DOP-C02 Practice Test 14 — 15 Questions

Question 1

A development team uses AWS CodeCommit as a source repository for their AWS CodePipeline. They want to automatically trigger a pipeline execution when a new branch is created. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon CloudWatch Events to trigger the pipeline on a CodeCommit 'Reference Created' event.. AWS CodePipeline can be configured to start execution automatically when a new branch is created in CodeCommit by using Amazon CloudWatch Events (now part of Amazon EventBridge) to listen for the 'Reference Created' event type. This event is emitted by CodeCommit whenever a new Git reference (such as a branch or tag) is created, and it can directly target a CodePipeline pipeline as a rule target, triggering a new execution without any custom polling or webhook setup.

Answer

Create an S3 event notification to invoke the pipeline when a branch is created.

Answer

Configure a webhook in CodePipeline to detect branch creation events.

Answer

Set up a polling mechanism in CodePipeline to check for new branches every minute.

Question 2

A company runs a containerized microservices architecture on Amazon ECS with Fargate. The services communicate via an internal Application Load Balancer. Recently, a new deployment of Service A caused its health checks to fail. The DevOps engineer notices that the old tasks remain running and the service is unavailable. What configuration change would prevent this issue in future deployments?

Accepted Answer

Set the deployment minimum healthy percent to 50 and maximum percent to 100 with a health check grace period. Setting the deployment minimum healthy percent to 50 and maximum percent to 100 ensures that during a rolling update, at least 50% of the tasks remain healthy, and the deployment will not continue if the new tasks fail health checks, preserving service availability. Option B is incorrect because the circuit breaker can roll back on failure, but 'disable rollback' negates that; it's a misconfigured setting. Option C is not a configuration change for this issue; CodeDeploy is a separate service used for blue/green deployments, not a direct fix for health check failures during rolling updates. Option D is incorrect because setting minimum healthy percent to 0 and maximum percent to 200 allows all old tasks to be stopped before new ones start, causing downtime if health checks fail, as there are no healthy tasks to serve traffic.

Answer

Set the deployment circuit breaker to rollback on deployment failure and disable rollback

Answer

Change the deployment controller from ECS to CodeDeploy for blue/green deployments

Answer

Set the deployment minimum healthy percent to 0 and maximum percent to 200

Question 3

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences periodic slowdowns. The team wants to monitor the number of active connections and the query execution time. Which approach is most cost-effective?

Accepted Answer

Enable Performance Insights and set up CloudWatch alarms on the 'DBLoad' metric.. Performance Insights provides detailed query execution time metrics, enabling monitoring of query performance. It also includes the 'DBLoad' metric which reflects database load from active connections and queries. Combined with CloudWatch alarms, this approach is cost-effective as Performance Insights is included with RDS at no additional cost for up to 7 days of retention (longer retention has a fee). Options A and B are invalid because the CloudWatch agent cannot be installed on RDS instances, and 'QueryExecutionTime' is not a standard CloudWatch metric for RDS. Option D is less suitable for the specific requirement of query execution time; Enhanced Monitoring provides OS-level metrics like processes and memory but does not track query-level execution time.

Answer

Install the CloudWatch agent on the RDS instance to collect custom metrics.

Answer

Use the RDS console to view the 'DatabaseConnections' and 'QueryExecutionTime' metrics.

Answer

Enable Enhanced Monitoring and publish metrics to CloudWatch, then create alarms on relevant metrics.

Question 4

A company uses AWS CodePipeline with Amazon S3 as the source stage. The pipeline triggers on object creation events in the S3 bucket. The development team notices that the pipeline does not trigger when multiple files are uploaded simultaneously. What is the most likely cause?

Accepted Answer

The S3 event notification filter is set to only include objects with a specific prefix or suffix that does not match the uploaded files.. Amazon S3 event notifications can be filtered by prefix and suffix. If the filter is configured to only match objects with a specific prefix or suffix (e.g., `images/` or `.zip`), and the uploaded files do not match that filter, the event notification will not be sent to CodePipeline, causing the pipeline not to trigger. This is the most likely cause when the pipeline fails to trigger on simultaneous uploads, as the filter configuration is a common misconfiguration.

Answer

Amazon S3 event notifications are not guaranteed to be delivered for bulk operations.

Answer

CodePipeline does not support triggering from S3 event notifications when multiple files are uploaded simultaneously.

Answer

The S3 bucket versioning is not enabled, causing events to be lost.

Question 5

A development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?

Accepted Answer

Configure CodeBuild to cache dependencies in an Amazon S3 bucket.. Caching dependencies in an Amazon S3 bucket allows CodeBuild to reuse previously downloaded Maven/Gradle dependencies across builds, eliminating the need to re-download them each time. Since the codebase and dependencies are stable, this directly reduces the build time by avoiding repeated network transfers of large artifact repositories.

Answer

Move the build process to a local developer machine to avoid CodeBuild overhead.

Answer

Reduce the number of unit tests executed in the build phase.

Answer

Increase the compute type of the build environment to a larger instance.

Question 6

A company is using AWS CloudTrail to track API calls. They want to be notified immediately when an IAM user creates a new access key. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic.. To be notified immediately when an IAM user creates a new access key, the most efficient approach is to use Amazon CloudWatch Events (Amazon EventBridge) with an Amazon SNS topic. CloudTrail records the 'CreateAccessKey' API call as an event. An EventBridge rule can be configured to match this specific event pattern and send the event to an SNS topic, which can then send notifications via email, SMS, etc. This provides real-time notification without additional services. Option A (CloudWatch Logs with metric filter and alarm) requires sending CloudTrail logs to CloudWatch Logs, which adds latency and complexity; it is not as direct as EventBridge. Option B (AWS Config with Lambda) is not designed for real-time event notification. Option C (EventBridge with Lambda and SES) adds unnecessary Lambda processing since SNS can directly send email when subscribed to the topic.

Answer

Amazon CloudWatch Logs with a metric filter and alarm.

Answer

AWS Config with an AWS Lambda function.

Answer

Amazon CloudWatch Events (Amazon EventBridge) with an AWS Lambda function that sends an email via Amazon SES.

Question 7

A company runs a stateless web application on EC2 instances behind an Application Load Balancer. To improve resilience, which configuration should be used for the EC2 instances?

Accepted Answer

Use multiple EC2 instances across two or more Availability Zones. D is correct because deploying multiple EC2 instances across two or more Availability Zones (AZs) ensures high availability and fault tolerance. If one AZ fails, the Application Load Balancer (ALB) automatically routes traffic to healthy instances in other AZs, maintaining service continuity. This aligns with the AWS Well-Architected Framework's resilience best practices for stateless applications.

Answer

Use one EC2 instance with a larger instance type

Answer

Use a single, large EC2 instance in one Availability Zone

Answer

Use multiple EC2 instances in one Availability Zone with health checks disabled

Question 8

A company uses AWS Config to track resource changes. They want to automatically remediate non-compliant security group rules that allow public SSH access. What is the MOST effective approach?

Accepted Answer

Create an AWS Config rule with an automatic remediation action using AWS Systems Manager Automation.. AWS Config can directly associate an AWS Systems Manager Automation document as a remediation action for a non-compliant rule. This approach provides a fully managed, idempotent, and auditable remediation workflow without requiring custom Lambda code or external event orchestration. The automation document can be configured to automatically remove the SSH ingress rule (port 22) from the security group when the Config rule detects non-compliance.

Answer

Set up an AWS Config rule that triggers a Lambda function to remove the SSH rule.

Answer

Use Amazon CloudWatch Events to detect the change and invoke a Lambda function.

Answer

Use AWS Service Catalog to enforce security group templates.

Question 9

A company uses AWS Systems Manager Automation to patch EC2 instances. The automation document 'AWS-RunPatchBaseline' runs successfully but some instances are not patched because they are not managed by Systems Manager. What is the most likely reason?

Accepted Answer

The instances do not have the AWS Systems Manager Agent (SSM Agent) installed and the required IAM role attached.. Systems Manager Automation can only patch instances that are managed by Systems Manager. For an instance to be managed, it must have the SSM Agent installed and running, and it must have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) to communicate with the Systems Manager service. Without these prerequisites, the instance is not registered as a managed node, so the automation document cannot target or patch it.

Answer

The instances are running Windows Server 2012 or older.

Answer

The instances are in a VPC without internet access.

Answer

The automation document is not compatible with the instance's operating system.

Question 10

A company uses AWS CloudFormation StackSets to deploy a common network infrastructure across multiple AWS accounts. They need to ensure that all StackSet operations are audited and any failed stack instances are automatically retried. Which THREE configurations should be implemented? (Select THREE.)

Accepted Answer

Configure Amazon SNS notifications for StackSet events.. To audit StackSet operations, enable AWS CloudTrail to log StackSet API calls (option E). To automatically retry failed stack instances, set the 'Retry on failure' option in StackSet operation preferences (option D). To receive notifications about StackSet events, configure Amazon SNS notifications (option B). Automatic rollback (A) is not a retry mechanism, and AWS Config rules (C) monitor compliance but do not provide audit logging or retry functionality.

Answer

Enable automatic rollback on failure.

Answer

Use AWS Config rules to monitor StackSet compliance.

Question 11

A company uses AWS CodeBuild to run unit tests as part of their CI/CD pipeline. The tests are memory-intensive and occasionally fail due to insufficient memory. The buildspec.yml file uses the default compute type. What is the most cost-effective solution to resolve the memory issue?

Accepted Answer

Change the build project's compute type to a larger instance (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM).. Increasing the compute type (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM) directly provides more memory for the build environment, resolving the out-of-memory failures. This is the most cost-effective solution as it only increases resources for the specific build project that needs them, without requiring architectural changes or additional build projects.

Answer

Use a custom build environment with the same compute type.

Answer

Enable local caching in the build project to reduce disk I/O.

Answer

Split the tests into multiple build projects and run them in parallel.

Question 12

A company is running a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The DevOps team wants to monitor HTTP 5xx errors and receive alerts when the error rate exceeds 5% over a 5-minute period. Which combination of services and configurations should be used to meet these requirements?

Accepted Answer

Use CloudWatch ALB metrics (HTTPCode_ELB_5XX_Count) and create a CloudWatch Alarm on the Sum statistic with a threshold based on total request count.. ALB automatically publishes the `HTTPCode_ELB_5XX_Count` metric to CloudWatch, and you can create a CloudWatch alarm using the `Sum` statistic over a 5-minute period. To detect when the error rate exceeds 5%, you need to combine this metric with the `RequestCount` metric in a math expression (e.g., `m1/m2*100 > 5`) or use a composite alarm, as the alarm threshold must be based on the ratio of 5xx errors to total requests, not just the raw count.

Answer

Enable CloudWatch Logs for the ALB and use CloudWatch Logs Insights to query 5xx logs, then create a metric filter and alarm.

Answer

Configure AWS Config rules to check ALB 5xx error counts and trigger alarms.

Answer

Use AWS X-Ray to trace requests and create a CloudWatch alarm based on X-Ray error rate.

Question 13

A development team uses AWS CodeCommit as a source repository for their AWS CodePipeline. They want to automatically trigger a pipeline execution when a new branch is created. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use 'git filter-branch' to rewrite the repository history and remove the sensitive file. 'git filter-branch' (or the modern 'git filter-repo') rewrites the repository history by removing or replacing the sensitive file in every commit, effectively purging it from the entire Git history. This is the only native Git method that completely eliminates the sensitive data from all past commits, preventing anyone from retrieving it via 'git log' or by cloning the repository. After rewriting history, a force push to the remote CodeCommit repository is required to overwrite the remote branches.

Answer

Delete the repository and create a new one, then force push the remaining branches

Answer

Use 'git revert' to create a new commit that undoes the changes

Answer

Create a new branch from the commit before the sensitive data was added and merge it to main

Question 14

A company is using AWS CodeBuild to run integration tests. The tests require access to an Amazon RDS instance in a private subnet. The CodeBuild project is configured with a VPC ID, subnet IDs, and security group IDs. However, the tests fail with a connection timeout. What is the MOST likely cause?

Accepted Answer

The security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group.. The most likely cause is that the security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group. CodeBuild runs inside the VPC using the specified security group, so it sends traffic to the RDS instance on port 3306 (or the appropriate database port). If the RDS security group's inbound rules do not explicitly permit traffic from the CodeBuild security group (or its CIDR), the connection is dropped, resulting in a timeout.

Answer

The CodeBuild project does not have internet access to download packages.

Answer

The CodeBuild project is not associated with a VPC.

Answer

The RDS instance is not publicly accessible and requires a NAT gateway.

Question 15

A company runs a critical web application on AWS using an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application is deployed using AWS CodeDeploy with a blue/green deployment configuration. The DevOps team is responsible for configuration management using AWS Systems Manager State Manager. They have set up a State Manager association to ensure that the instances have a specific security configuration (e.g., firewall rules). Recently, after a new deployment, the team noticed that the security configuration is missing on some new instances. The old instances still have the correct configuration. The association is configured to apply the configuration only at instance launch (using the AWS-RunShellScript document). The team suspects that the new instances are not being targeted by the association. Upon investigation, they find that the association is set to target instances based on tags, and the new instances do have the required tags. However, the association status shows 'Success' for the old instances but no status for the new instances. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The State Manager association was created before the new instances were launched, and the association is not configured to automatically apply to new instances. The association needs to be updated or scheduled to run periodically.. State Manager associations are created at a specific time and target instances that exist at that time. New instances launched after the association creation will not automatically be targeted unless the association is configured with a schedule or the 'Apply only at next update' option. The association is set to run only at launch, but the association itself must be applied to the instance at launch time. If the association was created before the new instances, it won't apply to them unless it is updated. Option B is wrong because the association can target instances by tags; tagging is not the issue. Option C is wrong because the problem is not about the script failing; the association is not running on new instances. Option D is wrong because the S3 bucket policy would affect the ability to store logs, but the association status would show error, not missing status.

Answer

The new instances have a different tag than the one specified in the association.

Answer

The association is trying to download a script from an S3 bucket, but the bucket policy denies access to new instances.

Answer

The AWS-RunShellScript document failed to execute on the new instances due to a missing IAM role.