DOP-C02 Practice Test 19 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running behind an Application Load Balancer. The DevOps team notices that during deployments, the new application version fails health checks and the deployment rolls back. The team wants to reduce deployment time while maintaining safety. Which configuration change should the engineer recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the deployment policy to immutable.. The immutable deployment policy in AWS Elastic Beanstalk creates a new Auto Scaling group with fresh instances running the new application version, performs health checks, and only then swaps the environment's target group to route traffic to the new fleet. This avoids the rolling update's problem of health check failures on existing instances (which trigger a rollback) and ensures the entire new environment is validated before any traffic is shifted. While immutable deployments can take longer than a successful rolling update because they provision a full new fleet, they reduce overall deployment time in this scenario by preventing repeated failed deployments and rollbacks, and they maintain safety by not exposing partially updated instances.

Answer

Increase the number of EC2 instances in the environment.

Answer

Use the all-at-once deployment policy.

Answer

Increase the rolling update batch size to 100%.

Question 2

A company is experiencing a DDoS attack on their web application hosted on Amazon EC2 behind an Application Load Balancer (ALB). The attack is causing high CPU utilization on the instances. The security team needs to mitigate the attack with minimal disruption to legitimate users. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Configure AWS WAF rate-based rules to block excessive requests from specific IP addresses.. AWS WAF rate-based rules are designed to automatically block IP addresses that exceed a specified request rate, which directly mitigates DDoS attacks by limiting excessive traffic from specific sources. This approach minimizes disruption to legitimate users because it only blocks IPs that exceed the threshold, preserving access for normal traffic patterns.

Answer

Enable AWS Shield Advanced on the ALB for additional DDoS protection.

Answer

Scale up the EC2 instances by increasing their instance size.

Answer

Place an Amazon CloudFront distribution in front of the ALB to cache content.

Question 3

Refer to the exhibit. An IAM policy is attached to a role used by a CI/CD system. The policy is intended to allow starting the pipeline 'MyPipeline' from the same account. However, the CI/CD system receives an 'AccessDenied' error when trying to start the pipeline. What is the problem?

Accepted Answer

The Deny statement with the 'aws:SourceAccount' condition denies access if the condition key is not present in the request.. The Deny statement with the `aws:SourceAccount` condition key denies access unless the request includes that condition key. When the CI/CD system assumes the role and makes a `StartPipelineExecution` API call, the request context does not automatically include the `aws:SourceAccount` key unless explicitly added by the caller. Since the condition is not satisfied, the Deny statement applies, resulting in an 'AccessDenied' error even though the Allow statement grants the necessary action.

Answer

The Allow statement does not specify the correct pipeline ARN.

Answer

The policy needs an additional Allow for 'codepipeline:GetPipeline' to start the pipeline.

Answer

The role does not have permission to pass the policy to the CI/CD system.

Question 4

A company uses AWS CodeBuild to compile and test code. The buildspec.yaml includes a pre_build phase that runs 'aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com'. The build fails with 'Error: Cannot connect to the Docker daemon'. What is the most likely cause?

Accepted Answer

The CodeBuild project does not have privileged mode enabled.. The error 'Cannot connect to the Docker daemon' indicates that the Docker daemon is not running or inaccessible within the CodeBuild build environment. CodeBuild runs Docker commands inside a container that does not have a Docker daemon by default. To execute Docker commands (such as docker login or docker build), the CodeBuild project must be configured with privileged mode enabled, which grants the container elevated permissions to run its own Docker daemon. Without privileged mode, any attempt to interact with the Docker daemon will fail.

Answer

The region specified does not match the ECR repository region.

Answer

The Docker login command syntax is incorrect.

Answer

The AWS CLI is not installed in the CodeBuild environment.

Question 5

A company uses Amazon RDS for MySQL as its database. The operations team notices that the database CPU utilization is consistently above 90% during peak hours, causing slow query responses. The team needs to quickly reduce CPU load without changing the application code. Which action should the team take?

Accepted Answer

Enable Performance Insights and analyze the top queries.. Enabling Performance Insights allows the team to identify the specific queries that are consuming CPU resources. By analyzing these top queries, the team can take targeted actions such as optimizing queries or adding indexes to reduce CPU load without changing application code. Option A is incorrect because Multi-AZ deployment provides high availability and failover support but does not reduce CPU utilization. Option B is incorrect because increasing max_connections allows more concurrent connections, which can actually increase CPU load rather than reduce it. Option C is incorrect because adding a read replica offloads read traffic but does not reduce CPU load on the primary instance, and typically requires application changes to route read queries to the replica.

Answer

Enable Multi-AZ deployment.

Answer

Modify the DB parameter group to increase max_connections.

Answer

Add a read replica to offload read traffic.

Question 6

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

Accepted Answer

Create an IAM user with administrator access and use that instead. Best practices for root user include enabling MFA, using a strong password, and not using root for daily tasks. Deleting the root user is not possible. Access keys should not be created for root user.

Answer

Use the root user for daily administrative tasks

Answer

Create access keys for the root user to use with CLI

Answer

Delete the root user after creating an IAM admin user

Question 7

A DevOps engineer is troubleshooting an AWS CloudFormation stack that failed to create. The error message indicates that a resource 'AWS::Lambda::Function' timed out while being created. The Lambda function code is packaged as a ZIP file in Amazon S3. What is the most likely cause?

Accepted Answer

The Lambda deployment package is very large, causing the S3 download to exceed the resource creation timeout.. AWS CloudFormation has a default timeout for creating resources, and if the Lambda deployment package is very large, downloading it from S3 can exceed that timeout. Option A is incorrect because the Lambda function's timeout setting (e.g., 3 seconds) applies to function execution, not to the creation process; the creation timeout is controlled by CloudFormation. Option B is incorrect because if the execution role lacks permissions to download the ZIP file, it would result in an access denied error, not a timeout. Option D is incorrect because the CloudFormation service role permissions affect stack operations broadly, but they do not directly cause a resource-specific timeout; the timeout here is due to package size.

Answer

The Lambda function has a very short timeout (e.g., 3 seconds) configured in the function properties.

Answer

The Lambda function's execution role does not have permission to download the ZIP file from S3.

Answer

The CloudFormation service role does not have permissions to create Lambda functions.

Question 8

A DevOps engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role attached with a policy that allows s3:GetObject. The S3 bucket policy explicitly denies access to the instance's role. What is the result?

Accepted Answer

Access is denied because the bucket policy explicitly denies. An explicit deny in any policy overrides any allow. The bucket policy deny takes precedence over the IAM role allow, so access is denied. Evaluation logic is that an explicit deny prevents access.

Answer

Access is denied only if the bucket is encrypted

Answer

Access is allowed only if the instance is in the same region

Answer

Access is allowed because the IAM role allows it

Question 9

A DevOps engineer is tasked with setting up a centralized logging solution for a multi-account AWS environment. Which service should be used to aggregate logs from multiple accounts?

Accepted Answer

Amazon CloudWatch Logs with cross-account subscription. Amazon CloudWatch Logs can aggregate logs across accounts using cross-account subscriptions with a central destination (e.g., Kinesis or Lambda). Option C is correct. Option A is incorrect because S3 is a storage service, not for real-time aggregation. Option B is incorrect as CloudTrail is for API activity, not application logs. Option D is incorrect because AWS Config is for configuration compliance.

Answer

Amazon S3 with cross-region replication

Answer

AWS CloudTrail with organization trails

Answer

AWS Config with aggregated compliance rules

Question 10

Refer to the exhibit. A DevOps engineer sees the following error when trying to update a CloudFormation stack: 'Stack [arn:aws:cloudformation:us-west-2:123456789012:stack/MyStack/abc123] is in ROLLBACK_COMPLETE state and can not be updated.' What should the engineer do to proceed?

Accepted Answer

Delete the stack and create a new one with the updated template.. When a CloudFormation stack reaches the ROLLBACK_COMPLETE state, it means the stack creation or update failed and the rollback has finished, leaving the stack in a terminal state. CloudFormation does not allow updates or rollback continuation on stacks in this state. The only supported action is to delete the stack and create a new one with the corrected template, as stated in the AWS documentation.

Answer

Run 'aws cloudformation continue-update-rollback' to finish the rollback and then update.

Answer

Modify the stack's template and try the update again.

Answer

Use the 'aws cloudformation resume-update' command to resume the update.

Question 11

A company uses AWS Elastic Beanstalk for deploying a web application. The development team wants to implement a blue/green deployment strategy to minimize downtime. Which approach should they use?

Accepted Answer

Create a new Elastic Beanstalk environment and swap the environment CNAMEs.. In AWS Elastic Beanstalk, blue/green deployment is achieved by creating a separate environment (the green environment) alongside the existing one (the blue environment), deploying the new application version to it, and then swapping the CNAME records of the two environments. This swap is instantaneous at the DNS level, resulting in zero downtime because traffic is immediately redirected from the old environment to the new one without any instance replacement or gradual shifting.

Answer

Update the Auto Scaling group launch configuration and gradually replace instances.

Answer

Create a new CodeDeploy deployment group and use the blue/green deployment configuration.

Answer

Create a new target group and register instances from the old environment.

Question 12

A company uses AWS OpsWorks for Chef Automate. They have a stack that includes a PHP application layer. The application requires a custom PHP configuration file. The DevOps engineer creates a custom Chef cookbook with a recipe that deploys the configuration file. The recipe is assigned to the layer's Setup lifecycle event. The engineer notices that the configuration file is not being created on new instances when they are added to the layer. The cookbook is stored in a private S3 bucket. The engineer has verified that the cookbook is correctly associated with the stack. What should the engineer do to fix the issue?

Accepted Answer

Ensure that the instance profile has permissions to read from the S3 bucket where the cookbook is stored. The issue is that the custom cookbook is stored in a private S3 bucket. For new instances to access the cookbook during the Setup lifecycle event, the instance must have the necessary IAM permissions to read from that S3 bucket. The instance profile attached to the OpsWorks stack's instances must include a policy that grants s3:GetObject for the cookbook's S3 bucket. Without these permissions, the instance cannot download the cookbook, so the recipe never runs. Therefore, the engineer should ensure that the instance profile has permissions to read from the S3 bucket. Option A is incorrect because the Setup lifecycle event is appropriate for deploying configuration files when the instance is being set up; moving to Configure would run later and might not achieve the same result. Option B is incorrect because the issue is not about the recipe being in default.rb; the cookbook is correctly associated, and the recipe is assigned to the layer lifecycle event directly, not necessarily via default.rb. Option C is incorrect because updating the cookbook version would not address the access permissions issue.

Answer

Assign the recipe to the Configure lifecycle event instead of Setup

Answer

Verify that the recipe is included in the cookbook's default.rb file

Answer

Update the cookbook version to the latest

Question 13

A DevOps team is configuring an Auto Scaling group for a web application behind an Application Load Balancer. The team wants to automatically replace instances that fail the health check. Which scaling policy should be used?

Accepted Answer

Default health check replacement. The correct approach is not a scaling policy but the Auto Scaling group's built-in health check replacement functionality. When the Auto Scaling group is configured with ELB health checks, it automatically terminates and replaces instances that the Application Load Balancer marks unhealthy. No scaling policy is required for this behavior.

Answer

Target tracking scaling policy

Answer

Step scaling policy

Answer

Manual scaling

Question 14

A company wants to centrally manage and audit access to AWS KMS keys across multiple accounts. Which AWS feature should be used?

Accepted Answer

AWS CloudTrail with organization trail. AWS CloudTrail with an organization trail can log all API calls, including KMS key usage, across multiple accounts in an AWS Organization. This provides centralized audit logging for KMS key access. Option A (AWS Config aggregated rules) can evaluate resource compliance but does not audit key usage. Option B (Cross-account IAM roles) allows access but not centralized auditing. Option D (AWS Organizations tag policies) manage tags, not auditing. Therefore, option C is correct.

Answer

AWS Config aggregated rules

Answer

Cross-account IAM roles

Answer

AWS Organizations tag policies

Question 15

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team requires that all data be encrypted at rest and that automated backups are also encrypted. Which configuration meets these requirements?

Accepted Answer

Enable encryption for the RDS instance using AWS KMS.. Enabling encryption on the RDS instance using AWS KMS at creation time encrypts the data, automated backups, read replicas, and snapshots. Option A is incorrect because an S3 bucket policy cannot enforce encryption for RDS automated backups; RDS encryption must be handled at the instance level. Option C is incorrect because enabling encryption on automated backups after creating a snapshot does not encrypt the live database or future automated backups. Option D is incorrect because encrypting the underlying EBS volumes separately does not automatically encrypt the RDS data, logs, or backups; RDS encryption must be enabled directly on the instance.

Answer

Use an S3 bucket policy to enforce encryption for backup files.

Answer

Enable encryption on automated backups only after creating a snapshot.

Answer

Enable encryption on the underlying EBS volumes using KMS.