DOP-C02 Practice Test 17 — 15 Questions

Question 1

A company wants to implement a least-privilege security model for its IAM users. Which TWO practices should be applied?

Accepted Answer

Use IAM policy conditions to restrict access based on IP address or time of day.. IAM policy conditions allow you to restrict access based on attributes like IP address (using the `aws:SourceIp` condition key) or time of day (using `aws:CurrentTime`). This enforces least-privilege by limiting when and from where actions can be performed, reducing the attack surface without over-provisioning permissions.

Answer

Use only resource-based policies to manage permissions.

Answer

Attach the AdministratorAccess managed policy to all IAM users.

Answer

Use the AWS account root user for daily administrative tasks.

Question 2

Which THREE actions can be performed using the AWS CLI for CodeDeploy? (Choose three.)

Accepted Answer

create-deployment. The `create-deployment` command is correct because it is the primary AWS CLI operation used to start a new deployment in CodeDeploy. It triggers the deployment of a revision (application code and configuration) to a specified deployment group, making it a core action for automating SDLC pipelines.

Answer

push-revision

Answer

register-instance

Question 3

A DevOps engineer needs to manage configuration files across a fleet of Amazon EC2 instances running Amazon Linux. The configuration files must be updated whenever they change in an S3 bucket. Which AWS service is most suitable for this task?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the most suitable service because it provides a configuration management solution that can automatically apply and maintain the desired state of EC2 instances. It can be configured to run associations on a schedule or in response to events, such as changes to an S3 bucket, using an AWS Lambda trigger or EventBridge rule to invoke the association. This ensures that configuration files are updated whenever they change in the S3 bucket, without requiring manual intervention or a full configuration management platform.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS CloudFormation

Answer

AWS Config

Question 4

A company is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must tolerate a Regional failure. Which design provides the most resilience?

Accepted Answer

Use DynamoDB global tables with Lambda functions deployed in multiple Regions and Route 53 multi-Region routing. DynamoDB global tables provide multi-Region, fully replicated tables with automatic conflict resolution, ensuring data availability during a Regional outage. Deploying Lambda functions in multiple Regions with Route 53 multi-Region routing (using health checks and latency-based or weighted routing) allows traffic to fail over to a healthy Region, making the entire serverless stack resilient to a Regional failure.

Answer

Use Lambda@Edge to run functions at AWS edge locations

Answer

Use DynamoDB auto-scaling and run Lambda in a single Region

Answer

Use DynamoDB Accelerator (DAX) to cache data across Regions

Question 5

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails because the new instances cannot connect to the database. The previous deployment succeeded. The DevOps engineer checks the CodeDeploy deployment configuration and finds that the deployment uses the 'CodeDeployDefault.AllAtOnce' configuration. What is the MOST likely cause of the failure?

Accepted Answer

The deployment replaced all instances at once, causing a temporary loss of connectivity if the new application version has incompatible changes.. The 'CodeDeployDefault.AllAtOnce' deployment configuration causes CodeDeploy to attempt to deploy the new application revision to all instances in the Auto Scaling group simultaneously. If the new application version contains incompatible changes—such as a database schema mismatch, altered connection strings, or missing environment variables—all instances will fail at the same time, resulting in a complete loss of connectivity to the database. This contrasts with a rolling or canary deployment, which would limit the blast radius by updating only a subset of instances at a time.

Answer

The load balancer health check is misconfigured, causing new instances to be deregistered.

Answer

The deployment group is not configured to handle traffic routing, causing a routing loop.

Answer

The security group for the Auto Scaling group was updated during deployment, blocking database access.

Question 6

A company uses AWS KMS to encrypt data in S3. The security team requires that the key material be rotated every 90 days. What should be done to meet this requirement?

Accepted Answer

Create a customer managed key and manually rotate it every 90 days.. AWS KMS customer managed keys support manual rotation, which allows you to rotate the key material every 90 days as required. Automatic key rotation for customer managed keys is only available with a minimum rotation period of 365 days (yearly), so it cannot meet a 90-day requirement. Manual rotation creates a new backing key while retaining the old one for decryption of previously encrypted data, ensuring compliance with the 90-day rotation policy.

Answer

Create a customer managed key and enable automatic yearly rotation.

Answer

Use an AWS managed key (SSE-S3) and enable rotation.

Answer

Use a custom key store with imported key material and enable automatic rotation.

Question 7

A DevOps team is using AWS Elastic Beanstalk to deploy a web application. They need to customize the software configuration on the EC2 instances that are part of the Elastic Beanstalk environment. Which THREE methods can they use? (Choose THREE.)

Accepted Answer

Use saved configurations to create reusable environment templates. Saved configurations in Elastic Beanstalk allow you to capture the environment's settings, including custom software configurations, and reuse them as templates for future environments. This enables consistent deployment without manual reconfiguration, directly addressing the need to customize software on EC2 instances.

Answer

Create a custom AMI with the desired configuration

Answer

Use OpsWorks to manage the instances

Question 8

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The DevOps engineer notices that the pipeline fails intermittently during the deploy stage with the error: 'The deployment failed because the deployment group does not exist'. What is the most likely cause?

Accepted Answer

The deployment group was deleted or renamed after the pipeline was configured. The intermittent 'deployment group does not exist' error indicates that the deployment group referenced in the CodePipeline deploy stage configuration is missing at the time of execution. This most commonly occurs when the deployment group has been deleted or renamed after the pipeline was initially configured, causing the pipeline to reference a non-existent resource. Since the error is intermittent, it suggests the deployment group may be deleted and recreated or renamed during certain operations, rather than a permanent misconfiguration.

Answer

The Auto Scaling group associated with the deployment group has insufficient capacity

Answer

The CodePipeline service role does not have permission to call CodeDeploy

Answer

The CodeDeploy application name in the pipeline is misspelled

Question 9

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. What is the most likely cause?

Accepted Answer

The Lambda function is not configured to access the VPC where the RDS instance resides.. The most likely cause of the timeout error is that the Lambda function is not configured to access the VPC where the RDS instance resides. When Secrets Manager rotates a secret for an RDS database, the rotation Lambda function must connect to the database to update the credentials. If the Lambda function is not attached to the same VPC (or a VPC with proper routing and security group rules), it cannot reach the RDS instance, causing network connection attempts to hang until the function times out.

Answer

The Lambda function's execution role lacks the required IAM permissions.

Answer

The secret rotation schedule is set to less than 24 hours.

Answer

The Lambda function does not have permission to access the S3 bucket.

Question 10

A team uses AWS CodePipeline to deploy a containerized application to Amazon ECS. The pipeline uses a source stage from CodeCommit, a build stage that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that updates an ECS service. The team wants to add a manual approval step before the deploy stage to allow QA to verify the image. What is the BEST way to implement this?

Accepted Answer

Add a manual approval stage in CodePipeline between the build and deploy stages, and configure SNS to notify approvers.. CodePipeline natively supports manual approval actions that pause the pipeline at a specified stage and wait for an approver to manually approve or reject the transition. By adding a manual approval stage between the build and deploy stages, the pipeline will automatically halt after the build completes, and you can configure Amazon SNS to notify the QA team via email or other endpoints when their approval is required. This approach requires no custom infrastructure, integrates directly with the pipeline's state machine, and provides a built-in audit trail of approvals.

Answer

Configure an AWS Lambda function in the pipeline that checks a DynamoDB table for approval status and pauses until approved.

Answer

Use an Amazon SNS topic to send a notification to QA, and have them manually trigger the deploy stage by clicking a link in the email.

Answer

Use Amazon CloudWatch Events to trigger a custom action that waits for an approval signal.

Question 11

A DevOps team is designing a CI/CD pipeline for a containerized application. Which THREE components are essential for a complete pipeline? (Choose three.)

Accepted Answer

Artifact storage. Artifact storage (Option B) is essential because a complete CI/CD pipeline must store build outputs (e.g., Docker images, JAR files) in a durable, versioned repository. Without artifact storage, subsequent deployment stages cannot reliably retrieve the exact build artifact that passed testing, breaking traceability and rollback capabilities. Services like Amazon ECR or S3 serve this role, ensuring immutability and consistent delivery across environments.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Question 12

Drag and drop the steps to perform a disaster recovery failover from a primary region to a secondary region using AWS Route 53 and RDS.

Accepted Answer

Configure health checks, then lower TTL, then promote RDS, then update DNS, then verify. First configure health checks, then lower TTL, then promote RDS, then update DNS, then verify.

Answer

Lower TTL, then configure health checks, then promote RDS, then update DNS, then verify

Answer

Configure health checks, then promote RDS, then lower TTL, then update DNS, then verify

Answer

Configure health checks, then update DNS, then lower TTL, then promote RDS, then verify

Question 13

A DevOps engineer needs to automate the creation of an Amazon ECS cluster using AWS CloudFormation. The cluster will run a web application that requires a load balancer. Which resource should be used to define the ECS cluster?

Accepted Answer

AWS::ECS::Cluster. The AWS::ECS::Cluster resource is the correct CloudFormation resource to define an ECS cluster, which serves as the logical grouping of container instances or Fargate tasks. The question specifically asks for the resource that defines the cluster itself, not the services or tasks running within it. A load balancer can be associated with the cluster via an AWS::ECS::Service resource, but the cluster definition is solely handled by AWS::ECS::Cluster.

Answer

AWS::ECS::Service

Answer

AWS::ECS::TaskDefinition

Answer

AWS::ECS::ContainerInstance

Question 14

A DevOps engineer receives an alert that an Amazon S3 bucket has become publicly accessible. The engineer needs to identify who made the bucket public. Which AWS service should the engineer use to find the API call that changed the bucket policy?

Accepted Answer

AWS CloudTrail. CloudTrail records all S3 API calls, including bucket policy changes. Option A is wrong because CloudWatch monitors metrics. Option C is wrong because Config records configuration changes but not the identity. Option D is wrong because GuardDuty detects threats but doesn't log API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon GuardDuty

Question 15

A company runs a critical web application on AWS. The application is deployed on EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group across multiple Availability Zones. The company uses Amazon Route 53 for DNS with a failover routing policy. Recently, the operations team noticed that during a regional outage, the failover did not trigger as expected, and users experienced downtime. The health checks in Route 53 are configured to check the ALB endpoint. The ALB's health checks are configured to check the instances. What is the MOST likely reason the failover did not work?

Accepted Answer

The ALB remained healthy during the regional outage, so Route 53 did not fail over.. Route 53 health checks are configured to check the ALB endpoint. During a regional outage, if the ALB itself remains healthy (e.g., the outage only affected the instances but not the ALB), the health check passes, so Route 53 does not trigger failover. This leads to users experiencing downtime because the instances behind the ALB are unhealthy, but Route 53 still directs traffic to the primary region. Option B is incorrect because failover with Route 53 is automatic when a health check fails; no manual intervention is required. Option C is incorrect because Route 53 health checks do not need to check instance IPs; checking the ALB is sufficient for failover as long as the ALB's health reflects instance health, but in this case it doesn't. Option D is incorrect because Route 53 can failover to a different region when the primary endpoint becomes unhealthy, but the condition for failover (health check failure) was not met.

Answer

The failover routing policy requires manual intervention to switch traffic.

Answer

Route 53 health checks were not configured for the instance IP addresses.

Answer

Route 53 cannot failover to a different region when the primary endpoint is still reachable.