DOP-C02 Practice Test 20 — 15 Questions

Question 1

A company runs a critical application on Amazon ECS with Fargate. They use blue/green deployments via AWS CodeDeploy. During a recent deployment, the new task set failed health checks and CodeDeploy automatically rolled back. However, the old task set also became unhealthy shortly after rollback. What could explain this?

Accepted Answer

The new application version changed the database schema, which broke the old version after rollback.. Option A is correct because a shared resource like a database schema change by the new version could corrupt data for the old version. Option B is wrong because CodeDeploy does not drain connections from ALB before rollback by default, but that would not cause the old version to become unhealthy. Option C is wrong because CloudWatch alarms are not configured by CodeDeploy to stop old tasks. Option D is wrong because ECS service auto-scaling does not stop tasks.

Answer

The CloudWatch alarm that triggered the rollback also stopped the old task set.

Answer

CodeDeploy did not drain connections from the Application Load Balancer before terminating the old task set.

Answer

The ECS service auto-scaling policy reduced the desired count of the old task set during the deployment.

Question 2

A team wants to automate the creation of a CI/CD pipeline using a JSON/YAML file that defines source, build, and deploy stages. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. Option B is correct because AWS CloudFormation can define CodePipeline resources in a template. Option A is wrong because CodePipeline itself uses a structure, but not to create itself. Option C is wrong because CodeDeploy is for deployment, not pipeline creation. Option D is wrong because Elastic Beanstalk is for applications, not pipeline definition.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Question 3

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline triggers on changes to the S3 bucket. However, the pipeline does not trigger when a new object is uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to invoke the pipeline.. Option C is correct because S3 event notifications need to be configured to trigger CodePipeline. Option A is wrong because the source stage bucket and pipeline must be in the same region, but the question implies it's not triggering. Option B is wrong because versioning is not required for pipeline triggers. Option D is wrong because bucket policies do not affect event notifications.

Answer

The S3 bucket policy denies the CodePipeline service role.

Answer

The S3 bucket is in a different AWS Region than the pipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 4

A company uses AWS CodeBuild to run builds for a Java application. The buildspec includes a 'mvn test' command. The build succeeds but the tests fail. The team wants to fail the build if any test fails. What should they do?

Accepted Answer

Ensure the buildspec's 'build' phase includes the test command and that the command returns a non-zero exit code on failure.. Option C is correct because CodeBuild's build phase returns exit code; if Maven test fails, it returns non-zero, and CodeBuild fails the build. Option A is wrong because phases are not modified. Option B is wrong because batch builds are for multiple builds. Option D is wrong because post_build runs after build phases.

Answer

Add a 'post_build' phase that fails the build if tests fail.

Answer

Add a 'test' phase in the buildspec before the 'build' phase.

Answer

Configure the build project to use batch builds.

Question 5

A team wants to automatically deploy a new version of a Lambda function when code is pushed to a CodeCommit repository. Which AWS service should orchestrate this workflow?

Accepted Answer

AWS CodePipeline. Option A is correct because CodePipeline can orchestrate source, build, and deploy stages. Option B is wrong because CodeDeploy alone cannot monitor CodeCommit. Option C is wrong because CloudFormation is for infrastructure, not continuous deployment. Option D is wrong because CodeBuild is for building, not deploying.

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Question 6

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must ensure that only code that passes security scanning can proceed to deployment. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Add a security scanning stage in the pipeline after the build stage and before the deploy stage.. A and D are correct. A: Adding a security scanning stage in CodePipeline ensures scanning before deployment. D: Failing the pipeline if the scanning stage fails is standard practice. B is incorrect because scanning after deployment defeats the purpose. C is incorrect because CodeDeploy does not perform scanning. E is incorrect because CloudWatch Events do not gate the pipeline.

Answer

Use Amazon CloudWatch Events to trigger a rollback if vulnerabilities are found after deployment.

Answer

Use AWS CodeDeploy to perform security scanning during deployment.

Answer

Configure the pipeline to run security scanning only in the deploy stage.

Question 7

A company uses AWS CloudFormation to deploy a multi-tier application. The stack creation fails with a 'CREATE_FAILED' error for a resource. The engineer wants to troubleshoot the issue. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Use the 'describe-stack-events' AWS CLI command to view the events.. A, B, and E are correct. A: Viewing events shows failure details. B: Checking the resource's status reason provides specific error. E: CloudFormation logs are in CloudWatch Logs. C is incorrect because delete_stack would remove resources. D is incorrect because DescribeStacks is less detailed than events.

Answer

Run 'delete-stack' to remove the failed stack and start over.

Answer

Use the 'describe-stacks' AWS CLI command to get the stack outputs.

Question 8

Refer to the exhibit. An alarm is configured as shown. The CPU utilization averages 85% for 10 minutes, then spikes to 95% for the next 5 minutes, and returns to 80%. How many times will the SNS topic receive a notification?

Accepted Answer

0. The alarm evaluates every 300 seconds (5 minutes) and requires 2 consecutive evaluation periods above threshold to trigger ALARM. The spike to 95% lasts only one period, so it never meets the 2-period condition. However, the OK action is triggered when state goes from ALARM to OK, but since it never enters ALARM, no notification is sent.

Answer

1

Answer

2

Answer

3

Question 9

A team uses AWS CodeBuild to build a Node.js application. The buildspec.yml file is at the root of the repository. The build fails with 'Error: Cannot find module 'aws-sdk''. Which TWO actions could resolve the issue? (Choose TWO.)

Accepted Answer

Ensure 'aws-sdk' is listed in the 'dependencies' section of package.json.. B and E are correct. B: Including 'npm install' installs dependencies from package.json. E: Adding aws-sdk to package.json ensures it is installed. A is incorrect because pre_build runs after install. C is incorrect because runtime version does not affect module availability. D is incorrect because build commands are for building, not installing dependencies.

Answer

Specify a different Node.js runtime version in the buildspec.

Answer

Add a 'pre_build' phase that runs 'npm test'.

Answer

Add a 'build' phase command to compile the code.

Question 10

A company is running a critical application on Amazon ECS with Fargate. The application generates custom metrics that are published to CloudWatch using the PutMetricData API. Recently, the metrics have been delayed by up to 5 minutes. The DevOps team needs to reduce the latency. What should the team do?

Accepted Answer

Set the StorageResolution parameter to 1 when calling PutMetricData.. Option D is correct because the storage resolution parameter allows metrics to be stored at a higher resolution (1 second) which can be retrieved faster. Option A is wrong because the CloudWatch agent is not needed for custom API calls. Option B is wrong because increasing the PutMetricData frequency may cause throttling. Option C is wrong because CloudWatch Logs does not replace custom metrics.

Answer

Install the CloudWatch agent on the Fargate tasks to collect metrics.

Answer

Publish the metrics as structured logs to CloudWatch Logs and use metric filters.

Answer

Increase the frequency of PutMetricData calls to every 5 seconds.

Question 11

Refer to the exhibit. An IAM policy is attached to a role used by a CI/CD system. The policy is intended to allow starting the pipeline 'MyPipeline' from the same account. However, the CI/CD system receives an 'AccessDenied' error when trying to start the pipeline. What is the problem?

Accepted Answer

The Deny statement with the 'aws:SourceAccount' condition denies access if the condition key is not present in the request.. Option B is correct. The Deny statement with a condition denies all codepipeline actions if the source account is not 123456789012. However, the Allow statement allows StartPipelineExecution for the specific pipeline. But the Deny statement with a condition that does not match (i.e., if the source account is exactly 123456789012, the condition is false, so the Deny does not apply). Wait, let's analyze: The Deny statement applies when the source account is NOT 123456789012. So if the source account IS 123456789012, the Deny does not apply, and the Allow should work. But the error suggests AccessDenied. The issue could be that the policy also needs to allow other actions? Actually, looking closely: The Allow only allows StartPipelineExecution, but maybe the pipeline execution requires other actions? No, StartPipelineExecution should be sufficient. Another possibility: The Deny statement with condition might be interpreted incorrectly. Actually, the Deny with StringNotEquals will deny if the source account is not equal to the specified account. So if the source account is 123456789012, the condition is false, so the Deny does not apply. So the Allow should work. But the error persists. Perhaps the issue is that the policy also needs to allow 'codepipeline:GetPipeline' or something? However, the most likely cause is that the Deny statement is too broad: it denies all codepipeline actions for any resource, but only if the source account is not the one specified. If the source account is correct, the Deny doesn't apply. So why denial? Maybe the condition key 'aws:SourceAccount' is not set for the request? If the condition key is not present, then StringNotEquals evaluates to false (since not present is not equal), so the Deny would apply. That is a common pitfall: when the condition key is absent, the condition evaluates to false, causing the Deny to apply. So Option B is correct: the condition key 'aws:SourceAccount' may not be present in the request, causing the Deny to apply. Option A is wrong because the Allow is not blocked by Deny if condition met. Option C is wrong because there is no explicit deny for GetPipeline. Option D is wrong because the policy is attached to the role, not user.

Answer

The Allow statement does not specify the correct pipeline ARN.

Answer

The policy needs an additional Allow for 'codepipeline:GetPipeline' to start the pipeline.

Answer

The role does not have permission to pass the policy to the CI/CD system.

Question 12

Refer to the exhibit. A DevOps engineer sees the following error when trying to update a CloudFormation stack: 'Stack [arn:aws:cloudformation:us-west-2:123456789012:stack/MyStack/abc123] is in ROLLBACK_COMPLETE state and can not be updated.' What should the engineer do to proceed?

Accepted Answer

Delete the stack and create a new one with the updated template.. Option D is correct. A stack in ROLLBACK_COMPLETE state cannot be updated; it must be deleted and recreated. Option A is wrong because continue-update-rollback is for stacks in UPDATE_ROLLBACK_FAILED state. Option B is wrong because there is no 'resume' operation. Option C is wrong because you cannot update a stack in ROLLBACK_COMPLETE.

Answer

Run 'aws cloudformation continue-update-rollback' to finish the rollback and then update.

Answer

Modify the stack's template and try the update again.

Answer

Use the 'aws cloudformation resume-update' command to resume the update.

Question 13

A company uses AWS CodeCommit for source control. Developers work on feature branches and create pull requests to merge into the 'develop' branch. The company wants to enforce that all commits to the 'develop' branch are signed. Which AWS service or feature should be used to enforce this policy?

Accepted Answer

Create an approval rule template in CodeCommit that requires commits to be signed and associate it with the 'develop' branch.. Option C is correct because CodeCommit supports approval rule templates that can require signed commits. Option A is incorrect because IAM policies can restrict who can push but not enforce signing. Option B is incorrect because CloudWatch Events can trigger actions but not enforce signing. Option D is incorrect because AWS KMS is used for encryption keys, not for enforcing commit signing.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that verifies commit signatures and reverts unsigned commits.

Answer

Use AWS Key Management Service (KMS) to create a signing key and require developers to use it.

Answer

Configure an IAM policy that denies 'git push' unless the commit is signed.

Question 14

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project can access a private Amazon S3 bucket to download build artifacts? (Choose two.)

Accepted Answer

Add a bucket policy that explicitly allows access from the CodeBuild project's IAM role ARN. Options A and D are correct. The CodeBuild project needs an IAM role with permissions to access the S3 bucket, and the S3 bucket policy must allow access from that role. Option B is wrong because VPC configuration is not required for S3 access. Option C is wrong because the bucket does not need to be public. Option E is wrong because CodeBuild does not use access keys.

Answer

Generate an access key and secret key for the CodeBuild project to use in the buildspec

Answer

Configure the CodeBuild project to run in a VPC with an S3 VPC endpoint

Answer

Make the S3 bucket publicly readable

Question 15

A DevOps engineer needs to set up an alert for when the CPU utilization of an EC2 instance exceeds 90% for 5 consecutive minutes. Which CloudWatch features should be used?

Accepted Answer

CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and threshold of 90.. Option B is correct because a CloudWatch alarm can monitor a metric and trigger an action when a threshold is breached for a specified period. Option A is wrong because CloudWatch Logs does not directly monitor CPU utilization. Option C is wrong because CloudTrail records API calls, not metrics. Option D is wrong because S3 does not provide monitoring or alerting.

Answer

CloudWatch Logs with a metric filter on CPU utilization logs.

Answer

CloudTrail to monitor EC2 instance CPU usage.

Answer

Amazon S3 server access logs to check CPU utilization.