DOP-C02 Practice Test 17 — 15 Questions

Question 1

A DevOps team is using AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The team wants to add a manual approval step before the deploy stage to ensure that only authorized personnel can approve production deployments. Which action should be taken to implement this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a manual approval action to the pipeline between the build and deploy stages, and configure the SNS topic to notify the approvers.. AWS CodePipeline natively supports a manual approval action that can be inserted as a stage between build and deploy. This action pauses the pipeline and sends a notification via an SNS topic to the configured approvers. The pipeline only resumes when an authorized user clicks the 'Approve' button in the CodePipeline console or API, ensuring that only authorized personnel can approve production deployments.

Answer

Add an AWS Lambda function as a transition action between the build and deploy stages that sends an email to the approver and waits for a response.

Answer

Create a CodeDeploy deployment group with a manual approval step in the deployment configuration.

Answer

Configure an Amazon SNS topic to send an approval request email to the approver, and use a Lambda function to resume the pipeline upon approval.

Question 2

A company uses AWS CloudTrail to audit API activity. During an incident investigation, they find that a user with the IAM policy 'AdministratorAccess' deleted an S3 bucket. The security team wants to know the source IP address and user agent used for the delete operation. Which action should the team take to obtain this information?

Accepted Answer

View the CloudTrail event history for the delete-bucket event.. CloudTrail event history captures all management events, including DeleteBucket, and records the source IP address and user agent for each API call. By viewing the event history for the specific delete-bucket event, the security team can directly retrieve the required metadata without needing additional log sources or configurations. Option B is incorrect because S3 server access logs log object-level operations, not management events like bucket deletion. Option C is not the most direct method; CloudWatch Logs can be used if CloudTrail is configured to send events to a log group, but the simplest way is from CloudTrail event history directly. Option D is incorrect because AWS Config tracks resource configuration changes, not API call details like source IP.

Answer

Check the S3 server access logs for the deleted bucket.

Answer

Use CloudWatch Logs to search for the event in the CloudTrail log group.

Answer

Query AWS Config to find the configuration item for the bucket deletion.

Question 3

A company runs a stateful application on EC2 instances. The application stores session data locally. The instances are behind an ALB with sticky sessions enabled. A scaling event terminates an instance, causing loss of session data. How can the company prevent this while maintaining performance?

Accepted Answer

Use Amazon ElastiCache to store session data. Using ElastiCache for session storage externalizes session data, making it resilient to instance termination.

Answer

Use a dedicated EC2 instance for sessions

Answer

Disable sticky sessions

Answer

Increase the sticky session duration

Question 4

A company runs a web application on AWS that uses Amazon SQS to decouple the frontend from the backend processing. The application experiences sudden spikes in traffic, causing the SQS queue to accumulate a large number of messages. The backend workers are unable to process messages fast enough, leading to increased latency. What solution can the company implement to improve the resilience and scalability of the backend?

Accepted Answer

Configure an Auto Scaling group for the backend workers with a scaling policy based on the SQS queue depth.. Configuring an Auto Scaling group for the backend workers with a scaling policy based on the SQS queue depth (ApproximateNumberOfMessagesVisible) directly addresses the sudden traffic spikes. This approach dynamically adds more worker instances when the queue depth increases, improving processing throughput and reducing latency. It ensures the backend scales in response to demand, enhancing both resilience and scalability.

Answer

Reduce the receive message wait time (long polling) to poll the queue more frequently.

Answer

Increase the visibility timeout of the SQS queue to allow more time for processing.

Answer

Use an SQS FIFO queue instead of a standard queue to ensure ordered processing.

Question 5

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline must scan container images for vulnerabilities before deploying to Amazon ECS. Which service should the engineer use to perform the vulnerability scan?

Accepted Answer

Amazon ECR image scanning. Amazon ECR can scan images for vulnerabilities. Option A is wrong because AWS WAF is a web application firewall. Option C is wrong because AWS Config is for compliance and resource inventory. Option D is wrong because Amazon GuardDuty is a threat detection service for workloads.

Answer

AWS WAF

Answer

AWS Config

Answer

Amazon GuardDuty

Question 6

Refer to the exhibit. This S3 bucket policy allows the root user of account 111122223333 to perform which actions?

Accepted Answer

Read and write objects in the bucket. The policy grants s3:GetObject and s3:PutObject to the root user of the specified account. It does not grant other actions. The resource is objects under my-bucket. The principal is the root user of the other account.

Answer

Change the bucket policy

Answer

Delete objects from the bucket

Answer

List objects in the bucket

Question 7

A company uses AWS Lambda functions to process events from an Amazon SQS queue. The Lambda function occasionally fails due to a transient downstream service error. The DevOps team wants to ensure that failed messages are not lost and can be retried later. The team also wants to reduce the number of invocations on the downstream service. Which configuration should the team use?

Accepted Answer

Configure a dead-letter queue (DLQ) on the SQS queue and set the Lambda function's reserved concurrency to 1.. Configuring a dead-letter queue (DLQ) on the SQS queue ensures that messages that exhaust their retries (due to Lambda failures) are preserved for later reprocessing, preventing data loss. Setting the Lambda function's reserved concurrency to 1 throttles the function to a single concurrent invocation, which naturally reduces the rate of downstream service calls and allows the SQS queue's visibility timeout and redrive policy to manage retry timing, thereby reducing pressure on the downstream service.

Answer

Configure an Amazon SNS topic as a Lambda destination for failure events and subscribe the SQS queue to it.

Answer

Configure a dead-letter queue (DLQ) on the Lambda function and set the function's maximum retry attempts to 2.

Answer

Configure the Lambda function to write failed messages to an Amazon DynamoDB table and set up a scheduled Lambda to retry.

Question 8

A DevOps engineer is designing a configuration management strategy for a fleet of EC2 instances running Amazon Linux 2. The instances must be bootstrapped with custom software and continuously managed to ensure desired state compliance. Which combination of services should the engineer use?

Accepted Answer

AWS Systems Manager State Manager for desired state configuration and AWS Systems Manager Run Command for initial bootstrapping. AWS Systems Manager State Manager provides a policy-driven mechanism to define and maintain desired state configuration for EC2 instances, while AWS Systems Manager Run Command enables ad-hoc or initial bootstrapping by executing scripts or commands (e.g., installing custom software) without requiring SSH. Together, they cover both the initial setup and ongoing compliance enforcement for Amazon Linux 2 instances, aligning with the requirement for continuous management.

Answer

AWS CloudFormation for bootstrapping and Amazon CloudWatch Events to enforce desired state

Answer

AWS OpsWorks for Chef Automate for configuration management and AWS CodeDeploy for deployments

Answer

AWS Config for configuration management and Amazon CloudWatch Events for remediation

Question 9

A DevOps engineer needs to ensure that EC2 instances can access an S3 bucket without storing AWS credentials on the instances. Which solution meets this requirement?

Accepted Answer

Attach an IAM role to the EC2 instance with an S3 access policy.. Attaching an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS STS service via the instance metadata service (IMDS). The EC2 instance can then use these credentials to access the S3 bucket without any long-term AWS credentials being stored on the instance. This is the AWS-recommended best practice for granting permissions to AWS services running on EC2.

Answer

Use an S3 bucket policy that grants access to the EC2 instance's public IP.

Answer

Store access keys in the EC2 user data script.

Answer

Create an IAM user and embed credentials in the application code.

Question 10

A company is deploying a stateful application on Amazon EKS. The application requires persistent storage that can be reattached to a new pod if the original pod fails. The cluster spans multiple Availability Zones. Which storage solution provides the BEST resilience and meets these requirements?

Accepted Answer

Amazon EFS file system.. Amazon EFS provides a fully managed, regional NFS file system that can be mounted concurrently by multiple pods across different Availability Zones. It is designed for high availability and durability, automatically replicating data across multiple AZs, and supports automatic reattachment to a new pod if the original pod fails, making it the best choice for stateful applications requiring resilient, shared persistent storage on Amazon EKS.

Answer

Amazon S3 bucket with a mountpoint.

Answer

Amazon EBS with gp3 volume type.

Answer

EC2 instance store volumes.

Question 11

A media company runs a video transcoding pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple Lambda functions that transcode video files stored in Amazon S3. The company wants to implement a monitoring solution to track the progress of each workflow execution, including which step is currently running, the duration of each step, and any errors. The solution should provide near real-time visibility and allow the team to troubleshoot failed executions quickly. Which solution meets these requirements?

Accepted Answer

Use Amazon EventBridge to capture Step Functions execution status changes and build a custom dashboard in CloudWatch.. Amazon EventBridge (formerly CloudWatch Events) can capture Step Functions execution state changes (e.g., step started, succeeded, failed). These events can be used to build a custom dashboard in CloudWatch, providing near real-time visibility into workflow progress, step durations, and errors. Option A is incorrect because creating custom metrics from Lambda functions requires additional instrumentation and does not provide workflow-level context easily. Option C is incorrect because CloudWatch Logs Insights queries are not near real-time; they require searching through logs, and the solution needs real-time visibility. Option D is incorrect because AWS X-Ray provides distributed tracing for individual requests, but it does not offer high-level workflow step tracking with durations and errors aggregated across executions in near real-time.

Answer

Create custom CloudWatch metrics from Lambda functions for each step, and build a CloudWatch dashboard.

Answer

Configure each Lambda function to write logs to CloudWatch Logs with the execution ID, and use CloudWatch Logs Insights to query and visualize.

Answer

Enable AWS X-Ray tracing on the Step Functions and Lambda functions to get a service map and trace details.

Question 12

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is Blue/Green. During a recent deployment, the new instances passed all health checks, but traffic was not routed to them. What is the most likely reason?

Accepted Answer

The target group associated with the Auto Scaling group is not properly configured to route traffic.. In a Blue/Green deployment with CodeDeploy and an Auto Scaling group, traffic routing is handled by a load balancer target group. If the target group is not properly configured to route traffic to the new instances (e.g., missing or incorrect listener rules, deregistration delay, or health check thresholds), the instances may pass health checks but never receive traffic. This is the most likely cause because the deployment succeeded in provisioning and validating the new instances, but the load balancer did not forward requests to them.

Answer

The deployment group is not configured to use a load balancer.

Answer

The Auto Scaling group's lifecycle hook failed to signal readiness.

Answer

The CodeDeploy agent on the new instances is not installed.

Question 13

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team requires that all artifacts be encrypted at rest and in transit. Which configuration ensures encryption for all stages?

Accepted Answer

Enable default encryption on the S3 artifact bucket and ensure all connections use HTTPS.. Enabling default encryption on the S3 artifact bucket ensures that all artifacts stored in the bucket are encrypted at rest. Additionally, ensuring all connections use HTTPS provides encryption in transit for all communications between pipeline stages (e.g., CodeBuild downloading from S3, CodeDeploy pulling artifacts). Option A is incorrect because enabling KMS encryption on the artifact bucket is not automatic with CodePipeline; you must configure it. Moreover, SSH is not used for CodeCommit; HTTPS is the primary method. Option B is incorrect because ACM certificates are used for securing custom domain endpoints, not for encrypting pipeline artifacts at rest or in transit by default. Option D is incorrect because CodePipeline does not have a built-in encryption feature; encryption must be configured on the S3 bucket.

Answer

Enable AWS KMS encryption on the CodePipeline artifact bucket and use SSH for CodeCommit.

Answer

Use an AWS Certificate Manager (ACM) certificate for CodeBuild and CodeDeploy endpoints.

Answer

Encrypt the CodePipeline artifact using the pipeline's built-in encryption feature.

Question 14

A company uses AWS CloudFormation to deploy infrastructure. The security team wants to be notified whenever a stack is created, updated, or deleted. They also want to track who made the change. Which combination of services should be used to achieve this?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events (now Events) with SNS. CloudTrail captures CloudFormation API calls (CreateStack, UpdateStack, DeleteStack) and CloudWatch Events can trigger SNS notifications based on those API calls. Option A is wrong because Config rules evaluate resource compliance, not API events. Option C is wrong because S3 event notifications are for S3 objects. Option D is wrong because Lambda alone cannot capture who made the change without CloudTrail integration.

Answer

AWS Config rules and Amazon SNS

Answer

Amazon S3 event notifications and AWS Lambda

Answer

AWS Lambda and Amazon DynamoDB

Question 15

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. During a recent failure of one AZ, the application experienced downtime because the Auto Scaling group did not launch new instances quickly enough. What should a DevOps engineer do to improve resilience?

Accepted Answer

Configure the Auto Scaling group to span multiple AZs and enable health checks to replace unhealthy instances.. Configuring the Auto Scaling group to span multiple Availability Zones (AZs) and enabling health checks ensures that if an entire AZ fails, the Auto Scaling group can launch replacement instances in the remaining healthy AZs. The ALB health checks detect unhealthy instances and trigger the Auto Scaling group to replace them, reducing downtime. This approach leverages the fault isolation of multiple AZs and the automatic scaling capabilities of AWS Auto Scaling.

Answer

Use a larger AMI to reduce boot times.

Answer

Increase the instance size of the EC2 instances to handle more traffic.

Answer

Configure the Auto Scaling group to launch instances in a single AZ with a larger instance count.