DOP-C02 Practice Test 22 — 15 Questions

Question 1

A critical application is deployed on Amazon EKS. The DevOps team notices that pods are failing with 'CrashLoopBackOff' status. The team needs to capture the application logs before the pod restarts to debug the issue. Which approach should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a sidecar container to stream logs to Amazon CloudWatch Logs. Configuring a sidecar container to stream logs to Amazon CloudWatch Logs ensures that logs are persisted and available for debugging even if the pod crashes and restarts. This approach decouples log collection from the pod's lifecycle, allowing the DevOps team to analyze logs from the crash without needing to capture them in real-time. It aligns with the incident response best practice of centralized logging for ephemeral environments like EKS.

Answer

Use 'kubectl logs' command immediately after the crash

Answer

Store logs in a ConfigMap

Answer

Use 'kubectl exec' to access the container and check logs

Question 2

A DevOps team uses the above CloudFormation template to create an S3 bucket. What does the bucket policy accomplish?

Accepted Answer

It denies all S3 operations on the bucket unless the request uses HTTPS.. The bucket policy uses a Deny effect with a condition that the request must use HTTPS (SecureTransport: false). This denies all S3 operations on the bucket unless the request is sent over HTTPS. Option B is incorrect because the policy does not target anonymous users specifically; it applies to all principals. Option C is incorrect because the policy denies all actions, not just delete. Option D is incorrect because it allows HTTP requests when the condition is not met, but the Deny overrides; the policy explicitly denies non-HTTPS requests.

Answer

It denies all read access to the bucket for anonymous users.

Answer

It prevents anyone from deleting objects in the bucket.

Answer

It allows only HTTPS requests to the bucket and denies all HTTP requests.

Question 3

A company is using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is configured with a batch size of 10 and a maximum concurrency of 5. Recently, the function started experiencing high error rates and the SQS queue's ApproximateNumberOfMessagesVisible metric is increasing. The CloudWatch logs show that the function is timing out after 30 seconds. The function makes calls to an external API that sometimes takes more than 30 seconds to respond. The DevOps engineer needs to reduce the backlog and prevent message loss. The engineer is considering the following actions: A) Increase the Lambda function timeout to 60 seconds and increase the SQS visibility timeout to 90 seconds. B) Decrease the batch size to 1 to avoid processing multiple messages at once. C) Increase the Lambda function reserved concurrency to 100 to allow more concurrent executions. D) Use a dead-letter queue to capture messages that fail processing after all retries. Which combination of actions should the engineer take?

Accepted Answer

Increase the Lambda function timeout to 60 seconds and increase the SQS visibility timeout to 90 seconds.. The correct action because increasing the Lambda function timeout to 60 seconds allows the function to wait longer for the external API, and increasing the SQS visibility timeout to 90 seconds prevents messages from becoming visible again before the function completes. This reduces unnecessary retries and helps clear the backlog. Option A (DLQ) is useful for capturing failed messages but does not address the timeout issue. Option B (decrease batch size) reduces throughput and worsens the backlog. Option D (increase concurrency) may lead to more timeouts if the function still cannot complete within the existing timeout.

Answer

Use a dead-letter queue to capture messages that fail processing after all retries.

Answer

Decrease the batch size to 1 to avoid processing multiple messages at once.

Answer

Increase the Lambda function reserved concurrency to 100 to allow more concurrent executions.

Question 4

A company uses AWS CodeDeploy to deploy a new version of an application to EC2 instances. They want to minimize downtime and roll back quickly if the deployment fails. Which deployment type should they use?

Accepted Answer

Blue/green deployment. Blue/green deployment creates two separate environments (blue and green) and shifts traffic from the old to the new after testing. This minimizes downtime because traffic is switched instantly, and rollback is achieved by reverting traffic to the original environment. Option A (Canary) is a traffic shifting pattern used within blue/green deployments, not a standalone deployment type that offers immediate rollback. Option B (Linear) is also a traffic shifting pattern for blue/green. Option D (In-place) updates existing instances, causing downtime during deployment and requiring a manual rollback process.

Answer

Canary deployment

Answer

Linear deployment

Answer

In-place deployment

Question 5

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The ALB is in us-east-1a and us-east-1b. They want to ensure that if one AZ fails, traffic is routed only to healthy instances in the other AZ. What configuration is necessary?

Accepted Answer

Enable cross-zone load balancing on the ALB. Cross-zone load balancing must be enabled on the ALB so that traffic can be distributed across instances in all AZs. By default, an ALB routes requests only to targets in the same Availability Zone as the requesting client. Enabling cross-zone load balancing allows the ALB to distribute traffic evenly across all registered targets in all enabled AZs, ensuring that if one AZ fails, traffic can be routed to healthy instances in other AZs. Option B is incorrect because health checks are already enabled by default and do not affect cross-AZ routing. Option C is incorrect because adding more AZs does not change the default AZ-affinity behavior; cross-zone load balancing must be explicitly enabled to utilize multiple AZs for failover.

Answer

Enable sticky sessions (session affinity)

Answer

Configure health checks on the target group

Answer

Add more subnets in additional AZs

Question 6

A company runs a critical microservice on Amazon ECS with AWS Fargate. The service must be highly available across multiple Availability Zones. The DevOps engineer configured the service with a desired count of 4 tasks spread across 2 Availability Zones. During a deployment, a new task fails to start due to a missing environment variable. The deployment fails, but the old tasks continue to run. What is the most likely cause of the deployment failure and how can the engineer ensure future deployments are resilient?

Accepted Answer

The deployment failed because the ECS service did not have the deployment circuit breaker enabled. Enable the circuit breaker with rollback.. The deployment failed because the new task could not start due to a missing environment variable, and the ECS service did not have the deployment circuit breaker enabled. Without the circuit breaker, ECS continues to attempt the deployment indefinitely or until a timeout, but it does not automatically roll back to the previous stable task set. Enabling the deployment circuit breaker with rollback ensures that if a specified number of tasks fail to start (e.g., due to health checks or runtime errors), ECS automatically rolls back to the last successful deployment, maintaining service availability.

Answer

The deployment failed because the ECS service was using the rolling update deployment controller. Change to blue/green deployment.

Answer

The deployment failed because the desired count was too low. Increase the desired count to 6.

Answer

The deployment failed because the health check grace period was too short. Increase the grace period.

Question 7

A company is using AWS CodeCommit for source control and wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created against the main branch. Which AWS service should be used to connect CodeCommit events to CodeBuild?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct choice because it can capture CodeCommit repository events (such as pull request creation) via a default event bus and route them to targets like CodeBuild. This allows you to define a rule that matches the 'codecommit: PullRequestCreated' event and triggers a CodeBuild project directly, without needing an intermediary pipeline or compute service.

Answer

AWS CodePipeline

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences intermittent failures due to a single Availability Zone failing. Which solution is MOST resilient and cost-effective?

Accepted Answer

Deploy EC2 instances across two Availability Zones and configure the ALB to distribute traffic. Most resilient and cost-effective. Deploying EC2 instances across two Availability Zones and configuring the ALB to distribute traffic ensures high availability by handling a single AZ failure without over-provisioning. Option A is wrong because using a larger instance in the same AZ does not address AZ failure. Option B is wrong because using three AZs with a single instance each and a Network Load Balancer is more expensive and not necessary for this scenario; ALB already supports cross-zone load balancing. Option C is wrong because migrating to a different region adds latency, complexity, and cost.

Answer

Use a larger instance type in the same Availability Zone

Answer

Use an Auto Scaling group with a single instance in each of three Availability Zones and a Network Load Balancer

Answer

Migrate to a single larger instance in a different region

Question 9

A company runs an application on EC2 with a shared Elastic IP. The instance fails and an engineer manually attaches the Elastic IP to a standby instance. To automate this failover, which service should be used?

Accepted Answer

CloudWatch Events with a Lambda target. C is correct because CloudWatch Events (now Amazon EventBridge) can detect the EC2 instance state change (e.g., 'stopped' or 'failed') and trigger a Lambda function. The Lambda function can then programmatically disassociate the Elastic IP from the failed instance and reassociate it to a standby instance using the AWS SDK (e.g., ec2.disassociate_address and ec2.associate_address). This provides a fully automated, event-driven failover without manual intervention.

Answer

Use an Auto Scaling group with a lifecycle hook

Answer

AWS Elastic Beanstalk

Answer

Configure a second Elastic IP

Question 10

A company uses AWS CodeDeploy with a blue/green deployment strategy for an Amazon EC2 Auto Scaling group. During deployment, the new instances are failing health checks and the deployment is rolling back. What is the MOST likely cause?

Accepted Answer

The new instances are not passing the configured health check grace period.. In a blue/green deployment with CodeDeploy, new instances are launched and must pass health checks before traffic is routed to them. If the health check grace period is not configured or is too short, the new instances may be deemed unhealthy before the application has fully started, triggering a rollback. This is the most likely cause because the health check grace period directly controls how long CodeDeploy waits before evaluating instance health.

Answer

The application is not registered with an Elastic Load Balancer.

Answer

The deployment group is not configured to use an Auto Scaling group.

Answer

The CodeDeploy agent is not installed on the new instances.

Question 11

A company is designing a resilient architecture for a critical application. Which TWO strategies improve resilience?

Accepted Answer

Deploy resources across multiple Availability Zones. Multi-AZ deployments and health checks with auto-remediation improve resilience by handling failures automatically.

Answer

Use a single large instance instead of multiple smaller ones

Answer

Disable automated backups to reduce latency

Answer

Deploy resources in a single Availability Zone

Question 12

An IAM policy attached to a user is shown in the exhibit. The user reports that they are unable to delete an object in the 'example-bucket' bucket. What is the reason for this?

Accepted Answer

The explicit Deny statement overrides the Allow. An explicit Deny overrides any Allow. The Deny action s3:DeleteObject explicitly denies the delete, even though the Allow all s3 actions includes delete. Option A is wrong because the resource ARN matches. Option C is wrong because the policy allows all s3 actions, but the Deny blocks delete. Option D is wrong because the policy is valid.

Answer

The resource ARN does not match the bucket name

Answer

The user does not have permissions to perform s3:DeleteObject

Answer

The policy has a syntax error

Question 13

A company uses AWS OpsWorks for configuration management with Chef. They are migrating to AWS Systems Manager to reduce complexity. The operations team needs to run custom scripts on a fleet of EC2 instances on a schedule, with the ability to target instances based on tags. Which Systems Manager capability should the engineer use?

Accepted Answer

State Manager. State Manager is the correct choice because it is designed to define and maintain consistent configuration of EC2 instances and other AWS resources, including running custom scripts on a schedule. It supports targeting instances by tags and uses associations to enforce desired states at specified intervals, making it ideal for scheduled script execution across a tagged fleet.

Answer

Patch Manager

Answer

Automation

Answer

Run Command

Question 14

A DevOps engineer is using AWS CloudFormation to deploy a stack that includes a VPC with public and private subnets. The engineer wants to ensure that the public subnets automatically get a public IP address assigned to instances launched in them. Which property should be set?

Accepted Answer

MapPublicIpOnLaunch on the subnet. The `MapPublicIpOnLaunch` property on an AWS CloudFormation `AWS::EC2::Subnet` resource controls whether instances launched in that subnet automatically receive a public IP address. Setting this property to `true` ensures that any EC2 instance launched in the public subnet gets a public IPv4 address from the subnet's CIDR range, which is essential for internet-facing resources in a VPC.

Answer

EnableDnsSupport on the VPC

Answer

EnableDnsHostnames on the VPC

Answer

AssociatePublicIpAddress on the instance

Question 15

A DevOps engineer is setting up centralized logging for multiple AWS accounts. They need to collect VPC Flow Logs, CloudTrail logs, and application logs into a single Amazon S3 bucket. What is the most efficient approach?

Accepted Answer

Use an S3 bucket in a centralized logging account with a bucket policy that grants write access from all other accounts.. It uses a centralized logging account with a single S3 bucket configured with a bucket policy that grants write access (s3:PutObject) to all other accounts. This approach avoids data duplication, eliminates the need for replication or intermediate compute resources, and is the most efficient and cost-effective method for aggregating logs from multiple accounts into a single destination.

Answer

Configure a Lambda function in each account to copy logs to a central S3 bucket.

Answer

Create an S3 bucket in each account and use S3 replication.

Answer

Use Amazon Kinesis Data Firehose to stream logs from all accounts to a central S3 bucket.