DOP-C02 Practice Test 16 — 15 Questions

Question 1

A DevOps engineer is designing a monitoring solution for a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The team needs to monitor for errors and latency. Which TWO actions should the engineer take to implement comprehensive monitoring? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS X-Ray tracing on API Gateway and Lambda.. AWS X-Ray provides end-to-end tracing for requests as they travel through API Gateway, Lambda, and DynamoDB, enabling the team to identify latency bottlenecks and errors across the entire serverless application. This is essential for comprehensive monitoring of distributed applications, as it captures detailed timing and error data for each component.

Answer

Enable DynamoDB Accelerator (DAX) to reduce latency.

Answer

Enable detailed billing metrics for cost analysis.

Answer

Configure CloudWatch Logs for DynamoDB.

Question 2

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project's artifacts are automatically deployed to an Amazon S3 bucket with server-side encryption using AWS KMS? (Choose 2.)

Accepted Answer

In the buildspec.yaml, set the 'artifacts' section to include 'encryptionDisabled: false' and specify the KMS key ID.. Setting 'encryptionDisabled: false' in the buildspec.yaml artifacts section explicitly enables encryption for the build output, and specifying the KMS key ID ensures that the artifacts are encrypted with that specific AWS KMS key. This configuration directly instructs CodeBuild to use server-side encryption with AWS KMS when uploading artifacts to S3.

Answer

Enable versioning on the S3 bucket.

Answer

Configure the S3 bucket policy to require HTTPS for all uploads.

Answer

Enable default encryption on the S3 bucket using SSE-KMS.

Question 3

Refer to the exhibit. A DevOps engineer ran the above AWS CLI command after a CloudFormation stack update. What does the status 'ROLLBACK_COMPLETE' indicate?

Accepted Answer

The stack update failed and CloudFormation reverted to the previous stack.. The 'ROLLBACK_COMPLETE' status indicates that the CloudFormation stack update operation failed, and CloudFormation automatically reverted the stack to its previous stable state. This is a built-in safety mechanism: if any resource fails to update, CloudFormation triggers a rollback to undo all changes made during the update, ensuring the stack returns to its last known good configuration.

Answer

The stack update is in progress.

Answer

The stack was deleted successfully.

Answer

The stack was created successfully.

Question 4

A company uses Amazon CloudWatch Synthetics canaries to monitor endpoint availability. The canaries are failing intermittently with timeout errors. The DevOps team needs to diagnose the issue. Which THREE aspects should they investigate?

Accepted Answer

The canary script execution time and memory usage.. Canary scripts have a maximum execution time of 5 minutes (300 seconds) and a memory limit of 1 GB. If the script execution time or memory usage exceeds these limits, the canary will fail with a timeout error. Investigating these metrics in CloudWatch can reveal whether the script is too resource-intensive or slow, causing the intermittent failures.

Answer

The canary schedule and frequency.

Answer

CloudWatch Logs retention policy for the canary logs.

Question 5

A company uses AWS CodeBuild to compile and test code. The buildspec.yml file includes commands that require access to a private S3 bucket. The DevOps engineer wants to securely provide AWS credentials to the build project. What is the recommended approach?

Accepted Answer

Use a service role for CodeBuild with appropriate permissions. The recommended approach is to use a service role for CodeBuild with appropriate permissions. CodeBuild can assume an IAM role that grants the build project access to the private S3 bucket, eliminating the need to manage long-term credentials. This follows AWS best practices for secure credential management by using temporary, automatically rotated credentials via the AWS Security Token Service (STS).

Answer

Store the AWS access key ID and secret access key in the buildspec.yml file

Answer

Use an EC2 instance profile attached to the build environment

Answer

Pass the credentials as environment variables in the build project configuration

Question 6

A company uses AWS CloudFormation StackSets to deploy a common security group across multiple accounts in an AWS Organization. The security group must allow inbound traffic from the organization's central VPN CIDR range. The VPN CIDR range is stored in AWS Systems Manager Parameter Store. How should the engineer reference this parameter in the StackSet template to ensure the value is resolved at deployment time?

Accepted Answer

Use the dynamic reference '{{resolve:ssm:/org/vpn/cidr}}' in the template.. CloudFormation dynamic references ({{resolve:ssm:/org/vpn/cidr}}) allow you to retrieve the current value of an SSM Parameter Store parameter at stack deployment time, without needing to pass it as a parameter or create a separate resource. This ensures the security group rule always uses the latest VPN CIDR value stored in Parameter Store, even if the CIDR changes between deployments.

Answer

Use Fn::ImportValue with an export from another stack that reads the parameter.

Answer

Use the Ref function on the parameter name as a CloudFormation parameter.

Answer

Use Fn::GetAtt to retrieve the parameter value from an AWS::SSM::Parameter resource.

Question 7

A company is migrating to a microservices architecture on Amazon ECS with AWS Fargate. They want to automate the deployment process using AWS CodePipeline. The pipeline should build a Docker image, push it to Amazon ECR, and deploy the updated service to ECS. Which THREE components are required in the pipeline? (Choose 3.)

Accepted Answer

Deploy stage with AWS CodeDeploy to ECS.. AWS CodeDeploy is the native deployment service that integrates with Amazon ECS to perform blue/green deployments, rolling updates, and traffic shifting. In a CodePipeline, the Deploy stage uses CodeDeploy to orchestrate the ECS service update, ensuring zero-downtime deployments by managing task set creation and load balancer target group routing.

Answer

Manual approval stage.

Answer

Test stage with AWS CodeBuild to run unit tests.

Question 8

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. The team wants to automate the response to an instance failure. Which THREE steps should be taken to ensure automatic recovery and notification?

Accepted Answer

Configure Auto Scaling to replace unhealthy instances. Configuring the Auto Scaling group to replace unhealthy instances ensures that when an instance fails health checks, Auto Scaling automatically terminates it and launches a new instance to maintain the desired capacity. This is the core mechanism for automated recovery in an Auto Scaling group, as it directly responds to instance failure without manual intervention.

Answer

Create a CloudWatch alarm to terminate the instance

Answer

Create a scaling policy based on CPU utilization

Question 9

Drag and drop the steps to implement a blue/green deployment using AWS CodeDeploy.

Accepted Answer

Create application -> Create deployment group with blue/green settings -> Deploy -> Validate deployment -> Reroute traffic. First create the application and deployment group, then configure blue/green settings, then deploy, then validate, then reroute traffic.

Answer

Create application -> Deploy -> Create deployment group -> Validate -> Reroute traffic

Answer

Create deployment group -> Create application -> Deploy -> Validate -> Reroute traffic

Answer

Create application -> Create deployment group -> Configure blue/green settings -> Validate -> Deploy -> Reroute traffic

Question 10

A team manages a large fleet of EC2 instances using AWS Systems Manager. They want to enforce a consistent configuration across all instances, including installed software packages, firewall rules, and user accounts. The team also needs to audit configuration changes and remediate drift automatically. Which AWS service should the team use?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct choice because it is designed to enforce a consistent configuration across EC2 instances by defining and applying desired state configurations (DSCs). It can manage software packages, firewall rules, and user accounts, and it automatically remediates drift by re-applying the desired state on a schedule. This directly meets the requirement for configuration enforcement, auditing, and automated drift remediation.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS Systems Manager Run Command

Answer

AWS Config

Question 11

A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)

Accepted Answer

Run Command. Run Command (A) is correct because it allows you to remotely and securely execute scripts or commands across EC2 instances without needing SSH or RDP, using an SSM document (SSM Document) that defines the desired configuration actions. This capability directly enforces a desired state by running idempotent scripts on demand or on a schedule.

Answer

OpsCenter

Answer

Parameter Store

Question 12

A company wants to ensure that its application can recover from an Amazon S3 service disruption. The application reads and writes data to S3. Which strategy should the application implement to achieve resilience?

Accepted Answer

Implement application logic to fall back to an S3 bucket in a different Region if the primary bucket is unavailable. Implementing application logic to fall back to an S3 bucket in a different Region provides resilience against a regional S3 service disruption. S3 buckets are regional resources, so if one Region experiences an outage, the application can redirect reads and writes to a bucket in another Region. This approach requires the application to handle errors from the primary bucket and switch to the secondary bucket, ensuring continued availability without relying on automatic failover mechanisms that may not be instantaneous.

Answer

Store all data in a single S3 bucket with versioning enabled

Answer

Enable S3 Cross-Region Replication with automatic failover

Answer

Use S3 Transfer Acceleration to improve data transfer speed

Question 13

A company uses AWS Lambda with Amazon DynamoDB to process orders. During peak hours, the Lambda function sometimes fails with throttling errors from DynamoDB. The system must be resilient and cost-effective. What should a DevOps engineer do?

Accepted Answer

Configure DynamoDB auto scaling and implement a dead-letter queue in Lambda to retry failed events.. Configuring DynamoDB auto scaling allows the table to adjust its provisioned capacity based on actual traffic patterns, preventing throttling during peak hours while remaining cost-effective during low usage. Implementing a dead-letter queue (DLQ) in Lambda ensures that failed events (e.g., due to transient throttling) are captured and can be retried or investigated, providing resilience without manual intervention.

Answer

Use Amazon SQS to buffer the requests and have Lambda pull from the queue with a reserved concurrency limit.

Answer

Increase the DynamoDB provisioned read and write capacity units to a high fixed value.

Answer

Provision DynamoDB Accelerator (DAX) to cache reads and reduce throttling.

Question 14

A DevOps engineer needs to set up a monitoring solution for an application running on Amazon EKS. The application emits custom metrics that need to be stored in Amazon CloudWatch and visualized on a dashboard. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch agent to emit custom metrics to CloudWatch.. The CloudWatch agent can be configured to emit custom application metrics to Amazon CloudWatch, which is the required destination for storing the metrics. The agent uses the CloudWatch PutMetricData API to send these metrics, enabling centralized monitoring and alerting within CloudWatch.

Answer

Use CloudWatch Logs Insights to analyze the custom metrics.

Answer

Use Amazon Managed Service for Prometheus to scrape the metrics.

Question 15

Refer to the exhibit. A DevOps engineer runs the above commands. The build project 'my-project' uses an S3 bucket as source and another S3 bucket for artifacts. The build fails with an 'Access Denied' error when trying to download the source code. What is the most likely cause?

Accepted Answer

The service role does not have s3:GetObject permission on the source bucket. The build project 'my-project' uses an S3 bucket as the source. When CodeBuild downloads source code from S3, the service role must have the s3:GetObject permission on the source bucket. The 'Access Denied' error indicates that the role lacks this permission, making option B the most likely cause.

Answer

The encryption key is a KMS key that the role cannot access

Answer

The source type is S3, but the project expects CodeCommit

Answer

The source location is incorrect