DOP-C02 Practice Test 15 — 15 Questions

Question 1

A company is deploying a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application must be resilient to the failure of an entire Availability Zone. Which design should the company implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Launch EC2 instances in at least two Availability Zones and place them behind an Application Load Balancer with cross-zone load balancing enabled.. Deploying EC2 instances across at least two Availability Zones (AZs) behind an Application Load Balancer (ALB) with cross-zone load balancing enabled ensures that if an entire AZ fails, the ALB can route traffic to healthy instances in the remaining AZs. Cross-zone load balancing allows the ALB to distribute incoming requests evenly across all registered instances in all enabled AZs, which improves fault tolerance and resource utilization. This design meets the requirement for resilience to an AZ failure by eliminating a single point of failure at the AZ level.

Answer

Use one EC2 instance in a single Availability Zone behind a Network Load Balancer.

Answer

Launch EC2 instances in one Availability Zone and use an Application Load Balancer to distribute traffic.

Answer

Deploy EC2 instances in two Availability Zones but use a single Application Load Balancer in one AZ.

Question 2

A company runs a stateless web application on Amazon ECS with Fargate launch type. The application experiences intermittent traffic spikes. The company wants to ensure that the application can scale automatically and remain resilient to underlying infrastructure failures. Which combination of actions should the DevOps engineer take?

Accepted Answer

Configure an Application Auto Scaling target tracking policy based on memory utilization and enable Amazon ECS service auto-recovery.. It combines Application Auto Scaling target tracking based on memory utilization, which is a relevant metric for a stateless web application to handle traffic spikes, with Amazon ECS service auto-recovery, which automatically replaces unhealthy tasks to ensure resilience against underlying infrastructure failures. This approach provides both automatic scaling and fault tolerance without manual intervention.

Answer

Configure a scheduled scaling policy for the Amazon ECS service to add tasks during known peak hours.

Answer

Launch tasks in a single Availability Zone and use an Application Auto Scaling target tracking policy based on CPU utilization.

Answer

Configure a step scaling policy for the Amazon ECS service and increase the task memory size.

Question 3

A development team is using AWS CodeCommit to store source code and AWS CodePipeline to automate builds and deployments. The team wants to ensure that builds and tests are triggered only when code is pushed to specific branches, and that manual approval is required before deploying to production. Which CodePipeline configuration should the team implement?

Accepted Answer

Configure the source action with a branch filter for main, and add a manual approval step before the production deployment stage.. CodePipeline source actions support branch filters that restrict which Git branches trigger the pipeline. By filtering on 'main', only pushes to that branch initiate the pipeline. Adding a manual approval step before the production deployment stage ensures that no code reaches production without explicit human sign-off, meeting both requirements precisely.

Answer

Configure the source action to trigger on all branches and add a manual approval step before the build stage.

Answer

Configure the source action with a branch filter for main, and add a manual approval step before the build stage.

Answer

Use a branch filter on the build action to run only for the main branch, and add a manual approval step before the deploy stage.

Question 4

A DevOps team uses AWS CodePipeline with a multi-branch strategy. The pipeline should deploy to production only from the 'main' branch, but run unit tests for all branches. How should the team configure the pipeline?

Accepted Answer

Configure the pipeline source stage to trigger on all branches, use branch-specific logic in the test stage, and add a manual approval step for production deployment only when the branch is 'main'.. AWS CodePipeline supports branch filtering in the source stage to trigger on all branches, and you can use a condition in the deploy stage (e.g., via a Lambda function or a manual approval step) to restrict production deployment to the 'main' branch only. This approach avoids duplicating pipelines while ensuring unit tests run for every branch, meeting the multi-branch strategy requirement efficiently.

Answer

Use an AWS Lambda function to check the branch name and invoke different CodePipeline executions for testing and deployment.

Answer

Create one pipeline with two source stages: one for 'main' and one for all other branches, each with its own test and deploy actions.

Answer

Create a separate pipeline for each branch, each with identical test and deploy stages.

Question 5

A company uses AWS CloudFormation to deploy infrastructure. During a recent deployment, the stack failed to create an Amazon RDS DB instance because of a parameter validation error. The DevOps engineer fixed the parameter and wants to resume the stack creation without recreating the resources that were already successfully created. The stack template is parameterized and uses nested stacks. What is the MOST efficient way to resume the stack creation?

Accepted Answer

Use the CloudFormation stack update operation with the corrected parameter.. CloudFormation stack updates can be used to fix the issue. By updating the stack with the corrected parameters, CloudFormation will only modify the failed resource and not recreate already created resources.

Answer

Manually create the RDS instance with the corrected parameter and update the stack to import it.

Answer

Delete the entire stack and redeploy with the corrected parameter.

Answer

Use the 'ContinueUpdateRollback' feature to rollback the failed stack and then redeploy.

Question 6

A DevOps engineer is creating an AWS Elastic Beanstalk environment and needs to ensure that configuration changes are tracked and can be reverted. Which THREE steps should the engineer take to achieve this? (Choose THREE.)

Accepted Answer

Enable configuration drift detection using AWS Config.. AWS Config can be used to track configuration changes to Elastic Beanstalk resources (e.g., the underlying EC2 instances, security groups, and load balancers) by recording configuration items and detecting drift from the desired state. This allows the DevOps engineer to audit changes and revert to a compliant configuration if needed.

Answer

Use Elastic Beanstalk lifecycle policies to automatically retain old configurations.

Answer

Store configuration templates in the Elastic Beanstalk console, which automatically keeps version history.

Question 7

A company is implementing a disaster recovery strategy for its Amazon Aurora MySQL database. The primary database is in us-west-2. The company requires an RPO of less than 1 minute and an RTO of less than 5 minutes. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with a secondary Region cluster.. Amazon Aurora Global Database is designed for low-latency cross-Region replication with a typical RPO of 1 second and RTO of 1 minute or less, meeting the <1 minute RPO and <5 minute RTO requirements. It uses a dedicated storage-level replication channel that keeps the secondary cluster fully synchronized without impacting primary performance, and failover involves promoting the secondary cluster to primary in under a minute.

Answer

Create a cross-Region read replica in the secondary Region and promote it during failover.

Answer

Use automated backups and restore to a new DB instance in the secondary Region.

Answer

Take manual snapshots of the DB instance and copy them to the secondary Region every hour.

Question 8

A company wants to design a resilient architecture for a web application using AWS services. Which of the following is a best practice for improving resilience?

Accepted Answer

Deploy EC2 instances in multiple Availability Zones.. Deploying EC2 instances across multiple Availability Zones (AZs) is a fundamental best practice for resilience because it eliminates a single point of failure at the data center level. If one AZ experiences an outage, traffic can be automatically routed to healthy instances in other AZs via an Elastic Load Balancer (ELB), ensuring application availability. This approach aligns with the AWS Well-Architected Framework's Reliability Pillar, which mandates distributing workloads across multiple AZs to achieve high availability.

Answer

Use an Auto Scaling group in a single AZ.

Answer

Use a single AZ with RDS Multi-AZ.

Answer

Use one large EC2 instance to handle all traffic.

Question 9

A DevOps engineer receives a CloudWatch alarm indicating that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance is part of an Auto Scaling group behind an Application Load Balancer. What is the MOST efficient initial step to troubleshoot the high CPU usage?

Accepted Answer

Review the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization.. Reviewing the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization is the most efficient initial step to diagnose high CPU usage. CPU credit balance is critical for burstable performance instances (e.g., T2/T3), as a depleted credit balance directly causes sustained high CPU utilization. Network utilization metrics can reveal if the high CPU is driven by excessive traffic or a DDoS-like pattern, allowing targeted remediation without unnecessary scaling or configuration changes.

Answer

Modify the Auto Scaling group to use a larger instance type.

Answer

Check the ALB's HTTP 5xx error rate metric for the target group.

Answer

Immediately increase the desired capacity of the Auto Scaling group.

Question 10

A DevOps engineer is setting up a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build environment requires specific software packages that are not available in the default CodeBuild environment. What is the MOST efficient way to customize the build environment?

Accepted Answer

Create a custom Docker image with the required software and push it to Amazon ECR.. Creating a custom Docker image with the required software and pushing it to Amazon ECR allows you to pre-configure the build environment with all necessary packages. This approach avoids the overhead of installing packages during each build, reduces build time, and ensures consistency across builds. AWS CodeBuild supports custom images from Amazon ECR, making this the most efficient method for customizing the environment.

Answer

Create a separate pipeline to pre-build the environment.

Answer

Add install commands in the buildspec file to install the packages during each build.

Answer

Modify the buildspec file to set environment variables that include the software packages.

Question 11

A company uses AWS CodeBuild to run unit tests and package a Node.js application. The buildspec.yml file includes commands to install dependencies using npm. The build is failing with the error: 'npm ERR! code EACCES'. How should a DevOps engineer resolve this issue?

Accepted Answer

Use 'npm ci' instead of 'npm install' and ensure a package-lock.json is present. The EACCES error in CodeBuild indicates a permission issue when npm tries to write to the node_modules directory. The default CodeBuild user (usually 'codebuild-user') lacks write permissions to the project root, which is owned by root. Using 'npm ci' (clean install) is the correct resolution because it bypasses the permission issue by using the package-lock.json to install dependencies deterministically, and it does not attempt to modify the lock file or run lifecycle scripts that may require elevated permissions. Additionally, 'npm ci' is faster and more reliable in CI/CD environments like CodeBuild.

Answer

Configure the CodeBuild project to use a custom VPC with a NAT gateway for internet access

Answer

Configure the buildspec to run npm install with sudo

Answer

Add a command to change the ownership of the node_modules directory to the current user

Question 12

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must ensure that only code that passes security scanning can proceed to deployment. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Add a security scanning stage in the pipeline after the build stage and before the deploy stage.. Integrating a security scanning stage after the build stage and before the deploy stage ensures that only code that has passed security checks proceeds to deployment. This aligns with the principle of shifting security left in the CI/CD pipeline, preventing vulnerable artifacts from reaching production environments.

Answer

Use Amazon CloudWatch Events to trigger a rollback if vulnerabilities are found after deployment.

Answer

Use AWS CodeDeploy to perform security scanning during deployment.

Answer

Configure the pipeline to run security scanning only in the deploy stage.

Question 13

A DevOps engineer is implementing AWS Config rules to enforce tagging standards on resources. The rule should trigger a remediation action via AWS Systems Manager Automation to apply the correct tags if a resource is non-compliant. What is the correct way to set up this remediation?

Accepted Answer

Use the AWS Config rule's remediation action to run an AWS Systems Manager Automation document.. AWS Config rules can directly associate a remediation action using an AWS Systems Manager Automation document. When a resource is evaluated as non-compliant, Config can automatically invoke the specified SSM Automation document to apply the correct tags, without requiring intermediate services. This is the native, supported mechanism for auto-remediation of non-compliant resources.

Answer

Configure the AWS Config rule to send events to AWS CodePipeline to trigger a pipeline that fixes the tags.

Answer

Configure a CloudWatch Events rule to detect non-compliant resources and invoke a Lambda function that applies tags.

Answer

Use an SNS topic to notify administrators when a resource is non-compliant.

Question 14

A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that EBS snapshots are shared with another account without exposing the underlying data. What is the correct approach?

Accepted Answer

Share the encrypted snapshot and update the KMS key policy to allow the target account to use the key.. Sharing an encrypted EBS snapshot requires the KMS key policy to grant the target account permission to use the key (via kms:Decrypt and kms:CreateGrant). Without this, the target account cannot decrypt the snapshot to create volumes or copies. AWS KMS enforces that the key policy explicitly allows cross-account access, and the target account must have the corresponding IAM permissions.

Answer

Share the encrypted snapshot without modifying the KMS key policy.

Answer

Create an unencrypted copy of the snapshot and share it.

Answer

Share the encrypted snapshot and also share the KMS key with the target account.

Question 15

A DevOps engineer needs to receive notifications when an EC2 instance's status check fails. Which TWO services should the engineer use? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Alarms (Option E) can monitor EC2 instance status checks (both system and instance checks) and trigger an action when the alarm state changes to ALARM. Amazon SNS (Option B) is the service that delivers the notification by publishing messages to subscribers (e.g., email, SMS, HTTP endpoints) when the CloudWatch alarm triggers. Together, they provide a complete monitoring and notification pipeline for status check failures.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS Config