DOP-C02 Practice Test 14 — 15 Questions

Question 1

A company uses Amazon CloudWatch Logs to store application logs. A DevOps engineer needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which approach is the MOST efficient and cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use CloudWatch Logs Insights to run a query that counts ERROR entries across all log groups and add the query to a CloudWatch dashboard. CloudWatch Logs Insights allows you to run a query across all log groups in real time using a single query, and you can add that query directly to a CloudWatch dashboard. This approach is both efficient (no need to create per-log-group metric filters) and cost-effective (you pay only for the data scanned by the query, not for ongoing metric filter evaluation).

Answer

Create a CloudWatch Logs metric filter for each log group to count ERROR entries, and then create a CloudWatch dashboard

Answer

Export logs to Amazon S3 and use Amazon Athena to query and visualize in Amazon QuickSight

Answer

Create a Kinesis Data Firehose delivery stream to stream logs to Amazon OpenSearch Service and build a dashboard in OpenSearch Dashboards

Question 2

A company uses Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The operations team notices that some instances are failing health checks but are not being terminated by Auto Scaling. What should be investigated to resolve this issue?

Accepted Answer

Check the health check grace period setting in the Auto Scaling group. If it is too long, instances failing health checks may not be terminated quickly.. The health check grace period in an Auto Scaling group controls how long Auto Scaling waits before checking the health of a newly launched instance. If this grace period is set too long, instances that fail health checks before the grace period expires will not be terminated promptly, leading to the observed behavior where unhealthy instances remain in service even though they are failing health checks. The default grace period is 300 seconds, but if it is excessively long, it delays the termination of instances that fail health checks during that period.

Answer

Confirm that the load balancer's health check target is pointing to the correct port and path on the instances.

Answer

Ensure the instances are sending health check requests to the load balancer.

Answer

Verify that the security group for the instances allows inbound traffic from the load balancer on the health check port.

Question 3

A DevOps engineer created the IAM policy shown in the exhibit and attached it to a user. The user tries to upload an object to my-bucket without specifying the ACL. Why does the upload fail?

Accepted Answer

The policy condition requires the ACL to be bucket-owner-full-control, but the user did not specify it. The policy condition requires the ACL to be 'bucket-owner-full-control'. If the user does not specify an ACL, the default is usually 'private', which does not satisfy the condition. Therefore the action is denied. The resource ARN is correct. The action is allowed. The condition specifies StringEquals, which is correct for comparison.

Answer

The Effect should be Deny for this policy to work

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket

Answer

The user does not have permission to list the bucket

Question 4

A company has a monolith application that takes over an hour to build. The DevOps team wants to implement continuous integration using AWS CodeBuild. The build environment requires a large amount of dependencies that are rarely updated. Which strategy will MINIMIZE build time and cost?

Accepted Answer

Create a custom Docker image that includes all dependencies and use it as the build environment.. By pre-baking all rarely-updated dependencies into a custom Docker image, the build environment is ready instantly without any download or installation steps. This eliminates the overhead of fetching dependencies at build time, which is the primary bottleneck for a monolith with a large dependency set, and minimizes both build duration and cost by reducing compute time.

Answer

Enable Amazon S3 cache for the CodeBuild project to reuse dependencies from previous builds.

Answer

Store the dependencies in an Amazon S3 bucket and download them at the start of each build.

Answer

Use a larger compute type for the CodeBuild project to speed up the build.

Question 5

A company is designing a disaster recovery strategy for its primary RDS for PostgreSQL database in us-east-1. The RTO is 15 minutes and RPO is 1 minute. Which solution meets these requirements?

Accepted Answer

Create a cross-Region read replica in the secondary Region and promote it during failover.. A cross-Region read replica can be promoted to a primary instance in a matter of minutes, meeting the 15-minute RTO, and replication lag is typically under 1 minute, satisfying the 1-minute RPO. Option B (AWS Backup every hour) provides an RPO of up to 1 hour, exceeding the requirement. Option C (Multi-AZ in same region) does not provide cross-Region failover. Option D (manual snapshots every 5 minutes) has a higher RPO than 1 minute and may not be promotable quickly enough.

Answer

Use AWS Backup to copy automated backups to the secondary Region every hour.

Answer

Deploy a Multi-AZ RDS instance and failover to the standby in the same region.

Answer

Take manual snapshots of the database every 5 minutes and copy them to the secondary Region.

Question 6

Refer to the exhibit. The deployment succeeded but the application fails. What is the MOST likely cause?

Accepted Answer

The new task definition has a misconfigured database connection string or security group.. The most common cause of a deployment succeeding but the application failing is a misconfiguration in the new task definition, such as an incorrect database connection string or a security group that does not allow traffic to the database. CodePipeline can successfully deploy the new task definition to ECS, but if the application cannot connect to its backend services due to these configuration errors, the application will fail at runtime. This aligns with the scenario where the deployment pipeline reports success but the application itself is non-functional.

Answer

The CodePipeline deployment action uses the wrong cluster.

Answer

The ECS service is not registered with a target group.

Answer

The database is not available in the same Availability Zone.

Question 7

A company runs a critical application on Amazon ECS with Fargate. They use blue/green deployments via AWS CodeDeploy. During a recent deployment, the new task set failed health checks and CodeDeploy automatically rolled back. However, the old task set also became unhealthy shortly after rollback. What could explain this?

Accepted Answer

The new application version changed the database schema, which broke the old version after rollback.. A backward-incompatible database schema change (e.g., a column removal or renaming) applied by the new application version can corrupt or invalidate the data that the old version relies on. When CodeDeploy rolls back to the old task set, the old application cannot function correctly with the altered schema, causing it to fail health checks. This is a classic rollback failure scenario where the deployment changes shared state (the database) that persists beyond the task set lifecycle.

Answer

The CloudWatch alarm that triggered the rollback also stopped the old task set.

Answer

CodeDeploy did not drain connections from the Application Load Balancer before terminating the old task set.

Answer

The ECS service auto-scaling policy reduced the desired count of the old task set during the deployment.

Question 8

A DevOps engineer is designing a CI/CD pipeline for a microservices application running on Amazon ECS with Fargate. The team wants to use a blue/green deployment strategy to minimize downtime. Which combination of AWS services and configurations should be used to implement this?

Accepted Answer

Use CodeDeploy with an ECS compute platform and an Application Load Balancer. CodeDeploy with an ECS compute platform natively supports blue/green deployments for ECS services by orchestrating traffic shifting between two target groups behind an Application Load Balancer. This approach minimizes downtime by gradually routing traffic from the 'blue' (current) task set to the 'green' (new) task set, with built-in rollback capabilities and lifecycle hooks for validation.

Answer

Use Amazon ECS service with a rolling update deployment controller

Answer

Create two separate ECS services and use Route 53 weighted routing to shift traffic

Answer

Use AWS CloudFormation with a custom resource to swap target group weights

Question 9

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment fails because the new version of the application crashes the instances. The DevOps engineer needs the Auto Scaling group to automatically replace the unhealthy instances with the previous working version. Which deployment configuration should the engineer use?

Accepted Answer

Blue/Green deployment with a load balancer to switch traffic only after health checks pass.. A blue/green deployment with a load balancer health check ensures that the new (green) instances are validated before any traffic is routed to them. If the new version crashes, the health checks fail, the load balancer keeps traffic on the old (blue) instances, and the Auto Scaling group can automatically terminate the unhealthy green instances and replace them with the previous working version by reverting to the original launch configuration or template.

Answer

In-place deployment with a deployment group that has a failure threshold of 0.

Answer

Canary deployment that shifts 10% of traffic to the new version, then 100% after 10 minutes.

Answer

Linear deployment that shifts 10% of traffic every 10 minutes.

Question 10

A developer wants to provision AWS resources using AWS Cloud Development Kit (CDK) and ensure that the infrastructure can be version-controlled and reviewed. Which practice should they follow?

Accepted Answer

Write the CDK app in TypeScript, store it in a Git repository, and use CDK pipelines for deployment.. It follows the recommended practice of treating CDK application code as infrastructure source code, storing it in a version control system (Git), and using CDK Pipelines (a high-level construct that automatically synthesizes and deploys CloudFormation templates) to ensure repeatable, reviewed deployments. This approach enables infrastructure-as-code best practices: version history, peer review via pull requests, and automated deployment pipelines.

Answer

Write the CDK app and deploy directly without synthesis to avoid extra steps.

Answer

Write the CDK app to generate Terraform configurations and store them in Git.

Answer

Write raw CloudFormation templates instead of CDK to simplify version control.

Question 11

A company runs a critical application on Amazon ECS with the Fargate launch type. The application is deployed across three Availability Zones. Each service has its own Application Load Balancer. The company wants to implement a blue/green deployment strategy to reduce risk. They currently use AWS CodeDeploy for ECS deployments. During a recent deployment, the company noticed that the new version (green) was not receiving any traffic even after passing all health checks. The CodeDeploy configuration uses a 'Linear10PercentEvery3Minutes' traffic shifting configuration. What is the most likely reason that the green tasks are not receiving traffic?

Accepted Answer

The green target group's health check is misconfigured, causing CodeDeploy to consider the green tasks unhealthy and not route traffic.. The green target group's health check is misconfigured, causing CodeDeploy to consider the green tasks unhealthy. With a 'Linear10PercentEvery3Minutes' traffic shifting configuration, CodeDeploy gradually shifts traffic in 10% increments every 3 minutes, but only if the green target group passes health checks. If the health check fails, CodeDeploy stops traffic shifting, leaving the green tasks with zero traffic despite the tasks themselves being healthy.

Answer

The CodeDeploy deployment group is not associated with the correct ECS service.

Answer

The blue target group is still set as the production target group in the load balancer listener.

Answer

The green tasks are in a different VPC than the load balancer.

Question 12

An organization uses AWS CodePipeline to orchestrate deployments to multiple environments (dev, test, prod). Each environment uses a different AWS account. The pipeline uses cross-account actions with IAM roles. Recently, the pipeline failed at the deploy stage for the prod account with the error 'Access Denied' when assuming the cross-account role. The role ARN is correct and the trust policy allows the pipeline's service role. What is the MOST likely cause?

Accepted Answer

The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.. The pipeline's service role must have an `sts:AssumeRole` permission on the cross-account role to perform the role assumption. Even if the trust policy on the cross-account role allows the pipeline's service role, the pipeline's service role itself needs an IAM policy granting `sts:AssumeRole` for the cross-account role ARN. Without this permission, the `AssumeRole` API call fails with 'Access Denied', which is the exact error described.

Answer

The EC2 instances in the prod account do not have an appropriate instance profile.

Answer

The cross-account role's permissions boundary denies the deploy action.

Answer

The pipeline's service role does not have permission to perform the deploy action in the prod account.

Question 13

A DevOps engineer receives an alarm that an EC2 instance's CPU utilization has exceeded 90% for 5 minutes. The engineer needs to automatically recover the instance. Which AWS service should be used to configure automatic recovery?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can be configured to trigger an EC2 instance recovery action when a metric like CPU utilization exceeds a threshold (e.g., 90% for 5 minutes). The alarm sends a signal to the EC2 service, which automatically recovers the instance by stopping it and starting it on a new underlying host, preserving the instance ID, private IP, and Elastic IP. This is the native, built-in mechanism for automatic instance recovery without requiring additional compute or orchestration services.

Answer

AWS Lambda

Answer

AWS Systems Manager Automation

Answer

EC2 Auto Scaling

Question 14

A company has a multi-account AWS environment with separate accounts for development, staging, and production. They want to implement a CI/CD pipeline that deploys to each account sequentially after manual approvals. Which setup allows cross-account deployment with CodePipeline?

Accepted Answer

Create an IAM role in the target account with permissions for the pipeline service role to assume, and use that role in the deployment action.. CodePipeline supports cross-account deployments by having the pipeline service role in the source account assume an IAM role in the target account. This role must have a trust policy allowing the pipeline service role to assume it, and the deployment action (e.g., CloudFormation, CodeDeploy) references that target account role. This enables sequential deployment to development, staging, and production accounts with manual approval gates between stages.

Answer

Create separate pipelines in each account and trigger them via SNS from a master pipeline.

Answer

Use CodePipeline with cross-account actions by specifying the target account ID and region.

Answer

Use a single pipeline in the management account with different stages for each account.

Question 15

A development team uses AWS CodeCommit for source control. They want to enforce that all commits include a JIRA issue key in the commit message. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function on every push to validate commit messages.. CodeCommit triggers can invoke an AWS Lambda function on every push event, allowing real-time validation of commit messages against a required pattern (e.g., JIRA issue key). This serverless approach enforces the policy centrally without relying on client-side configurations, making it the most efficient and reliable method for a team using AWS CodeCommit.

Answer

Use Amazon CloudWatch Events to detect new commits and invoke a Lambda function to validate the commit message.

Answer

Implement a pre-commit hook in each developer's local repository.

Answer

Configure a branch policy on the repository that requires commit message format.