DOP-C02 Practice Test 24 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. The development team wants to promote changes from a development environment to a production environment using change sets. They need to ensure that the production stack is not updated if there are any changes to the stack's IAM policies. Which approach should the team use?

Accepted Answer

Create a ChangeSet from the updated template, review the changes for IAM modifications, and execute only if no IAM changes are present.. Option A is correct because ChangeSets allow reviewing changes before execution, and you can inspect changes to IAM resources. Option B is wrong because StackSets are for multi-account deployments. Option C is wrong because drift detection checks for manual changes, not intended updates. Option D is wrong because a custom resource is overly complex.

Answer

Enable drift detection on the production stack and compare with the development stack.

Answer

Use AWS CloudFormation StackSets to deploy to multiple accounts and use stack instance filters.

Answer

Use a custom resource in the template that checks for IAM changes and fails the update.

Question 2

A company is implementing a CI/CD pipeline using AWS CodePipeline. The source code is stored in an AWS CodeCommit repository. The pipeline must automatically start whenever a change is pushed to any branch. Which configuration is required?

Accepted Answer

Create a CloudWatch Events rule that matches CodeCommit push events and targets the CodePipeline pipeline.. Option D is correct because CodePipeline can use Amazon CloudWatch Events to detect changes in CodeCommit repositories and trigger the pipeline. Option A is wrong because CodePipeline does not have a built-in trigger for branch creation. Option B is wrong because polling is not recommended and may not detect changes immediately. Option C is wrong because CodeCommit does not send SNS notifications for pushes.

Answer

Add a branch creation trigger in CodeCommit that starts the pipeline.

Answer

Create an SNS topic and subscribe the pipeline to it, then configure CodeCommit to publish to the topic on push.

Answer

Configure the pipeline to poll the CodeCommit repository every few minutes.

Question 3

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack update. The stack contains an AWS::Lambda::Function resource. The update failed with the error 'Resource creation cancelled' after a timeout. The engineer wants to view the logs from the Lambda function during the stack update to diagnose the issue. What should the engineer do?

Accepted Answer

Access the CloudWatch Logs log group for the Lambda function. CloudFormation does not directly capture Lambda function logs. The Lambda function logs are sent to Amazon CloudWatch Logs. The engineer should check the CloudWatch Logs log group for the specific function to see any errors during invocation. Option A is correct. Option B is wrong because the stack events do not include function logs. Option C is wrong because CloudFormation does not log function output. Option D is wrong because CodeBuild is not involved in this scenario.

Answer

Use AWS CodeBuild to build and test the function locally

Answer

Enable detailed CloudFormation logging in the stack template

Answer

Review the CloudFormation stack events in the AWS Management Console

Question 4

A DevOps engineer is creating an AWS CloudFormation template to deploy a stack that includes an Amazon EC2 instance. The instance needs to be launched in a specific subnet. How should the engineer reference the subnet ID in the template?

Accepted Answer

Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.. Option C is correct because using a parameter allows the subnet ID to be passed in at stack creation time, making the template reusable. Option A is wrong because hardcoding reduces reusability. Option B is wrong because mappings are for static values, not dynamic IDs. Option D is wrong because the Fn::GetAtt function is used to get attributes of resources created in the same stack, not for parameters.

Answer

Hardcode the subnet ID in the template.

Answer

Use a mapping (Mappings) to define the subnet ID based on the stack name.

Answer

Use the Fn::GetAtt function to retrieve the subnet ID from a VPC resource.

Question 5

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project's artifacts are automatically deployed to an Amazon S3 bucket with server-side encryption using AWS KMS? (Choose 2.)

Accepted Answer

In the buildspec.yaml, set the 'artifacts' section to include 'encryptionDisabled: false' and specify the KMS key ID.. Options A and C are correct. Option A ensures the CodeBuild service role has permission to use the KMS key. Option C configures the artifacts to be uploaded with KMS encryption. Option B is wrong because setting the S3 bucket default encryption does not affect CodeBuild uploads if CodeBuild specifies its own encryption. Option D is wrong because encryption in transit (HTTPS) does not relate to server-side encryption. Option E is wrong because enabling versioning does not enforce encryption.

Answer

Enable versioning on the S3 bucket.

Answer

Configure the S3 bucket policy to require HTTPS for all uploads.

Answer

Enable default encryption on the S3 bucket using SSE-KMS.

Question 6

An IAM policy is attached to a service role used by AWS CodePipeline. Which TWO statements about this policy are correct?

Accepted Answer

The policy allows starting a pipeline execution. The policy allows codepipeline:StartPipelineExecution and codepipeline:PutJobSuccessResult, PutJobFailureResult. These actions are used by custom actions or Lambda functions to report job status. However, CodePipeline itself does not call StartPipelineExecution; it's used by external triggers. The policy does not allow codepipeline:UpdatePipeline, so updating the pipeline definition is not allowed. Option B is correct: the policy allows reporting success or failure of a job. Option D is correct: the policy allows starting a pipeline execution. Option A is wrong because codebuild:StartBuild is allowed only for the specific project. Option C is wrong because s3:PutObject is allowed for the artifact bucket, but s3:GetObject is also allowed. Option E is wrong because updating the pipeline is not allowed.

Answer

The policy allows updating the pipeline definition

Answer

The policy allows starting any CodeBuild project

Answer

The policy allows reading and writing objects to any S3 bucket

Question 7

A development team is using AWS CodeCommit as a source repository and AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a build stage that runs on AWS CodeBuild. The team wants to automatically trigger the pipeline when changes are pushed to the 'develop' branch of the CodeCommit repository. Which configuration change should be made to the pipeline?

Accepted Answer

Configure the source action to use CodeCommit as the source provider and specify the 'develop' branch.. Option B is correct because CodePipeline can be configured with a source action that uses the 'Amazon S3' (via CodeCommit webhook) or directly with CodeCommit as the source provider, and a cloudwatch event rule is automatically created to trigger the pipeline on changes to the specified branch. Option A is wrong because manual approval is not needed for automatic triggering. Option C is wrong because CodeBuild can be triggered independently, but the pipeline itself needs a source trigger. Option D is wrong because S3 events are not used for CodeCommit.

Answer

Enable S3 event notifications on the repository to invoke the pipeline.

Answer

Add a manual approval action before the build stage.

Answer

Create a CodeBuild webhook on the CodeCommit repository.

Question 8

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline deploys a static website to an S3 bucket. The deployment must ensure that the website is always available and that rollbacks happen automatically if the deployment fails. Which TWO actions should the company take?

Accepted Answer

Use a blue/green deployment strategy with two S3 buckets. To ensure availability during deployment, use a blue/green deployment strategy with two separate buckets (one active, one staging). Automated rollbacks can be achieved by configuring CloudFront to point to the active bucket and using CloudFormation to manage the deployment with rollback triggers. Option A (blue/green with two buckets) is correct because it allows switching traffic after successful deployment. Option D (CloudFormation with rollback configuration) is correct because CloudFormation can automatically roll back on failure. Option B is wrong because versioning alone doesn't provide zero-downtime switching. Option C is wrong because it doesn't specify a rollback mechanism. Option E is wrong because Route53 weighted routing can be used but is more complex and not the best practice.

Answer

Use Amazon Route53 weighted routing to shift traffic

Answer

Use AWS CodeDeploy with an in-place deployment

Answer

Enable S3 bucket versioning to keep multiple versions

Question 9

A DevOps team is using AWS CodeBuild to run integration tests against a test database. The database is an Amazon RDS instance in a private subnet. The CodeBuild project is configured to run in a VPC. Which THREE steps are required to allow CodeBuild to access the RDS instance?

Accepted Answer

Ensure the security group attached to the RDS instance allows inbound traffic from the CodeBuild security group.. Correct answers are A, B, and D. A: The CodeBuild project must have VPC configuration to place it in the same VPC. B: Security group must allow inbound traffic from CodeBuild. D: Outbound routes are needed to reach RDS. C is wrong because NAT gateway is for internet access, not internal RDS. E is wrong because the database should be in a private subnet, and a public subnet is not needed.

Answer

Place the RDS instance in a public subnet with a public IP.

Answer

Attach a NAT gateway to the VPC so that CodeBuild can route to RDS.

Question 10

A company uses AWS Systems Manager Automation to patch EC2 instances. The automation document 'AWS-RunPatchBaseline' runs successfully but some instances are not patched because they are not managed by Systems Manager. What is the most likely reason?

Accepted Answer

The instances do not have the AWS Systems Manager Agent (SSM Agent) installed and the required IAM role attached.. Option B is correct: SSM Agent must be installed and the instance must have an IAM role that allows Systems Manager actions. Option A is not a requirement. Option C is not required. Option D is incorrect.

Answer

The instances are running Windows Server 2012 or older.

Answer

The instances are in a VPC without internet access.

Answer

The automation document is not compatible with the instance's operating system.

Question 11

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The deployment consistently fails because the Lambda function's IAM role is not created before the function. The team uses a single CloudFormation template. Which action should be taken to resolve this dependency issue?

Accepted Answer

Add a DependsOn attribute in the CloudFormation template to ensure the IAM role is created before the Lambda function.. Option A is correct because CloudFormation handles resource dependencies via the DependsOn attribute. The issue is that the template likely lacks a DependsOn on the Lambda function resource to wait for the IAM role. Adding DependsOn ensures the role is created first. Option B is wrong because nested stacks add complexity but don't inherently fix dependency ordering. Option C is wrong because the role should be in the same template. Option D is wrong because wait conditions are for external signals, not resource dependencies.

Answer

Create the IAM role in a separate CodeBuild action before the deploy stage.

Answer

Add a wait condition in the CloudFormation template.

Answer

Separate the IAM role into a nested stack and reference it.

Question 12

A DevOps team uses AWS CodePipeline with an S3 source action and CodeBuild as a build provider. The pipeline has a manual approval step before deployment. Recently, the team noticed that the pipeline automatically starts when a new object is uploaded to the S3 bucket, even if the object is not the source code. They want to ensure that the pipeline only triggers on changes to the source code directory. What is the MOST efficient solution?

Accepted Answer

Configure the S3 event notification to use a prefix filter that matches the source code directory.. Option C is correct because S3 event notifications can be filtered by prefix and suffix, so setting a prefix filter to the source code directory ensures only changes to that directory trigger the pipeline. Option A is wrong because enabling versioning alone doesn't filter events. Option B is wrong because CloudWatch Events can filter but adds complexity and cost. Option D is wrong because disabling automatic triggers would require manual intervention, which is not efficient.

Answer

Use Amazon CloudWatch Events to create a custom rule that matches the source code path and triggers the pipeline.

Answer

Enable versioning on the S3 bucket and configure the pipeline to use the latest version.

Answer

Disable the S3 trigger and manually start the pipeline after each code commit.

Question 13

A DevOps engineer is setting up a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build environment requires specific software packages that are not available in the default CodeBuild environment. What is the MOST efficient way to customize the build environment?

Accepted Answer

Create a custom Docker image with the required software and push it to Amazon ECR.. Option B is correct because using a custom Docker image with pre-installed software is the most efficient and repeatable way. Option A is wrong because install commands increase build time and are error-prone. Option C is wrong because buildspec is not for environment customization. Option D is wrong because a separate pipeline is unnecessary.

Answer

Create a separate pipeline to pre-build the environment.

Answer

Add install commands in the buildspec file to install the packages during each build.

Answer

Modify the buildspec file to set environment variables that include the software packages.

Question 14

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration uses a linear traffic shifting with a 10-minute interval. The application logs show that the new version of the application crashes on startup. What is the MOST effective way to handle this situation to ensure successful future deployments?

Accepted Answer

Add a script in the AppSpec file's 'Validate Service' lifecycle hook to check the application health and fail the deployment if the application does not start successfully.. Option B is correct because adding a script to the AppSpec file that validates the application health before allowing traffic shifting can catch startup failures early and prevent deployment failures. Option A is wrong because increasing the interval doesn't fix the root cause. Option C is wrong because rolling back doesn't address the underlying issue. Option D is wrong because a blue/green deployment would still have the same crash issue.

Answer

Increase the interval in the linear traffic shifting to 30 minutes to allow more time for instances to stabilize.

Answer

Configure the deployment to automatically roll back when a failure occurs and ignore the error.

Answer

Switch to a blue/green deployment strategy to minimize the impact on existing instances.

Question 15

A developer is using AWS CodeBuild to compile code. The build takes a long time because dependencies are downloaded each time. What can the developer do to reduce build time?

Accepted Answer

Enable caching in the build project to store dependencies in Amazon S3.. Option C is correct because caching dependencies in a S3 bucket allows subsequent builds to reuse them. Option A is wrong because upgrading instance type may not help if the bottleneck is network. Option B is wrong because parallel builds don't reduce single build time. Option D is wrong because multiple build environments don't reduce time.

Answer

Split the build into multiple parallel build actions.

Answer

Use multiple build environments to distribute the work.

Answer

Use a larger compute type for the build project.