DOP-C02 Practice Test 13 — 15 Questions

Question 1

A company uses AWS CodeBuild to build and test code. They need to securely store sensitive parameters, such as database passwords, and inject them into the build process. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is the correct choice because it provides secure, hierarchical storage for configuration data and secrets, such as database passwords, and integrates natively with AWS CodeBuild via the `parameter-store` environment variable type. This allows you to reference parameters without hardcoding sensitive values, and you can optionally use secure string parameters encrypted with KMS for additional protection.

Answer

Storing them in the CodeBuild project environment variables

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Question 2

A DevOps engineer must ensure that all API calls in an AWS account are logged for compliance. The logs should be stored in an S3 bucket with server-side encryption enabled. Which two services should be used together to meet these requirements?

Accepted Answer

AWS CloudTrail and Amazon S3. AWS CloudTrail logs all API calls in the account and can deliver these logs to an S3 bucket, where server-side encryption (SSE) can be enabled for compliance. Option A (AWS CloudTrail and Amazon CloudWatch Logs) can capture API calls, but the requirement is to store logs in an S3 bucket with encryption, not CloudWatch Logs. Option C (Amazon VPC Flow Logs and Amazon S3) captures network traffic, not API calls. Option D (AWS Config and AWS CloudTrail) includes AWS Config, which tracks resource configuration changes, not API calls; CloudTrail alone suffices for API logging, but Config is not needed for this requirement.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs and Amazon S3

Answer

AWS Config and AWS CloudTrail

Question 3

A DevOps team uses AWS Lambda functions to process events from an SQS queue. The Lambda function occasionally fails due to transient errors, and the team wants to capture and analyze the full error details, including stack traces, for debugging. The errors are not always related to invocation failures (e.g., timeouts) but include exceptions thrown within the function code. Which approach will capture the MOST comprehensive error information?

Accepted Answer

Ensure the Lambda function code returns a meaningful error object (e.g., throws an exception) so that the error is logged in CloudWatch Logs with a stack trace.. When a Lambda function throws an exception or returns an error object, AWS Lambda automatically logs the error details, including the stack trace, to CloudWatch Logs. This captures the full error information necessary for debugging transient errors. Option A is incorrect because a Dead Letter Queue (DLQ) on SQS captures the failed messages themselves, not the error details or stack traces of the function execution. Option B is incorrect because CloudWatch Logs automatic invocation logging provides only basic information such as invocation time, duration, and status; it does not include the function's stack trace unless explicitly logged by the code. Option D is incorrect because AWS X-Ray provides tracing of requests and can show service maps and latency, but it does not necessarily capture the full stack trace of application-level exceptions; it focuses on request flow rather than detailed error logs.

Answer

Configure a DLQ on the SQS queue to capture failed messages and inspect them.

Answer

Enable CloudWatch Logs and rely on the automatic logging of invocation results.

Answer

Use AWS X-Ray to trace the function execution and analyze the traces.

Question 4

A company uses AWS CloudFormation to deploy a multi-tier application. The stack creation fails with a 'CREATE_FAILED' error for a resource. The engineer wants to troubleshoot the issue. Which TWO steps should the engineer take? (Choose TWO.)

Accepted Answer

Use the 'describe-stack-events' AWS CLI command to view the events.. The 'describe-stack-events' AWS CLI command retrieves all stack events, including the specific event for the failed resource. This event contains the 'ResourceStatusReason' field, which provides the detailed error message from CloudFormation explaining why the resource creation failed. Option C is correct because checking the 'ResourceStatusReason' field in the stack events directly reveals the underlying error. Option B is incorrect because CloudFormation does not automatically create a CloudWatch Logs log group for stack errors; resource-specific logs are only available if the resource itself writes to CloudWatch. During a stack creation failure, there may be no such logs to review. Option D is incorrect because deleting the stack would lose the event history and prevent effective troubleshooting. Option E is incorrect because 'describe-stacks' only returns stack outputs and status, not failure details.

Answer

Review the CloudWatch Logs log group for the stack to find detailed error logs.

Answer

Run 'delete-stack' to remove the failed stack and start over.

Answer

Use the 'describe-stacks' AWS CLI command to get the stack outputs.

Question 5

A security team wants to automatically detect and remediate S3 buckets that are publicly accessible across multiple AWS accounts. Which solution is MOST efficient and scalable? (Choose THREE.)

Accepted Answer

Apply a service control policy (SCP) to deny s3:PutBucketAcl that makes buckets public.. Options B, D, and E are correct. An SCP can centrally deny s3:PutBucketAcl actions that make buckets public, preventing public access across all accounts (B). AWS Config with the managed rule 's3-bucket-public-read-prohibited' can detect publicly accessible buckets across accounts when using an aggregator (D). CloudWatch Events (now Amazon EventBridge) can trigger a Lambda function to automatically remediate non-compliant buckets, such as applying a bucket policy or ACL change (E). Option A (Trusted Advisor) is per-account and only alerts, not remediates; Option C (manual review) is not scalable for multiple accounts.

Answer

Use AWS Trusted Advisor to check for open S3 buckets and send alerts.

Answer

Manually review each account's S3 bucket permissions weekly.

Question 6

A DevOps engineer needs to audit changes to IAM policies over the past 90 days. The engineer wants to see who made the change, what the change was, and when it occurred. Which AWS tool should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct choice because it records all API calls made to the AWS environment, including IAM policy changes, and stores them as events with details such as the identity of the caller (IAM user or role), the time of the request, and the request parameters. By querying CloudTrail logs over the past 90 days, the DevOps engineer can audit who made the change, what the change was (e.g., the specific IAM policy document modification), and when it occurred.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

IAM Access Analyzer

Question 7

A company runs a critical e-commerce application on AWS. They use AWS CodePipeline to manage deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy to an Auto Scaling group). Recently, a deployment caused a 5-minute outage because the new application version had a bug that caused the health checks to fail. The Auto Scaling group marked instances as unhealthy and replaced them, but during the replacement, traffic was routed to the remaining instances, which also failed health checks, causing a full outage. The company wants to implement a deployment strategy that prevents any traffic from being routed to unhealthy instances and automatically rolls back if the deployment fails. They also want to minimize deployment time and cost. Which solution should the DevOps team implement?

Accepted Answer

Use CodeDeploy blue/green deployment with automatic rollback enabled. The correct solution is to use a blue/green deployment with CodeDeploy and automatic rollback enabled. In a blue/green deployment, a new Auto Scaling group (green) is created alongside the existing one (blue). Traffic is shifted to the green group only after all health checks pass. If health checks fail, the deployment is automatically rolled back by terminating the green group, ensuring no traffic is routed to unhealthy instances. This prevents any outage. Option B (in-place deployment with rollback) updates instances in place, which can cause downtime if instances fail health checks, as the Auto Scaling group replaces them sequentially, potentially routing traffic to unhealthy instances. Option A (manual approval) slows down deployment and does not automate rollback based on health checks. Option D (increasing health check grace period) only delays detection of failures and does not prevent traffic from being routed to unhealthy instances.

Answer

Add a manual approval step in CodePipeline before deploy

Answer

Use CodeDeploy in-place deployment with automatic rollback enabled

Answer

Increase the health check grace period in the Auto Scaling group

Question 8

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires environment-specific configuration values (database URL, API keys) that must be stored securely and rotated automatically. The team uses AWS Secrets Manager. Which configuration management strategy should the team implement to securely inject secrets into the Elastic Beanstalk environment?

Accepted Answer

Use an Elastic Beanstalk platform hook script that retrieves secrets from Secrets Manager and sets them as environment variables.. Elastic Beanstalk platform hooks allow custom scripts to run during deployment, enabling retrieval of secrets from AWS Secrets Manager and setting them as environment variables before the application starts. This approach keeps secrets out of the environment configuration and supports automatic rotation by having the script fetch the latest secret value on each deployment.

Answer

Store the secrets in the Elastic Beanstalk environment configuration as plain text under 'aws:elasticbeanstalk:application:environment'.

Answer

Configure Secrets Manager to automatically push secrets to Elastic Beanstalk environment properties.

Answer

Use AWS CloudFormation dynamic references to inject secrets into the Elastic Beanstalk environment.

Question 9

A company has a multi-account AWS environment using AWS Organizations. They want to centrally manage user access to all accounts using single sign-on (SSO) and enforce multi-factor authentication (MFA). Which service should they use?

Accepted Answer

Use AWS IAM Identity Center (AWS SSO) to manage access and enforce MFA.. AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user access and permissions across all AWS accounts in an AWS Organization. It natively supports enforcing multi-factor authentication (MFA) through an identity source (e.g., the built-in identity store or an external IdP) and integrates directly with AWS Organizations to grant single sign-on access without needing to create IAM users in each account.

Answer

Use AWS Secrets Manager to store and rotate IAM user credentials.

Answer

Create IAM users in each account and share the credentials securely.

Answer

Use Amazon Cognito user pools with an identity broker.

Question 10

A company is using AWS CloudFormation to deploy infrastructure. They need to ensure that all resources created by CloudFormation are tagged with a 'CostCenter' tag. The tag must be applied automatically to all resources in the stack. What should they do?

Accepted Answer

Specify the tag in the CloudFormation stack's Tags parameter, which applies the tag to all resources in the stack.. CloudFormation allows you to specify stack-level tags in the Tags parameter when creating or updating a stack. These tags are automatically propagated to all resources that support tagging within the stack, ensuring consistent cost allocation without additional custom logic or post-creation remediation.

Answer

Use AWS Service Catalog to enforce tagging on all products.

Answer

Create an AWS Config rule to detect untagged resources and trigger auto-remediation.

Answer

Use a custom Lambda function as a CloudFormation hook to tag resources after creation.

Question 11

A DevOps engineer is setting up an AWS CodePipeline to deploy a web application to an EC2 instance using AWS CodeDeploy. The deployment group uses an in-place deployment configuration. The pipeline's deploy stage fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The engineer checks the CodeDeploy logs on the instance and finds that the 'BeforeInstall' lifecycle hook script is failing. The script attempts to download a package from an Amazon S3 bucket that is encrypted with SSE-KMS. What is the MOST likely cause of the failure?

Accepted Answer

The IAM role attached to the EC2 instance lacks the 'kms:Decrypt' permission for the AWS KMS key used to encrypt the S3 object.. The error occurs because the EC2 instance's IAM role lacks the `kms:Decrypt` permission for the AWS KMS key used to encrypt the S3 object. When the `BeforeInstall` script attempts to download the package, the AWS SDK or CLI on the instance must decrypt the object using the KMS key. Without this permission, the download fails, causing the lifecycle hook to fail and the overall deployment to abort due to too many failed instances.

Answer

The EC2 instance does not have internet access to reach the S3 bucket.

Answer

The S3 bucket name is misspelled in the 'BeforeInstall' script.

Answer

The CodeDeploy agent does not have permissions to read from the S3 bucket.

Question 12

A company is using AWS CodeDeploy with a blue/green deployment strategy for an Amazon ECS service. After a deployment, the new task set fails health checks, and CodeDeploy automatically rolls back to the original task set. However, the rollback fails because the original task set's desired count is set to 0. What is the most likely cause?

Accepted Answer

The original task set's desired count was set to 0 during the blue/green deployment and the rollback is unable to restore it because the original task definition is no longer available.. During a blue/green deployment on ECS, CodeDeploy sets the original (blue) task set's desired count to 0 after the new (green) task set is created and begins serving traffic. If the green task set fails health checks and triggers an automatic rollback, CodeDeploy attempts to restore the original task set's desired count to its previous value. However, if the original task definition has been deregistered or deleted (e.g., due to lifecycle policies or manual cleanup), the rollback cannot scale the original task set back up, causing the rollback to fail.

Answer

The original task set's health checks are failing.

Answer

The original task set's CloudFormation stack was deleted during the deployment.

Answer

The original task set was deregistered from the target group.

Question 13

A DevOps team is designing a disaster recovery solution for an Amazon RDS for MySQL database. The primary database is in us-east-1, and the recovery point objective (RPO) is 5 minutes, recovery time objective (RTO) is 1 hour. Which solution meets these requirements?

Accepted Answer

Create a cross-Region read replica in the secondary Region.. A cross-Region read replica in the secondary Region meets the RPO of 5 minutes because replication from the primary RDS instance to the read replica is asynchronous but typically completes within seconds to a few minutes, well under the 5-minute threshold. In a disaster, promoting the read replica to a standalone instance can be done manually or automated, and the RTO of 1 hour is achievable because promotion takes only a few minutes, leaving ample time for DNS and application failover. This solution provides a continuous replication stream without manual intervention, unlike snapshot-based approaches.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Take manual snapshots and copy them to the secondary Region daily.

Answer

Configure automated backups with a retention period of 35 days.

Question 14

An organization uses AWS Elastic Beanstalk to deploy a web application. The deployment fails with a '502 Bad Gateway' error after the environment update. The health status shows 'Severe'. Investigation reveals that the application is not binding to the port that the nginx proxy expects. What is the most efficient way to diagnose and resolve this issue?

Accepted Answer

Check the application's listening port by viewing the nginx configuration files in the platform hooks and ensure the app listens on the expected port (e.g., 8080).. The 502 Bad Gateway error in Elastic Beanstalk typically occurs when the nginx reverse proxy cannot forward requests to the application because the application is not listening on the expected port (default 8080). Checking the nginx configuration files in the platform hooks and verifying the application's listening port directly addresses the root cause, as the proxy expects the app to bind to a specific port. This is the most efficient diagnostic step because it targets the exact mismatch between the proxy and the application.

Answer

Rebuild the environment with a larger instance type to handle the load.

Answer

Use the Elastic Beanstalk console to update the environment's software configuration.

Answer

Review the application logs in CloudWatch Logs for error messages.

Question 15

A company has an IAM policy that allows users to manage their own passwords and MFA devices. The policy includes a condition that requires MFA for all API operations except for changing passwords and MFA. Which THREE statements are true about this policy? (Choose THREE.)

Accepted Answer

The policy uses NotAction to exclude password and MFA actions.. Options C, D, and E are correct. The policy uses NotAction to exclude password and MFA actions from the MFA requirement, and uses the aws:MultiFactorAuthPresent condition key to require MFA for all other actions. The policy must be attached to IAM users or groups to take effect. Option A is incorrect because the policy is an identity-based policy, not a role. Option B is incorrect because IAM policies do not apply to the root user.

Answer

The policy creates an IAM role for MFA enforcement.

Answer

The policy applies to the AWS account root user.