DOP-C02 Practice Test 14 — 15 Questions

Question 1

A company uses Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The operations team notices that some instances are failing health checks but are not being terminated by Auto Scaling. What should be investigated to resolve this issue?

Accepted Answer

Check the health check grace period setting in the Auto Scaling group. If it is too long, instances failing health checks may not be terminated quickly.. Option C is correct because if the health check grace period is too long, instances that fail shortly after launch may not be terminated promptly. Option A is wrong because security groups allow traffic but do not affect health check initiation. Option B is wrong because ELB health checks are sent to the instances, not the other way. Option D is wrong because the load balancer is the one performing health checks.

Answer

Confirm that the load balancer's health check target is pointing to the correct port and path on the instances.

Answer

Ensure the instances are sending health check requests to the load balancer.

Answer

Verify that the security group for the instances allows inbound traffic from the load balancer on the health check port.

Question 2

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage to Elastic Beanstalk. Recently, deployments started failing with an error: 'The deployment failed because the Elastic Beanstalk environment is in an UPDATE_ROLLBACK_IN_PROGRESS state.' What is the MOST likely cause?

Accepted Answer

A previous deployment failed and triggered an automatic rollback, leaving the environment in an unstable state. Option B is correct because a failed previous deployment can leave the environment in a rolling back state, preventing subsequent deployments. Option A is wrong because CodeCommit authentication issues would cause the source stage to fail, not the deploy stage. Option C is wrong because build spec errors would cause the build stage to fail. Option D is wrong because CloudWatch alarms do not block deployments.

Answer

The buildspec.yml file contains an invalid command that prevents artifact generation

Answer

A CloudWatch alarm is blocking the deployment due to high error rates

Answer

Insufficient IAM permissions for CodePipeline to pull source code from CodeCommit

Question 3

A development team wants to automate infrastructure provisioning using AWS CloudFormation. Which tool is specifically designed to manage CloudFormation templates as part of a deployment pipeline?

Accepted Answer

AWS CodePipeline. Option C is correct because AWS CodePipeline natively integrates with CloudFormation to deploy infrastructure. Option A is wrong because AWS CodeCommit is a source control service. Option B is wrong because AWS CodeBuild is a build service. Option D is wrong because AWS CodeDeploy is for deploying applications, not infrastructure.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 4

A company uses AWS CodeBuild to compile a Java application. The build specification includes a pre-build phase to download dependencies. Which file defines the commands for each build phase?

Accepted Answer

buildspec.yml. In AWS CodeBuild, the build specification file named 'buildspec.yml' defines the commands that CodeBuild runs during each phase of the build process, including the pre-build phase for downloading dependencies. This YAML file is placed in the root of the source code or specified in the build project configuration, and it contains structured sections for install, pre_build, build, and post_build phases. Option B is correct because buildspec.yml is the standard file that CodeBuild uses to orchestrate build commands.

Answer

pipeline.json

Answer

config.xml

Answer

appspec.yml

Question 5

A company uses AWS CodeBuild to run security scans. The scans require access to a private Amazon ECR repository. The build project is configured with a service role. What is the correct way to provide access to ECR?

Accepted Answer

Attach an IAM policy to the CodeBuild service role that allows ECR operations.. Option D is correct because CodeBuild uses an IAM service role to define the permissions granted to the build environment. By attaching an IAM policy that allows ECR operations (such as ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:GetAuthorizationToken) to the CodeBuild service role, the build project can authenticate and pull images from the private ECR repository without needing to embed or manage static credentials.

Answer

Set environment variables with ECR credentials in the build project.

Answer

Configure the ECR repository policy to allow access from the CodePipeline service role.

Answer

Include the ECR credentials in the buildspec file.

Question 6

A company uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that creates an Amazon RDS DB instance. The database password must be stored securely and rotated automatically. Which approach meets these requirements?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation. Reference the secret in the template using a dynamic reference.. Option D is correct because AWS Secrets Manager provides built-in capabilities for automatic password rotation, which is a requirement. By storing the password in Secrets Manager and referencing it in the CloudFormation template using a dynamic reference (e.g., `{{resolve:secretsmanager:secret-id:SecretString:password}}`), the password is never exposed in the template or parameter logs, and rotation can be configured without updating the stack. This approach meets both security and automation requirements.

Answer

Hardcode the password in the CloudFormation template and use a NoEcho parameter.

Answer

Use AWS Key Management Service (KMS) to encrypt the password and pass it as a parameter.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it using a dynamic reference.

Question 7

Refer to the exhibit. A CodePipeline deployment fails at the CloudFormation stage. The Lambda function creation is cancelled. What is the MOST likely cause?

Accepted Answer

The Lambda function is configured in a VPC without a NAT gateway or VPC endpoints, causing deployment timeout.. The error indicates CloudFormation timed out waiting for a signal (WaitCondition). Lambda functions in a VPC require a NAT gateway or VPC endpoints to download dependencies or access external services, and the wait condition might be waiting for a signal that never arrives due to network issues.

Answer

The buildspec.yml file contains an invalid command.

Answer

The Lambda function's execution role lacks permissions to create ENIs.

Answer

The CodeCommit branch is not configured correctly in the pipeline.

Question 8

Refer to the exhibit. The deployment succeeded but the application fails. What is the MOST likely cause?

Accepted Answer

The new task definition has a misconfigured database connection string or security group.. The error shows a database connection timeout to an internal IP (10.0.0.5). The new task definition likely has incorrect environment variables or security group rules that prevent connecting to the database.

Answer

The CodePipeline deployment action uses the wrong cluster.

Answer

The ECS service is not registered with a target group.

Answer

The database is not available in the same Availability Zone.

Question 9

Refer to the exhibit. A CloudFormation template creates a Lambda function. After deployment, the function fails with a timeout error. Logs are not being created in CloudWatch. What is the most likely cause?

Accepted Answer

The IAM role does not grant sufficient permissions to write logs.. Option C is correct because the Lambda function does not have permission to create log groups in the correct log group ARN. The log group ARN pattern is missing the log group name. Option A is wrong because the code is not the issue. Option B is wrong because the runtime is correct. Option D is wrong because the role is correctly assumed.

Answer

The runtime is not supported.

Answer

The Lambda execution role has a trust policy that is missing the lambda service.

Answer

The Lambda function code is faulty.

Question 10

Refer to the exhibit. A network engineer reviews VPC Flow Logs. Which statement about the traffic is correct?

Accepted Answer

Outbound HTTP traffic to the internet is blocked.. First two records show accepted traffic between internal IPs on port 443 (HTTPS). The third record shows outbound traffic from 10.0.1.5 to an external IP on destination port 80 (HTTP) that is rejected. This indicates outbound HTTP is blocked.

Answer

Internal traffic on port 80 is allowed.

Answer

Outbound HTTPS traffic is being rejected.

Answer

All traffic is accepted.

Question 11

A company wants to centrally manage and apply policies across multiple AWS accounts in an AWS Organization. Which service should be used to define and enforce compliance rules?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are the correct choice because they centrally manage permissions across all accounts in an AWS Organization by defining maximum allowable permissions. SCPs act as a guardrail, restricting what member accounts can do, even if IAM policies within those accounts grant broader access. This makes SCPs the ideal service for enforcing compliance rules at the organization level.

Answer

AWS Config rules

Answer

AWS CloudTrail

Answer

IAM policies

Question 12

A company uses AWS Elastic Beanstalk for deploying web applications. They want to automate deployments whenever a new commit is pushed to the master branch of their CodeCommit repository. Which AWS service should they use to trigger the deployment?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed continuous delivery service that can be configured to automatically trigger a deployment pipeline when a new commit is pushed to a CodeCommit repository's master branch. It integrates directly with CodeCommit as a source action and Elastic Beanstalk as a deployment provider, enabling end-to-end automation without custom scripting.

Answer

AWS CloudTrail

Answer

AWS OpsWorks

Answer

Amazon CloudWatch Events

Question 13

A DevOps engineer creates a CloudFormation stack with the above template. After creation, they want to update the Lambda function code by uploading a new zip file to the S3 bucket and updating the S3Key property. However, the stack update fails because the Lambda function is published as a version and the alias points to that version. What is the most likely reason for the update failure?

Accepted Answer

The AWS::Lambda::Version resource is immutable and cannot be updated.. Option A is correct. When you update a Lambda function's code, CloudFormation updates the $LATEST version. However, if you have created a version (AWS::Lambda::Version) and an alias pointing to that version, the alias does not automatically point to the new version. CloudFormation tries to update the function code, but the version resource is immutable; once created, it cannot be updated. The update will fail because CloudFormation cannot modify the existing version. Option B is wrong because the alias does not need to be recreated, but the version does. Option C is wrong because the function code can be updated, but the version resource blocks it. Option D is wrong because the IAM role is not the issue.

Answer

The alias must be deleted before updating the function code.

Answer

The IAM role does not have permission to update the function.

Answer

The function code cannot be updated because the S3 bucket is in a different region.

Question 14

Which TWO AWS services can be used as sources in an AWS CodePipeline? (Choose two.)

Accepted Answer

AWS CodeCommit. CodePipeline supports Amazon S3 and AWS CodeCommit as source providers. AWS CodeBuild is a build provider, not a source. AWS CloudFormation is a deploy provider. AWS Lambda can be used as a custom action but not as a built-in source.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Question 15

A DevOps team uses AWS CodeBuild to compile code and run unit tests. The team notices that builds are failing with a timeout error after 60 minutes. What is the most likely cause and solution?

Accepted Answer

The build timeout limit is exceeded; increase the timeout in CodeBuild project settings.. CodeBuild has a default build timeout of 60 minutes. Increasing the timeout in the build project configuration resolves the issue.

Answer

The buildspec has syntax errors; validate the YAML.

Answer

The build environment is too small; increase compute type.

Answer

The source code repository is too large; use shallow clone.