DOP-C02 Practice Test 13 — 15 Questions

Question 1

An IAM policy is attached to a user who needs to create a CloudFormation stack that provisions an EC2 instance and an S3 bucket. The user receives an 'Access Denied' error when running the 'aws cloudformation create-stack' command. Which additional permission is required?

Accepted Answer

ec2:RunInstances and s3:CreateBucket. Option B is correct because to create a stack that provisions EC2 and S3 resources, the user must have permissions for those resource types (ec2:RunInstances, s3:CreateBucket) in addition to cloudformation:CreateStack. Option A is incorrect because the user already has cloudformation:CreateStack. Option C is incorrect because the user already has s3:GetObject. Option D is incorrect because iam:PassRole is needed only if a role is passed, which is not mentioned.

Answer

s3:PutObject

Answer

cloudformation:DescribeStacks

Answer

iam:PassRole

Question 2

Which TWO actions should a DevOps engineer take to implement a GitFlow branching strategy for infrastructure as code using AWS CodeCommit and CodePipeline? (Choose two.)

Accepted Answer

Use CodeBuild to run unit tests on feature branches before merging.. Options B and D are correct. Using separate pipelines for each branch allows different deployment behaviors. Option A is wrong because CodePipeline does not natively support pull request triggers; CodeBuild can be used for validation. Option C is wrong because merging from develop to master should trigger a pipeline for release. Option E is wrong because using the same pipeline for all branches reduces flexibility.

Answer

Disable automatic triggers on the master branch to prevent accidental deployments.

Answer

Use a single pipeline that handles all branches.

Answer

Configure CodePipeline to trigger on pull request creation.

Question 3

An organization uses AWS OpsWorks for configuration management of their EC2 instances. They need to ensure that all instances have the latest security patches applied automatically. Which action should the team take?

Accepted Answer

Configure a custom Chef recipe in OpsWorks to run 'yum update' on a schedule.. Option D is correct because OpsWorks can run Chef recipes on a schedule using custom recipes. Option A is incorrect because OpsWorks does not directly integrate with Systems Manager Patch Manager; that is a separate service. Option B is incorrect because AWS Config rules are for compliance evaluation, not patching. Option C is incorrect because updating the AMI does not affect running instances.

Answer

Create an AWS Config rule to check for missing patches and trigger an auto-remediation.

Answer

Update the AMI used by the OpsWorks layer to include the latest patches.

Answer

Enable AWS Systems Manager Patch Manager to patch all instances managed by OpsWorks.

Question 4

A company uses AWS CloudFormation to deploy infrastructure. A recent stack update failed, and the engineer needs to roll back to the previous stable state. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the 'Rollback' action in the CloudFormation console.. Option C is correct because CloudFormation provides a built-in 'Rollback' action that automatically reverts a stack to its last known stable state when a stack update fails. This rollback occurs by default on failure, but if the engineer needs to manually trigger it after a failed update, they can use the 'Rollback' action in the CloudFormation console or API (e.g., `aws cloudformation rollback-stack`). This ensures the infrastructure returns to the previous working configuration without manual intervention.

Answer

Use AWS CloudFormation Drift Detection.

Answer

Use AWS CloudFormation StackSets.

Answer

Create a Change Set and execute it.

Question 5

A company is using Amazon S3 to store critical data. The company requires that all versions of objects be retained, including deleted objects, to meet compliance requirements. Which S3 feature should be enabled?

Accepted Answer

S3 Versioning. Option A is correct because S3 Versioning keeps all versions of objects, including deleted ones (marked with delete markers). Option B is wrong because MFA Delete adds an extra layer of security but does not retain all versions. Option C is wrong because S3 Object Lock prevents deletion but requires versioning to be enabled; however, versioning itself is the feature that retains all versions. Option D is wrong because lifecycle policies can transition or expire objects, not retain all versions.

Answer

S3 Object Lock

Answer

S3 Lifecycle policies

Answer

MFA Delete

Question 6

A company has a production environment that uses Amazon Route 53 for DNS and an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The company wants to implement a disaster recovery plan that automatically fails over to a secondary region in case the primary region becomes unavailable. Which configuration should be used?

Accepted Answer

Use Route 53 failover routing policy with primary and secondary records and health checks.. Option B is correct because Route 53 failover routing policy with health checks on the ALB endpoint can automatically route traffic to a secondary endpoint when the primary is unhealthy. Option A is wrong because weighted routing distributes traffic based on weights, not failover. Option C is wrong because latency routing routes based on latency, not automatic failover. Option D is wrong because geolocation routing routes based on geographic location, not failover.

Answer

Use Route 53 weighted routing policy with equal weights for both regions.

Answer

Use Route 53 geolocation routing policy to route users based on their location.

Answer

Use Route 53 latency routing policy to route to the region with lowest latency.

Question 7

A company's DevOps team uses AWS CodePipeline to automate deployments. A recent pipeline execution failed at the 'Deploy' stage. The engineer needs to view the detailed logs for the failed action. Which AWS service or feature should the engineer use?

Accepted Answer

CloudWatch Logs. AWS CodePipeline integrates with Amazon CloudWatch Logs to capture and store detailed execution logs for each pipeline action, including the 'Deploy' stage. When a deployment action fails, the engineer can view the associated logs directly from the CodePipeline console or via the CloudWatch Logs console, which provides granular error messages, timestamps, and stack traces necessary for troubleshooting. This is the designated service for accessing action-level logs in CodePipeline.

Answer

S3 access logs

Answer

CodeBuild logs

Answer

CloudTrail

Question 8

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to know who attempted to decrypt data using a specific KMS key and whether the attempt succeeded. Which AWS service should the team use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey, as events in the CloudTrail logs. By examining CloudTrail events for the specific KMS key ID, the security team can see who called the Decrypt API and whether the call succeeded (HTTP 200) or failed (e.g., AccessDenied). This provides the exact audit trail needed for incident response.

Answer

AWS Config

Answer

KMS key policies

Answer

CloudWatch Logs

Question 9

A company uses AWS CloudTrail to log API events. During an incident investigation, they need to identify who deleted an S3 bucket. Which CloudTrail feature should be used to retrieve the event details quickly?

Accepted Answer

CloudTrail Event history. CloudTrail Event history provides a view of the last 90 days of management events for each AWS region, allowing you to quickly search and filter by resource name (e.g., the S3 bucket name) and event name (e.g., DeleteBucket). This feature is designed for rapid retrieval of recent API activity without needing to query S3 or set up additional infrastructure, making it the fastest option for identifying who deleted an S3 bucket during an incident investigation.

Answer

CloudTrail log file integrity validation

Answer

CloudTrail Lake

Answer

CloudTrail Insights

Question 10

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The operations team needs to run a script on all instances that are missing a specific security patch. Which Systems Manager capability should be used to accomplish this?

Accepted Answer

State Manager. State Manager is the correct capability because it is designed to maintain consistent configuration of EC2 instances by defining and enforcing a desired state. In this scenario, the operations team needs to ensure that all instances missing a specific security patch are brought into compliance, which is a classic desired-state management task. State Manager uses associations to define the desired state (e.g., a script to apply the patch) and automatically enforces it on a schedule or on-demand, making it ideal for ensuring all instances eventually reach the patched state.

Answer

Automation

Answer

Run Command

Answer

Patch Manager

Question 11

A company uses AWS CloudFormation to deploy a three-tier web application. The deployment includes an Application Load Balancer (ALB), an Auto Scaling group, and an Amazon RDS database. The operations team reports that updates to the database security group rules are not being applied correctly during stack updates. The CloudFormation template uses AWS::RDS::DBInstance and AWS::EC2::SecurityGroup resources. What is the most likely cause of this issue?

Accepted Answer

The DBInstance resource has a DeletionPolicy attribute set to 'Retain', causing CloudFormation to skip updates to dependent resources.. Option A is correct because when a DBInstance resource has a DeletionPolicy set to 'Retain', CloudFormation treats the resource as a 'non-updatable' resource during stack updates. This means CloudFormation will not modify the DBInstance or its dependent resources, such as the security group rules, even if the template changes. The 'Retain' policy prevents CloudFormation from replacing or updating the resource, causing updates to associated security group rules to be silently skipped.

Answer

The CloudFormation stack has a stack policy that denies updates to the security group resources.

Answer

The security group rules are defined inline within the AWS::EC2::SecurityGroup resource, and CloudFormation does not update inline rules after initial creation.

Answer

The RDS database is in a VPC that requires a VPC endpoint for CloudFormation to update security groups.

Question 12

A company uses AWS CodeBuild to compile and test code. The build process requires a specific version of a library that is not available in the default build environment. Which approach should be used to include this library in the build process?

Accepted Answer

Create a custom Docker image that includes the library and use it as the build environment in CodeBuild.. Option D is correct because creating a custom Docker image that includes the required library ensures the build environment is consistent, reproducible, and avoids repeated download/compile overhead. AWS CodeBuild supports custom Docker images via the `image` field in the buildspec file or the console, allowing you to specify a repository in Amazon ECR or Docker Hub. This approach aligns with infrastructure-as-code best practices by baking dependencies into the environment rather than managing them at build time.

Answer

Modify the buildspec file to include the library as a build artifact.

Answer

Store the compiled library in an Amazon S3 bucket and download it during the build process using the buildspec file.

Answer

Add an install command in the buildspec file to download and compile the library during each build.

Question 13

A company uses AWS CodePipeline to deploy a serverless application with AWS Lambda and Amazon API Gateway. The pipeline includes a beta and a production stage. The DevOps team wants to automatically promote the application from beta to production after successful testing. Which action should be taken in the pipeline?

Accepted Answer

Add a manual approval step between the beta and production stages. Option C is correct because CodePipeline requires an explicit manual approval action to gate promotions between stages. Without a manual approval step, the pipeline would automatically transition from beta to production upon successful testing, which bypasses the necessary human validation for production deployments. Adding a manual approval step ensures that a designated approver reviews the beta stage results before promoting to production, aligning with safe deployment practices.

Answer

Configure a CloudWatch Events rule to automatically trigger the production deployment after beta completion

Answer

Use AWS CodeDeploy to create a deployment group that promotes the application

Answer

Configure an AWS Config rule to automatically approve the promotion

Question 14

Which TWO approaches can be used to manage configuration files (e.g., application.properties) across multiple AWS accounts and regions using AWS Systems Manager? (Select TWO.)

Accepted Answer

Use AWS AppConfig to create, manage, and deploy application configurations across accounts and regions.. AWS AppConfig is a feature of AWS Systems Manager that allows you to create, manage, and deploy application configurations across accounts and regions. It supports staged rollouts, validation, and monitoring, making it suitable for managing configuration files like application.properties in multi-account, multi-region environments.

Answer

Use AWS OpsWorks for Chef Automate to store configuration data in Chef data bags.

Answer

Store configuration files in AWS Secrets Manager and retrieve them using the Secrets Manager API.

Answer

Use AWS Systems Manager Run Command to push configuration files to EC2 instances on demand.

Question 15

An application running on Amazon ECS (Fargate) experiences intermittent HTTP 503 errors. The application uses an Application Load Balancer. The ECS service has a desired count of 2. CPU and memory utilization are below 50%. What is the most likely cause?

Accepted Answer

The target group health check threshold is set too low.. Intermittent HTTP 503 errors from an Application Load Balancer (ALB) typically indicate that the target group health checks are failing, causing the ALB to stop routing traffic to the affected tasks. With a desired count of 2 and low CPU/memory utilization, the most likely cause is a health check threshold set too low (e.g., a low unhealthy threshold count), which makes the ALB prematurely mark tasks as unhealthy during transient issues, leading to no healthy targets and 503 responses. This aligns with the symptom of intermittent errors, as tasks may briefly fail a health check but recover quickly, yet the low threshold causes them to be deregistered.

Answer

The ECS service Auto Scaling is too aggressive.

Answer

The ALB listener rule is misconfigured.

Answer

The task definition has an incorrect memory hard limit.

DOP-C02 Practice Test 13 — 15 Questions

Exhibit

DOP-C02 Practice Test 13 — 15 Questions

Exhibit