intervention. CodePipeline's built-in retry setting on a stage action is not automatic; it only allows manual retries via the console or API. Option D (Step Functions) is a valid alternative but adds unnecessary complexity for this use case.

Answer

Configure the Retry setting in the Test stage's action configuration.

Answer

Enable the 'Retry on failure' option in the CodePipeline pipeline settings.

Answer

Use AWS Step Functions to orchestrate the pipeline and implement retries.

Question 5

A DevOps team is implementing a blue/green deployment strategy for a microservice running on Amazon ECS with AWS CodeDeploy. They want to shift 10% of traffic to the new task set for 5 minutes, then shift the remaining 90%. Which deployment configuration should they use?

Accepted Answer

CodeDeployDefault.ECSCanary10Percent5Minutes. The built-in configuration `CodeDeployDefault.ECSCanary10Percent5Minutes` shifts 10% of traffic to the new task set, holds for 5 minutes, then shifts the remaining 90%. This matches the requirement exactly. A custom configuration (D) is unnecessary and not a standard deployment configuration.

Answer

CodeDeployDefault.ECSAllAtOnce

Answer

CodeDeployDefault.ECSLinear10PercentEvery1Minutes

Answer

Custom configuration with 10% initial traffic and 100% after 5-minute interval

Question 6

A development team uses AWS CodeCommit to store source code and AWS CodePipeline to automate builds and deployments. The team wants to ensure that every commit to the main branch triggers a build and deployment to a test environment. Which action should be taken?

Accepted Answer

Configure the source stage of the CodePipeline to use the CodeCommit repository and specify the main branch.. CodePipeline natively integrates with CodeCommit as a source action. By configuring the source stage to use the CodeCommit repository and specifying the main branch, the pipeline automatically triggers on every commit to that branch without any additional infrastructure or polling. This is the simplest and most reliable approach, as CodePipeline uses Amazon CloudWatch Events under the hood to detect changes.

Answer

Create a CodeBuild project that watches the main branch and starts a pipeline.

Answer

Use AWS Lambda to poll the repository and start the pipeline on new commits.

Answer

Set up an Amazon CloudWatch Events rule that matches commits to the main branch and targets the CodePipeline.

Question 7

A company uses AWS CodeBuild to run integration tests as part of a pipeline. The tests require access to an Amazon RDS database. The RDS instance is in a private subnet with no public access. The CodeBuild project is configured with a VPC. Which additional configuration is necessary to ensure the build can connect to the database?

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic from the security group associated with the CodeBuild project.. The CodeBuild project is configured with a VPC, meaning it runs inside a private subnet and uses an elastic network interface (ENI) with an associated security group. To allow the build container to connect to the RDS instance, the RDS security group must have an inbound rule that permits traffic on port 3306 (or the appropriate database port) from the CodeBuild security group. This is a standard network-layer access control; no additional IAM or gateway is required for connectivity.

Answer

Add an IAM policy that grants the CodeBuild service role access to the RDS instance.

Answer

Create a VPC endpoint for Amazon RDS.

Answer

Attach a NAT gateway to the private subnet.

Question 8

Your company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances running a web server. The web servers write access logs to a shared Amazon EFS filesystem. The operations team needs to monitor the web server logs in real-time to detect and alert on 5xx error spikes. Currently, the team manually SSHes into instances to tail logs, which is inefficient and doesn't provide real-time alerting. The team wants a centralized, near-real-time logging solution with minimal operational overhead. They have asked you to design a solution that ingests logs from the EFS filesystem into a centralized log analytics platform. Which solution would you recommend?

Accepted Answer

Install and configure the Amazon CloudWatch Logs agent on each EC2 instance to tail the log files from the EFS mount and send them to CloudWatch Logs. Create a metric filter and alarm for 5xx errors.. Installing the CloudWatch Logs agent on each EC2 instance allows it to tail the log files from the shared EFS mount point and stream them to CloudWatch Logs in near real-time. This provides centralized log ingestion with minimal operational overhead, and you can create a metric filter and alarm to detect and alert on 5xx error spikes without manual SSH access.

Answer

Enable AWS CloudTrail data events for the EC2 instances to capture log file modifications.

Answer

Configure an Amazon EventBridge scheduled rule to invoke an AWS Lambda function that reads new log lines from EFS and publishes them to Amazon CloudWatch Logs.

Answer

Stream the log files to Amazon Kinesis Data Streams using a custom producer, then use a Lambda function to analyze and alert on 5xx errors.

Question 9

A company runs a web application behind an Application Load Balancer (ALB) in a production AWS account. The DevOps team needs to analyze HTTP request patterns and identify the top IP addresses generating errors. They want to store the data cost-effectively for querying with SQL. Which solution meets these requirements?

Accepted Answer

Enable ALB access logs and store them in Amazon S3, then use Amazon Athena to query the logs with SQL.. ALB access logs provide detailed HTTP request data (including source IP, request URI, response code, etc.) and are stored in Amazon S3, which is cost-effective for long-term storage. Amazon Athena allows querying these logs directly with standard SQL without needing to load data into a database, meeting the requirement for SQL-based analysis of top IP addresses generating errors.

Answer

Use CloudWatch Metrics to monitor error rates and top IPs via custom metrics.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query the logs.

Answer

Stream the ALB logs to Amazon Kinesis Data Analytics and use SQL applications.

Question 10

A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?

Accepted Answer

Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.. Attaching an IAM role to the EC2 instance and using the instance profile allows the application to obtain temporary credentials from the EC2 instance metadata service (IMDS). These credentials are automatically rotated by AWS before they expire, and they are never stored on disk—they are fetched on-demand from the metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). This satisfies both the requirement for automatic rotation and the prohibition against disk storage.

Answer

Store the credentials in AWS Secrets Manager and retrieve them at application startup.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and retrieve them using the EC2 instance's IAM role.

Answer

Generate an access key and secret key for an IAM user and store them in a configuration file on the EC2 instance.

Question 11

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration uses a linear traffic shifting with a 10-minute interval. The application logs show that the new version of the application crashes on startup. What is the MOST effective way to handle this situation to ensure successful future deployments?

Accepted Answer

Add a script in the AppSpec file's 'Validate Service' lifecycle hook to check the application health and fail the deployment if the application does not start successfully.. The 'Validate Service' lifecycle hook in the AppSpec file runs after the application is installed and started, allowing you to execute a custom script that verifies the application is healthy. If the script detects that the new version crashes on startup, it can return a non-zero exit code, which causes CodeDeploy to mark that instance as failed and trigger the deployment failure. This provides an early, automated validation that prevents the deployment from proceeding with a broken application, directly addressing the root cause of the crash.

Answer

Increase the interval in the linear traffic shifting to 30 minutes to allow more time for instances to stabilize.

Answer

Configure the deployment to automatically roll back when a failure occurs and ignore the error.

Answer

Switch to a blue/green deployment strategy to minimize the impact on existing instances.

Question 12

A DevOps engineer is reviewing the CodePipeline structure above. The pipeline fails during the Deploy stage with an error: 'The deployment group could not be found.' What is the most likely cause?

Accepted Answer

The pipeline is configured as a single-region pipeline, but the Deploy action is in a different region.. The error 'The deployment group could not be found' indicates that CodePipeline is attempting to invoke a CodeDeploy deployment in a region where the specified deployment group does not exist. If the pipeline is configured as a single-region pipeline (e.g., in us-east-1) but the Deploy action references a deployment group in a different region (e.g., us-west-2), CodePipeline will fail because it cannot resolve the deployment group across regions in a single-region pipeline configuration. Cross-region actions require explicit cross-region action configuration in the pipeline structure.

Answer

The source artifact is not accessible from us-west-2.

Answer

The CodeDeploy application does not exist in us-west-2.

Answer

The CodeBuild project is not configured to output artifacts.

Question 13

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The pipeline has a source stage that pulls from a CodeCommit repository, a build stage using AWS CodeBuild, and a deploy stage that uses AWS CodeDeploy to deploy to an EC2 Auto Scaling group. The team notices that the pipeline frequently fails at the deploy stage with the error 'The deployment failed because the deployment group's deployment configuration specifies a minimum healthy host count of 1, but 0 healthy hosts are available.' What is the MOST likely cause of this issue?

Accepted Answer

The CodeDeploy agent is not installed or is not running on the EC2 instances.. The error message indicates that the CodeDeploy deployment is failing because zero healthy hosts are available in the deployment group. The most common cause is that the CodeDeploy agent is not installed or not running on the EC2 instances, preventing them from reporting their health status to the CodeDeploy service. Without a healthy agent, the instances cannot execute the deployment lifecycle hooks, and CodeDeploy considers them unhealthy, leading to the failure.

Answer

The IAM role for CodePipeline does not have sufficient permissions to access the CodeCommit repository.

Answer

The build artifacts are not being stored in an S3 bucket.

Answer

The EC2 instances are not registered with a Classic Load Balancer.

Question 14

A company runs a stateless web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer. The operations team needs to ensure that the application remains available if one AZ fails. Which solution is MOST resilient?

Accepted Answer

Configure the Auto Scaling group to launch instances in three Availability Zones with a desired capacity of 3.. Distributing instances across three Availability Zones (AZs) with a desired capacity of 3 ensures that even if one AZ fails, the remaining two AZs still have at least 2 instances running, maintaining service capacity. The Application Load Balancer (ALB) automatically routes traffic away from the failed AZ, and the Auto Scaling group will replace lost instances in the healthy AZs, providing the highest resilience against a single-AZ failure.

Answer

Configure the Auto Scaling group to launch instances in a single Availability Zone with a desired capacity of 6.

Answer

Configure the Auto Scaling group to launch instances in two Availability Zones with a desired capacity of 4.

Answer

Configure the Auto Scaling group to launch instances in two Availability Zones with a desired capacity of 6, all in one AZ.

Question 15

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer to route traffic to the ECS service. Recently, the DevOps team noticed that the ECS service is failing to deploy new tasks during a rolling update. The CloudWatch Logs for the ECS service show that new tasks are failing to start because they cannot pull the container image from Amazon ECR. The error message indicates 'AccessDenied' when attempting to pull the image. The task execution role has the necessary permissions, and the image URI is correct. The VPC has a VPC endpoint for ECR configured. The security group for the tasks allows outbound traffic to the VPC endpoint. What is the MOST likely cause of the access denied error?

Accepted Answer

The VPC endpoint for ECR does not have 'Private DNS names enabled' selected.. For ECS tasks using Fargate to pull images from ECR via a VPC endpoint, the private DNS names must be enabled on the endpoint. If not enabled, the task's DNS resolution of the ECR repository URL returns a public IP, which may be blocked by security groups or route tables, causing an 'AccessDenied' error despite correct IAM permissions. Option A is incorrect because 'ecr:GetAuthorizationToken' is needed for authentication, but the error occurs after authentication (the task execution role has permissions). Option B is irrelevant as the ALB security group does not affect image pulling. Option D is incorrect because the task role is for application-level permissions, not for pulling images; that is handled by the task execution role.

Answer

The task execution role does not have the 'ecr:GetAuthorizationToken' permission.

Answer

The security group for the ALB does not allow inbound traffic to the ECS tasks.

Answer

The task role does not have the 'ecr:BatchGetImage' permission.