DOP-C02 Practice Test 16 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a web application across multiple AWS accounts using StackSets. The DevOps team notices that stack instance updates are failing in some accounts with the error: 'Insufficient IAM permissions to perform the action'. The team has already verified that the StackSet IAM role has the necessary permissions. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The target accounts do not have the necessary trust policy to allow the StackSet IAM role to assume the execution role.. StackSets require a trust relationship between the StackSet IAM role (in the management account) and an execution role in each target account. Even if the StackSet IAM role has full permissions, the target accounts must have a trust policy that allows the StackSet IAM role to assume the execution role. Without this trust policy, the assumption fails, resulting in the 'Insufficient IAM permissions' error.

Answer

The target accounts have reached the limit of 200 stacks per region.

Answer

AWS Organizations has a service control policy (SCP) that denies the required action, but the StackSet IAM role has full admin permissions.

Answer

The StackSet name contains invalid characters that are not allowed in some accounts.

Question 2

A company uses AWS CloudTrail to log API activity in their AWS account. They need to ensure that any changes to CloudTrail configuration itself are detected and alerted upon in real time. Which service should they use?

Accepted Answer

Use Amazon CloudWatch Events (EventBridge) to create a rule matching the StopLogging or UpdateTrail API calls.. Amazon CloudWatch Events (EventBridge) can monitor CloudTrail API calls in real time by creating a rule that matches specific API calls such as StopLogging or UpdateTrail. When these calls are made, the rule triggers an action (e.g., SNS notification or Lambda function) to alert administrators immediately. This provides the real-time detection required for changes to CloudTrail configuration itself.

Answer

Enable AWS Config rules to monitor CloudTrail configuration changes.

Answer

Use Amazon CloudWatch Logs Insights to query CloudTrail logs for changes.

Answer

Enable Amazon GuardDuty to detect changes to CloudTrail.

Question 3

A DevOps engineer is setting up an AWS CodeBuild project that needs to access resources in a VPC, such as an Amazon RDS database. The engineer has configured the CodeBuild project to run in the VPC. Which additional configuration is required for CodeBuild to pull the build Docker image?

Accepted Answer

Create a VPC interface endpoint for Amazon ECR and configure the CodeBuild project to use it.. When a CodeBuild project runs inside a VPC, it loses default internet access, so it cannot reach public endpoints like Amazon ECR (Docker Hub or ECR) to pull the build image. A VPC interface endpoint (powered by AWS PrivateLink) creates a private, highly available connection to Amazon ECR within the VPC, allowing CodeBuild to pull images without traversing the internet. This is the correct solution because it provides direct, secure access to ECR while keeping all traffic within the AWS network.

Answer

Create a VPC peering connection to another VPC that has internet access.

Answer

Configure a VPC gateway endpoint for Amazon ECR.

Answer

Attach an internet gateway to the VPC and add a default route to it.

Question 4

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team needs to monitor application performance and troubleshoot slow API responses. They currently use Amazon CloudWatch Logs for container logs and have enabled Container Insights. However, they are unable to see detailed latency breakdowns per API endpoint. Which solution would provide the most granular visibility into API performance?

Accepted Answer

Use AWS X-Ray to instrument the application and collect trace data.. AWS X-Ray provides end-to-end tracing of requests as they travel through microservices, capturing detailed latency breakdowns per API endpoint, including downstream calls, database queries, and external HTTP requests. This gives the operations team the granular visibility needed to pinpoint exactly where slow responses occur, unlike aggregated metrics or log-based queries.

Answer

Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.

Answer

Enable CloudWatch Logs Insights to query API logs for slow requests.

Answer

Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.

Answer

Set up VPC Flow Logs to analyze network latency between services.

Question 5

A company uses AWS CodePipeline with a GitHub source action. They want to automatically start the pipeline when a pull request is merged to the main branch. However, the pipeline also starts on every push to any branch. How can they limit the pipeline to only trigger on push events to the main branch?

Accepted Answer

Configure the source action's 'Branch' field to 'main' and set 'PollForSourceChanges' to false, and use a webhook with filters.. It configures the source action to only respond to push events on the main branch by setting the 'Branch' field to 'main' and disabling polling ('PollForSourceChanges': false), while using a webhook with branch filters. This ensures that only pushes to the main branch trigger the pipeline, not pushes to any other branch.

Answer

Use a Lambda function as a source action instead of GitHub.

Answer

Create a GitHub webhook manually and point it to a Lambda function that starts the pipeline only for main branch pushes.

Answer

Add a condition in the pipeline's first stage to check the branch name.

Question 6

A company runs a critical e-commerce application on Amazon EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. The application must be resilient to an Availability Zone (AZ) failure. What is the MOST resilient configuration?

Accepted Answer

Configure the Auto Scaling group to span at least three AZs and set the ALB to route traffic to all AZs.. Spanning the Auto Scaling group across at least three Availability Zones (AZs) and routing traffic from the ALB to all AZs ensures that if one AZ fails, the remaining AZs can handle the load without interruption. This configuration leverages the ALB's native cross-zone load balancing and Auto Scaling's ability to maintain desired capacity across multiple AZs, providing fault isolation and high availability for the critical e-commerce application.

Answer

Configure the Auto Scaling group to launch instances in a single AZ with a larger instance type.

Answer

Deploy a single large EC2 instance in one AZ and use an Elastic IP for failover.

Answer

Use a Network Load Balancer instead of an ALB and deploy instances in two AZs.

Question 7

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). Recently, deployments have been failing intermittently during the deploy stage with the error: 'The service has reached its maximum number of running tasks.' How should a DevOps engineer resolve this issue?

Accepted Answer

Update the ECS service configuration to increase the maximum number of tasks. The error 'The service has reached its maximum number of running tasks' indicates that the ECS service's desired count or maximum tasks (if using a placement constraint) has been hit. Updating the ECS service configuration to increase the maximum number of tasks (or the desired count) allows the deployment to proceed by accommodating the new tasks during a rolling update. This directly resolves the capacity limit that CodeDeploy encounters when trying to launch new tasks.

Answer

Increase the memory reservation for the task definition

Answer

Configure an Amazon ECS Service Auto Scaling policy to scale out

Answer

Increase the number of concurrent deployments allowed in CodeDeploy

Question 8

A team is using AWS CloudFormation to manage infrastructure. They want to implement a change management process where any modifications to the stack must be reviewed and approved. Which feature should they use?

Accepted Answer

Change Sets. Change Sets allow you to preview how proposed changes to a CloudFormation stack will impact your running resources before you execute them. This enables a review-and-approve workflow because you can generate a change set, have a team member or automated process inspect the list of resource additions, modifications, or deletions, and then either execute or discard the change set. This directly supports the required change management process.

Answer

StackSets

Answer

Drift Detection

Answer

Stack Policy

Question 9

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with a 'HealthCheckFailed' error. The application is running, but the health check endpoint returns HTTP 500. What should the team do to resolve this issue?

Accepted Answer

Modify the application to handle the health check endpoint correctly and return HTTP 200.. The health check endpoint returns HTTP 500, indicating the application is not functioning correctly despite running. CodeDeploy uses the health check endpoint to verify the application is healthy after deployment; returning HTTP 200 is required for the deployment to succeed. The team must fix the application code to properly handle the health check endpoint and return a successful status.

Answer

Change the deployment configuration to use AllAtOnce to avoid health checks.

Answer

Increase the health check grace period in the Auto Scaling group.

Answer

Disable the health check in the CodeDeploy deployment configuration.

Question 10

A DevOps engineer is troubleshooting a CloudFormation stack that failed to update. The error message indicates a circular dependency among resources. The template includes an Auto Scaling group, a launch template, and an IAM instance profile. The launch template references the IAM instance profile, and the Auto Scaling group references the launch template. The IAM instance profile's role references the Auto Scaling group name in its trust policy. How can the engineer resolve the circular dependency?

Accepted Answer

Pass the Auto Scaling group name as a parameter to the IAM role's trust policy, and create the Auto Scaling group with a condition that depends on the role. Resolves the circular dependency by decoupling the Auto Scaling group name from the IAM role's trust policy at template creation time. By passing the group name as a parameter and using a condition to create the Auto Scaling group only after the role exists, CloudFormation can determine the correct creation order without a circular reference. This approach allows the trust policy to reference a value that is not yet known at template parsing, breaking the dependency cycle.

Answer

Use DependsOn clauses to explicitly order the resource creation

Answer

Place the launch template and Auto Scaling group in a nested stack

Answer

Hardcode the Auto Scaling group name in the IAM role's trust policy

Question 11

A company's security policy requires that all EC2 instances must be launched with an IAM role that provides least privilege access. A DevOps engineer needs to enforce this across the organization. Which approach is MOST effective?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance is launched with the required IAM role, and attach it to all users. Attaching an IAM policy to all users that denies ec2:RunInstances unless the instance is launched with the required IAM role directly enforces the requirement. Option A (SCP denying if not the approved role) is incorrect because SCPs cannot check for a specific role attachment at launch time; they only control permissions at the account level. Option B (SCP denying unless instance profile attached) only requires any instance profile, not specifically the approved one. Option C (AWS Config + Lambda) is reactive and can have delays, so it is less effective than a preventive IAM policy.

Answer

Create an SCP that denies ec2:RunInstances if the specified IAM role is not the approved role

Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action unless an instance profile is attached

Answer

Use AWS Config to detect instances without the required role and terminate them via Lambda

Question 12

A DevOps engineer is tasked with centralizing logs from multiple AWS accounts into a single Amazon OpenSearch Service domain. The engineer sets up Amazon Kinesis Data Firehose to deliver logs from each account to the OpenSearch domain. However, some accounts show failed deliveries in the Firehose console. Which configuration is MOST likely causing the failures?

Accepted Answer

The IAM role assumed by Firehose in each account does not have permissions to write to the cross-account OpenSearch domain. The most likely cause of failed deliveries is that the IAM role assumed by Kinesis Data Firehose in each source account lacks the necessary permissions to write to the cross-account Amazon OpenSearch Service domain. Firehose uses a service-linked or custom IAM role to perform actions such as `es:ESHttpPut` and `es:ESHttpPost` against the OpenSearch domain endpoint. Without explicit cross-account trust and resource-based policy allowing the Firehose role's ARN, the delivery will fail with an authorization error.

Answer

The source accounts do not have a CloudWatch Logs subscription filter to send logs to Firehose

Answer

The Kinesis Data Streams used as the Firehose source is not encrypted

Answer

The OpenSearch domain's access policy does not allow access from the S3 bucket used by Firehose

Question 13

A company uses AWS CloudFormation to deploy infrastructure. The stack creation fails with the error: 'Resource handler returned message: 'The security group does not exist in VPC'.' The template references a security group by name. What is the MOST likely cause?

Accepted Answer

The security group name is misspelled or uses incorrect case. The error 'Resource handler returned message: The security group does not exist in VPC' occurs when CloudFormation cannot find a security group with the specified name in the target VPC. The most likely cause is a misspelling or case sensitivity issue (Option A), as CloudFormation matches security group names exactly. While region scoping (Option C) can also cause a similar error, the combination of a name-based reference and the specific error wording points to a name mismatch as the most common issue. IAM permission errors (Option B) would typically return an authorization error, not a 'does not exist' error. Option D is incorrect because a default VPC security group exists and would not cause this error unless it is missing, which is unlikely.

Answer

The IAM role used for CloudFormation does not have permissions to describe security groups

Answer

The stack is being created in a Region where the security group does not exist

Answer

The template uses a parameter that resolves to the default VPC security group

Question 14

A company uses AWS OpsWorks for configuration management. The DevOps team wants to deploy a new application version to a stack of EC2 instances. What should the team use to perform the deployment?

Accepted Answer

Custom Chef recipes in OpsWorks. AWS OpsWorks is a configuration management service that uses Chef. When you need to deploy a new application version to a stack of EC2 instances managed by OpsWorks, the native and recommended approach is to use custom Chef recipes. These recipes can be executed as a lifecycle event (e.g., Deploy) to update application code, restart services, or perform any deployment tasks directly on the instances, leveraging the existing OpsWorks agent and Chef infrastructure.

Answer

AWS Elastic Beanstalk

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 15

An application running on Amazon ECS experiences intermittent failures. The DevOps engineer wants to capture the application's standard output and error logs and send them to CloudWatch Logs. What is the simplest way to achieve this?

Accepted Answer

Use the awslogs log driver in the task definition.. The awslogs log driver is the simplest native integration between Amazon ECS and CloudWatch Logs. By specifying the log driver in the task definition, the ECS container agent automatically captures stdout and stderr from the container and streams them to CloudWatch Logs without any additional agents or custom code.

Answer

Install the CloudWatch Agent in each container.

Answer

Configure AWS CloudTrail to capture logs.

Answer

Write logs to a file and use an S3 bucket with event notifications.