DOP-C02 Practice Test 22 — 15 Questions

Question 1

A DevOps engineer is setting up a CI/CD pipeline for a Python application using AWS CodePipeline. The pipeline includes a build stage with CodeBuild and a deploy stage that runs an AWS CLI command to update a Lambda function. Which THREE steps are necessary to ensure the pipeline can update the Lambda function? (Choose 3)

Accepted Answer

Store the AWS CLI command in the buildspec file or as a separate script in the source repository.. Options A, B, and D are correct. The CodeBuild project needs a role that allows Lambda updates, and the pipeline role needs to pass the CodeBuild role. Option C is incorrect because CloudWatch is not required. Option E is incorrect because the CLI command is already in the deploy stage.

Answer

Configure a CloudWatch Events rule to trigger the pipeline when the Lambda function is updated.

Answer

Use AWS CodeDeploy instead of the AWS CLI to update the Lambda function.

Question 2

A DevOps engineer receives a CloudWatch alarm indicating that an EC2 instance's CPU utilization has exceeded 90% for 10 minutes. The instance is part of an Auto Scaling group behind an Application Load Balancer. What is the MOST efficient initial step to troubleshoot the high CPU usage?

Accepted Answer

Review the EC2 instance's CloudWatch metrics for CPU credit balance and network utilization.. Option C is correct because CloudWatch metrics provide historical data to identify the root cause. Option A is wrong because no alarm exists for HTTP 5xx. Option B is wrong because scaling has not yet occurred. Option D is wrong because increasing instance size does not address the cause.

Answer

Modify the Auto Scaling group to use a larger instance type.

Answer

Check the ALB's HTTP 5xx error rate metric for the target group.

Answer

Immediately increase the desired capacity of the Auto Scaling group.

Question 3

A DevOps engineer is setting up centralized logging for multiple AWS accounts. They need to collect VPC Flow Logs, CloudTrail logs, and application logs into a single Amazon S3 bucket. What is the most efficient approach?

Accepted Answer

Use an S3 bucket in a centralized logging account with a bucket policy that grants write access from all other accounts.. Option B is correct because using an S3 bucket policy in a centralized account to allow cross-account log delivery is a common pattern. Option A is wrong because aggregating logs in a single account's S3 bucket requires cross-account permissions. Option C is wrong because Kinesis Data Firehose is not needed for simple log aggregation. Option D is wrong because Lambda functions would add complexity and cost.

Answer

Configure a Lambda function in each account to copy logs to a central S3 bucket.

Answer

Create an S3 bucket in each account and use S3 replication.

Answer

Use Amazon Kinesis Data Firehose to stream logs from all accounts to a central S3 bucket.

Question 4

Refer to the exhibit. An AWS CloudFormation template includes a Lambda function with the ARN shown. The function is part of a custom resource to create an S3 bucket. The stack creation fails with the error 'Function not found: arn:aws:lambda:us-east-1:123456789012:function:my-function'. The Lambda function exists in the same account and region. What is the most likely cause?

Accepted Answer

The Lambda function is defined in the same template and has a circular dependency. The error indicates that CloudFormation cannot find the Lambda function. Since the function exists in the same account and region, the issue could be that the function is not deployed yet because of a circular dependency. CloudFormation may be trying to invoke the function before it is created. Option C is correct. Option A is wrong because the ARN is correct. Option B is wrong because IAM permissions would cause a different error. Option D is wrong because the function exists.

Answer

The Lambda function is not in the same AWS region

Answer

The Lambda function lacks necessary IAM permissions

Answer

The Lambda function ARN is malformed

Question 5

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). Recently, deployments have been failing intermittently during the deploy stage with the error: 'The service has reached its maximum number of running tasks.' How should a DevOps engineer resolve this issue?

Accepted Answer

Update the ECS service configuration to increase the maximum number of tasks. Option B is correct because the error indicates that the ECS service's desired count or maximum tasks limit has been reached. Updating the service to increase the maximum number of tasks resolves the issue. Option A is wrong because CodeDeploy does not have a deployment limit that causes this error. Option C is wrong because scaling policies are for auto scaling, not for the error about maximum tasks. Option D is wrong because the issue is not related to insufficient memory but to task count limits.

Answer

Increase the memory reservation for the task definition

Answer

Configure an Amazon ECS Service Auto Scaling policy to scale out

Answer

Increase the number of concurrent deployments allowed in CodeDeploy

Question 6

A DevOps engineer is designing a CI/CD pipeline that must enforce a policy: any change to the production branch in CodeCommit must be reviewed and approved by two senior developers before the change can be merged. The pipeline must also automatically build and deploy to a staging environment after approval. Which combination of AWS services and configurations should be used?

Accepted Answer

Use CodeCommit pull request approval rules and a CodePipeline with a manual approval step triggered by a Lambda function that checks approval status. Option C is correct because AWS CodeCommit does not have native approval workflows; however, CodePipeline can use approval actions and CodeCommit can be configured with pull request notifications to trigger pipelines. A Lambda function can be used to automatically approve the pipeline after the required number of approvals in a pull request. Option A is wrong because IAM does not enforce manual approvals. Option B is wrong because CodeBuild does not have approval capabilities. Option D is wrong because CloudWatch Events cannot enforce two-approver rule directly.

Answer

Configure CodeBuild to run a script that checks the commit author and rejects if not approved

Answer

Use Amazon EventBridge to trigger a Lambda function that validates the number of approvers before merging

Answer

Use IAM policies to restrict write access to the production branch to only senior developers

Question 7

A DevOps team uses AWS CodeBuild to compile a Java application. The build environment is managed by AWS and runs on Linux. The team wants to speed up the build process by caching dependency directories across builds. Which configuration should the team use?

Accepted Answer

Enable local caching in the CodeBuild project and specify the cache location as /root/.m2. Option B is correct because CodeBuild supports local caching, which can be configured to cache specific directories like the Maven local repository. Option A is wrong because S3 caching is not a built-in CodeBuild feature. Option C is wrong because it is not specific to dependency caching. Option D is wrong because Docker layer caching is for Docker builds, not Java dependencies.

Answer

Configure the buildspec file to use Docker layer caching

Answer

Use the CodeBuild cache configuration to store the entire build output in a custom Docker image

Answer

Store dependencies in an Amazon S3 bucket and download them at the start of each build

Question 8

A DevOps engineer notices that an EC2 instance running a web application is unresponsive. CloudWatch alarms are not triggering. What is the FIRST step the engineer should take to diagnose the issue?

Accepted Answer

Review the EC2 instance system log and CloudWatch Logs for error messages.. Option C is correct because checking the system logs (e.g., EC2 console or CloudWatch Logs) helps identify the root cause. Option A is wrong because restarting without diagnosis may lose transient logs. Option B is wrong because creating a new alarm doesn't help diagnose the current issue. Option D is wrong because it assumes the instance is permanently failed without investigation.

Answer

Terminate the instance and launch a new one from the latest AMI.

Answer

Restart the EC2 instance immediately to restore service.

Answer

Create a new CloudWatch alarm with a lower threshold to get alerted quicker next time.

Question 9

A development team is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a Source stage connected to an Amazon S3 bucket, a Build stage using AWS CodeBuild, and a Deploy stage that deploys to an Amazon ECS cluster. The team notices that the pipeline fails intermittently during the Build stage with a 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE' error. What is the most likely cause?

Accepted Answer

The CodeBuild project is configured to run in a VPC without a NAT gateway, and the build image is pulled from a public registry.. Option C is correct because CodeBuild builds run in a VPC that must have a route to pull Docker images from public registries; if the VPC does not have a NAT gateway or internet gateway, the build container cannot pull the base image. Option A is wrong because CodePipeline does not require CodeBuild to be in the same region. Option B is wrong because the error is about pulling the image, not insufficient resources. Option D is wrong because S3 policy does not affect image pulling.

Answer

The CodeBuild project is in a different AWS Region than the CodePipeline pipeline.

Answer

The S3 bucket where the source code is stored has a bucket policy denying access to the CodeBuild service role.

Answer

The CodeBuild project does not have enough memory or vCPU allocated.

Question 10

A company is implementing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application using the AWS Serverless Application Model (SAM). The pipeline must build and package the application, then deploy it to multiple environments (dev, test, prod) sequentially with manual approval gates before production. Which stage configuration should be used?

Accepted Answer

Use a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, then separate deploy stages for each environment with manual approval actions. Option D is correct because SAM deploy commands can be run in CodeBuild, and multiple deploy stages can be created in CodePipeline with approval actions. Option A is wrong because CloudFormation alone does not handle packaging. Option B is wrong because CodeDeploy is for EC2/ECS, not Lambda. Option C is wrong because CodePipeline cannot directly deploy SAM templates without a build action to package.

Answer

Use a single CloudFormation stack with a change set approval step

Answer

Configure CodePipeline with a deploy action provider set to AWS CloudFormation

Answer

Use CodeDeploy to deploy the SAM template directly to Lambda

Question 11

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment strategy is Blue/Green. After a successful deployment, the team notices that the new instances are receiving traffic but the application returns errors. The old instances are still serving traffic correctly. The team wants to roll back immediately. What should be done?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails, then manually trigger a rollback.. Option B is correct because in a Blue/Green deployment, CodeDeploy can automatically roll back by re-routing traffic to the original (blue) environment if a deployment fails. Option A is wrong because redeploying the same revision would redeploy the faulty code. Option C is wrong because stopping the deployment terminates the process but does not restore traffic to the old instances. Option D is wrong because while you could manually reassociate instances, CodeDeploy provides a built-in rollback mechanism.

Answer

Stop the current deployment using the AWS CLI.

Answer

Manually update the Auto Scaling group to associate new instances with the old launch configuration.

Answer

Redeploy the same application revision to the same Auto Scaling group.

Question 12

Which THREE steps are required to set up a cross-account CI/CD pipeline where the source stage is in Account A (CodeCommit) and the deploy stage is in Account B (ECS)? (Choose 3.)

Accepted Answer

Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action.. Options A, B, and D are correct. Option A provides cross-account access for CodePipeline in Account A to pull source from Account B. Option B is necessary for the pipeline to deploy to Account B. Option D ensures the pipeline can assume the execution role in Account B. Option C is wrong because KMS keys are not required for cross-account pipelines unless encryption is used. Option E is wrong because S3 buckets are not required for CodeCommit source.

Answer

Configure an AWS KMS key in Account B and share it with Account A for encrypting artifacts.

Answer

Create an S3 bucket in Account B to store the artifacts and grant cross-account access.

Question 13

An organization uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. Developers complain that their pipeline executions often fail because the source stage cannot access the CodeCommit repository. The IAM role used by CodePipeline has the following policy attached. What is the MOST likely cause of the failure? Policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["codecommit:GetBranch","codecommit:GetCommit","codecommit:UploadArchive","codecommit:GetUploadArchiveStatus"],"Resource":"*"}]}

Accepted Answer

The IAM role is missing the 'codecommit:GitPull' permission. Option A is correct because the pipeline source stage needs to use Git operations like GitPull, which require the codecommit:GitPull action. The provided policy only allows GetBranch, GetCommit, and archive operations, which are not sufficient for Git-based connections. Option B is wrong because CodeStar connections are used for third-party sources. Option C is wrong because the role does not need S3 permissions for CodeCommit access. Option D is wrong because tagging is not related to this issue.

Answer

The IAM role does not have permissions to describe the CodeCommit repository

Answer

The CodeCommit repository is not tagged with the pipeline's project tag

Answer

The pipeline uses a CodeStar connection instead of a direct CodeCommit source

Question 14

A company uses AWS CodePipeline with multiple stages: source, build, test, and deploy. The test stage takes 45 minutes to complete. Developers complain that the pipeline takes too long to provide feedback. The team wants to run tests in parallel across multiple environments. Which approach should be taken to reduce the pipeline execution time?

Accepted Answer

Configure the test stage with parallel actions in CodePipeline. Running the test stage in parallel across multiple environments can be achieved by using a parallel action group in CodePipeline, which will execute multiple test actions simultaneously. This reduces the overall time from sequential 45 minutes to the longest single test time. Option C is correct. Option A is wrong because building multiple parallel pipelines would increase complexity and resource usage. Option B is wrong because increasing instance size may not improve parallelism. Option D is wrong because CodeBuild cannot parallelize within a single build project without multiple buildspecs.

Answer

Increase the compute capacity of the test environment

Answer

Use AWS CodeBuild batch builds with a single buildspec

Answer

Create multiple pipelines, each running a subset of tests

Question 15

A DevOps engineer is setting up an AWS CodeBuild project that needs to access resources in a VPC, such as an Amazon RDS database. The engineer has configured the CodeBuild project to run in the VPC. Which additional configuration is required for CodeBuild to pull the build Docker image?

Accepted Answer

Create a VPC interface endpoint for Amazon ECR and configure the CodeBuild project to use it.. Option D is correct because CodeBuild requires a VPC interface endpoint to Amazon ECR or the Docker Hub to pull images when running in a private subnet without internet access. Option A is wrong because internet gateway is not enough; the subnet must be public or have NAT. Option B is wrong because VPC peering does not provide internet access. Option C is wrong because CodeBuild does not have a direct integration with Amazon ECR via a gateway endpoint; ECR requires interface endpoints.

Answer

Create a VPC peering connection to another VPC that has internet access.

Answer

Configure a VPC gateway endpoint for Amazon ECR.

Answer

Attach an internet gateway to the VPC and add a default route to it.