DOP-C02 Practice Exam 1 — 20 Questions

Question 1

A team wants to automate the creation of a CI/CD pipeline using a JSON/YAML file that defines source, build, and deploy stages. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define infrastructure as code (IaC) using JSON or YAML templates, which can include the creation of a CI/CD pipeline by defining resources like AWS CodePipeline, CodeBuild, and CodeDeploy. This enables full automation of the pipeline's source, build, and deploy stages through a declarative template, rather than manually configuring each service. The question specifically asks for automating the creation of the pipeline itself using a JSON/YAML file, which is exactly what CloudFormation does.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Question 2

Refer to the exhibit. The IAM policy above is attached to a Lambda function's execution role. The Lambda function is supposed to publish custom metrics to CloudWatch using PutMetricData. However, the metrics are not appearing. What is the most likely reason?

Accepted Answer

The function needs to specify a metric name and value when calling PutMetricData.. The most likely reason the metrics are not appearing is that the Lambda function is not providing the required parameters—specifically a metric name and value—when calling PutMetricData. The IAM policy correctly grants the cloudwatch:PutMetricData action, but the API call itself must include at least a MetricName and a Value (or StatisticValues) in the MetricDatum array; otherwise, CloudWatch silently drops the request without publishing any metric. This is a common coding error where the execution role permissions are sufficient but the function logic is incomplete.

Answer

The policy does not include the 'cloudwatch:PutMetricData' action.

Answer

The policy includes unnecessary actions that conflict with each other.

Answer

The policy uses a wildcard resource, which is not allowed for the PutMetricData action.

Question 3

A company uses AWS CodeBuild to compile Java applications. The builds often fail due to insufficient memory. The buildspec currently specifies 'compute-type: BUILD_GENERAL1_SMALL'. What is the most cost-effective solution to resolve the memory issues without changing the build logic?

Accepted Answer

Change the compute-type to 'BUILD_GENERAL1_MEDIUM' or 'BUILD_GENERAL1_LARGE' in the buildspec.. The most direct and cost-effective way to resolve insufficient memory in AWS CodeBuild is to increase the compute type to a larger size (e.g., BUILD_GENERAL1_MEDIUM or BUILD_GENERAL1_LARGE), which provides more memory without altering the build logic. This change incurs additional cost only when builds run, and it avoids unnecessary complexity or invalid approaches.

Answer

Enable Amazon S3 caching for the build artifacts to reduce memory usage.

Answer

Split the build into multiple parallel CodeBuild actions in the pipeline, each compiling a subset of the code.

Answer

Set the environment variable 'MEMORY_OVERPROVISION=2' in the buildspec.

Question 4

A company uses AWS Systems Manager to manage its EC2 instances at scale. The DevOps team wants to ensure that all instances are patched with the latest security updates. Which Systems Manager capability should they use to automate patching?

Accepted Answer

Patch Manager. Patch Manager is the correct choice because it is the dedicated AWS Systems Manager capability designed to automate the process of patching managed instances with security updates and other types of updates. It uses patch baselines to define which patches should be installed and can schedule patching on a recurring basis, ensuring compliance across the EC2 fleet.

Answer

Run Command

Answer

Automation

Answer

State Manager

Question 5

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment fails with a '502 Bad Gateway' error. The developer checks the logs and sees that the application is running but returns errors. The environment uses a load balancer. What is the MOST likely cause?

Accepted Answer

The application is not binding to the correct port or is crashing under load.. A 502 Bad Gateway error from an Elastic Beanstalk environment with a load balancer typically indicates that the reverse proxy (nginx or Apache) is unable to communicate with the application process. Since the logs show the application is running but returning errors, the most likely cause is that the application is not binding to the correct port (expected port 8080 by default) or is crashing under load, causing the proxy to receive no valid response and return a 502.

Answer

The application source bundle is missing a required file.

Answer

The security group of the environment does not allow inbound HTTP traffic.

Answer

The environment's environment variables are misconfigured.

Question 6

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. During an incident, the API returns 502 Bad Gateway errors. The Lambda function logs show no errors. What is the most likely cause?

Accepted Answer

The Lambda function is returning a response that exceeds the API Gateway payload size limit. When an API Gateway REST API returns 502 Bad Gateway errors but the Lambda function logs show no errors, the most likely cause is that the Lambda function is returning a response that exceeds the API Gateway payload size limit. API Gateway has a maximum payload size of 10 MB for REST APIs, and if the Lambda function returns a response larger than this, API Gateway will reject it and return a 502 error without the Lambda function itself throwing an exception or logging an error.

Answer

The Lambda function is throwing an unhandled exception

Answer

The API Gateway has reached its maximum concurrency limit

Answer

The Lambda function is timing out and API Gateway is not handling the timeout correctly

Question 7

A company's application uses Amazon SQS to decouple microservices. During peak hours, the SQS queue backlog grows significantly, causing processing delays. The DevOps team wants to reduce latency without increasing costs unnecessarily. What should the team do?

Accepted Answer

Configure Auto Scaling for the consumer fleet based on the ApproximateNumberOfMessagesVisible metric.. Scaling the consumer fleet based on the ApproximateNumberOfMessagesVisible metric directly addresses the backlog by adding more processing capacity when the queue grows. This approach reduces latency dynamically without incurring unnecessary costs during off-peak hours, as it only scales up when needed. Auto Scaling with SQS metrics is a cost-effective, elastic solution for handling variable workloads.

Answer

Increase the visibility timeout to allow consumers more time to process messages.

Answer

Use an SQS queue with priority settings to process high-priority messages first.

Answer

Increase the SQS queue's throughput by requesting a quota increase.

Question 8

A company uses AWS CloudTrail to log API activity across multiple accounts in AWS Organizations. The security team wants to receive near-real-time notifications for specific high-risk API calls, such as IAM policy changes or S3 bucket policy modifications. What is the MOST efficient and scalable solution?

Accepted Answer

Deliver CloudTrail logs to an S3 bucket, enable S3 Event Notifications to trigger a Lambda function that filters and publishes to SNS.. It uses S3 Event Notifications to trigger a Lambda function in near-real-time when CloudTrail logs are delivered to S3. The Lambda function can filter for specific high-risk API calls (e.g., IAM policy changes, S3 bucket policy modifications) and publish only relevant events to an SNS topic, providing a scalable and cost-effective solution that avoids polling or complex querying.

Answer

Create a CloudWatch Events rule that matches the specific API calls and publishes to an SNS topic.

Answer

Use CloudWatch Logs Insights to query CloudTrail logs and set up a metric filter with an alarm.

Answer

Enable AWS Config rules to detect changes and trigger an SNS notification.

Question 9

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline triggers on changes to the S3 bucket. However, the pipeline does not trigger when a new object is uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to invoke the pipeline.. CodePipeline does not automatically monitor S3 buckets for new objects. To trigger a pipeline on S3 events, you must explicitly configure an S3 event notification (e.g., s3:ObjectCreated:Put) that sends the event to CloudWatch Events or directly to CodePipeline via Amazon EventBridge. Without this notification, the pipeline will not start when a new object is uploaded.

Answer

The S3 bucket policy denies the CodePipeline service role.

Answer

The S3 bucket is in a different AWS Region than the pipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 10

A developer is setting up AWS CodeBuild to compile a Go application. The build fails with the error: 'go: command not found'. What is the MOST likely cause?

Accepted Answer

The build environment image does not have the Go runtime installed. The error 'go: command not found' indicates that the Go executable is not available in the build environment's PATH. CodeBuild uses a managed or custom build environment image (e.g., Ubuntu, Amazon Linux 2) to run build commands. If the image does not include the Go runtime, the shell cannot locate the 'go' binary, causing the build to fail. The most direct fix is to select a build environment image that has Go pre-installed or to install Go in the install phase of the buildspec.

Answer

The environment variables in buildspec.yml are incorrectly set

Answer

The build project does not have enough memory to compile Go code

Answer

The CodeBuild service role does not have permission to access the S3 bucket for artifacts

Question 11

A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?

Accepted Answer

CloudFormation Change Sets. CloudFormation Change Sets allow the DevOps team to preview how proposed changes to a stack will impact running resources before they are executed. This enables a review-and-approval workflow because the change set can be created, reviewed, and then executed only after approval, satisfying the requirement for a change management process.

Answer

CloudFormation StackSets

Answer

CloudFormation Stack Policies

Answer

CloudFormation Drift Detection

Question 12

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS instance. The stack creation fails with the error: 'The following resource(s) failed to create: [DBInstance]'. The CloudFormation template includes a parameter for the DB instance class. Which troubleshooting step should be taken FIRST?

Accepted Answer

Check the CloudFormation stack events for a detailed status message from the DBInstance resource.. The first step when a CloudFormation stack creation fails is to check the stack events in the CloudFormation console or via the AWS CLI. Each resource creation attempt generates a status message that includes a detailed reason for the failure, such as insufficient capacity, incorrect parameter values, or network configuration issues. For an RDS DBInstance, the event message will provide the specific error (e.g., 'DB instance class not supported in this Availability Zone'), enabling targeted troubleshooting without guesswork.

Answer

Increase the stack creation timeout to allow more time for the database to be created.

Answer

Verify that the VPC has at least two public subnets in different Availability Zones.

Answer

Use the Amazon RDS console to check if a DB instance with the same identifier already exists.

Question 13

A security engineer reviews the CloudTrail log entry above and notices that a security group was modified to allow SSH access from anywhere. The engineer wants to ensure that such changes are automatically detected and remediated in the future. What should the engineer do?

Accepted Answer

Create an AWS Config rule that checks security group rules and triggers an AWS Systems Manager Automation document to revoke the ingress rule.. AWS Config can continuously evaluate security group rules against a custom or managed rule (e.g., restricted-ssh) and, upon detecting a noncompliant rule allowing 0.0.0.0/0 on port 22, trigger an AWS Systems Manager Automation document that automatically revokes the offending ingress rule. This provides both detection and remediation without manual intervention, meeting the requirement for automated detection and remediation.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter that alerts on AuthorizeSecurityGroupIngress events with 0.0.0.0/0.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the source IP is 0.0.0.0/0.

Answer

Enable Amazon GuardDuty to detect and block such changes in real time.

Question 14

A DevOps engineer is writing an AWS CloudFormation template to create a VPC with public and private subnets. The engineer wants to ensure that the private subnets can access the internet through a NAT gateway. Which resources must be included in the template? (Choose TWO.)

Accepted Answer

AWS::EC2::RouteTable. A is correct because an AWS::EC2::RouteTable resource is required to define the routing rules for the private subnets. Specifically, you must create a route table for the private subnets and add a default route (0.0.0.0/0) that points to the NAT gateway, enabling outbound internet traffic from instances in the private subnets while blocking inbound traffic from the internet.

Answer

AWS::EC2::VPNGateway

Answer

AWS::EC2::InternetGateway

Answer

AWS::EC2::VPCEndpoint

Question 15

A DevOps team uses AWS CodeBuild to compile code and run unit tests. The team notices that builds are failing with a timeout error after 60 minutes. What is the most likely cause and solution?

Accepted Answer

The build timeout limit is exceeded; increase the timeout in CodeBuild project settings.. The default build timeout for AWS CodeBuild is 60 minutes. When a build runs longer than this limit, it fails with a timeout error. The correct solution is to increase the timeout value in the CodeBuild project settings, which can be set up to a maximum of 8 hours (480 minutes) for on-demand compute environments.

Answer

The buildspec has syntax errors; validate the YAML.

Answer

The build environment is too small; increase compute type.

Answer

The source code repository is too large; use shallow clone.

Question 16

A company has a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build stage runs unit tests and produces a JUnit report. The pipeline includes a test action that publishes results to an S3 bucket. Recently, the pipeline started failing with the error: 'The action could not be started because the artifact bucket policy is misconfigured.' What is the most likely cause?

Accepted Answer

The artifact bucket's bucket policy does not grant the necessary permissions to the CodePipeline service role.. AWS CodePipeline requires the artifact bucket's bucket policy to grant the CodePipeline service role (or the pipeline's assumed role) permissions to perform actions like s3:GetObject, s3:PutObject, and s3:GetBucketVersioning. When the bucket policy is misconfigured—for example, missing a principal or action—the pipeline's test action cannot start, resulting in the specific error message. This is a common IAM/permissions issue rather than a regional or encryption key problem.

Answer

The S3 bucket has Amazon S3 Transfer Acceleration enabled, which is not supported by CodePipeline.

Answer

The KMS key used to encrypt the bucket objects has been rotated, causing the pipeline to lose access.

Answer

The artifact bucket is in a different AWS Region than the pipeline, and cross-region replication is not enabled.

Question 17

A company is using AWS CodePipeline for CI/CD with CloudFormation as the deployment action. The pipeline fails intermittently with the error 'Rate exceeded' when creating or updating stacks. What is the most likely cause and solution?

Accepted Answer

The CloudFormation API rate limit is being hit; request a limit increase from AWS Support.. The 'Rate exceeded' error is a standard AWS API throttling error, indicating that CloudFormation API requests are being made faster than the account-level or region-level rate limit allows. CodePipeline can trigger multiple concurrent stack operations, especially during parallel stage executions or frequent commits, which can exceed the default CloudFormation API rate limit (e.g., 0.5 requests per second per account per region for CreateStack/UpdateStack). Requesting a limit increase from AWS Support is the correct solution to accommodate higher throughput.

Answer

The stack has a stack policy that prevents updates; modify the stack policy.

Answer

The IAM role used by CloudFormation does not have sufficient permissions; update the role policy.

Answer

The pipeline is exceeding the CodePipeline execution frequency limit; reduce the number of pipeline executions.

Question 18

A company uses AWS CodeBuild to compile a Java application. The build specification includes a pre-build phase to download dependencies. Which file defines the commands for each build phase?

Accepted Answer

buildspec.yml. In AWS CodeBuild, the build specification file named 'buildspec.yml' defines the commands that CodeBuild runs during each phase of the build process, including the pre-build phase for downloading dependencies. This YAML file is placed in the root of the source code or specified in the build project configuration, and it contains structured sections for install, pre_build, build, and post_build phases. Option B is correct because buildspec.yml is the standard file that CodeBuild uses to orchestrate build commands.

Answer

pipeline.json

Answer

config.xml

Answer

appspec.yml

Question 19

A DevOps team receives a CloudWatch alarm that an RDS DB instance's CPU utilization has exceeded 90% for 5 minutes. The application is experiencing latency. What is the best immediate step to mitigate the issue?

Accepted Answer

Modify the RDS instance to a larger instance class.. When an RDS instance's CPU utilization exceeds 90% for 5 minutes and the application is experiencing latency, the immediate step is to scale up the instance to a larger class to provide more CPU capacity. This directly addresses the resource bottleneck without requiring time-consuming analysis or architectural changes, making it the fastest mitigation for an ongoing incident.

Answer

Analyze slow query logs and optimize queries.

Answer

Enable Multi-AZ deployment for failover.

Answer

Add a read replica to offload read traffic.

Question 20

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting attacks. Which AWS service should be integrated with the ALB?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS traffic. It uses managed rule groups to block common attack patterns like SQL injection (e.g., detecting malicious SQL keywords in query strings) and cross-site scripting (e.g., identifying script tags in user input). This makes it the correct choice for protecting web applications at Layer 7.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty