DOP-C02 Practice Test 5 — 25 Questions

Question 1

A company uses AWS CodePipeline with a multi-branch strategy. The pipeline deploys a Lambda function using CloudFormation. The DevOps engineer notices that when a new branch is created, the pipeline executes but the CloudFormation stack fails because the stack name already exists. What is the MOST efficient way to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the pipeline to use a dynamic stack name parameter, such as the branch name.. Using a dynamic stack name parameter, such as the branch name, ensures each branch creates a unique CloudFormation stack. This avoids naming conflicts while allowing independent infrastructure per branch. In CodePipeline, you can pass the branch name as a variable (e.g., #{SourceVariables.BranchName}) to the CloudFormation deploy action, making the stack name unique without manual intervention.

Answer

Hardcode a different stack name for each branch in the pipeline.

Answer

Delete the existing stack before each deployment.

Answer

Use the CloudFormation 'Override' parameter to reuse the same stack.

Question 2

A DevOps engineer is designing a CI/CD pipeline that must enforce a policy: any change to the production branch in CodeCommit must be reviewed and approved by two senior developers before the change can be merged. The pipeline must also automatically build and deploy to a staging environment after approval. Which combination of AWS services and configurations should be used?

Accepted Answer

Use CodeCommit pull request approval rules and a CodePipeline with a manual approval step triggered by a Lambda function that checks approval status. CodeCommit pull request approval rules enforce the requirement for two senior developers to approve changes before merging, and CodePipeline with a manual approval step can be configured to trigger a Lambda function that checks the approval status before proceeding to build and deploy to staging. This combination directly satisfies the policy of requiring two approvals and automating the build/deploy after approval.

Answer

Configure CodeBuild to run a script that checks the commit author and rejects if not approved

Answer

Use Amazon EventBridge to trigger a Lambda function that validates the number of approvers before merging

Answer

Use IAM policies to restrict write access to the production branch to only senior developers

Question 3

A company uses AWS CloudFormation to manage infrastructure. The DevOps engineer wants to implement a CI/CD pipeline that builds and tests a CloudFormation template and then deploys it across multiple AWS accounts. Which combination of services should the engineer use?

Accepted Answer

Use CodePipeline with separate CodeBuild projects for validation and CloudFormation deployment actions assuming IAM roles in target accounts.. It uses CodePipeline to orchestrate the CI/CD workflow, with separate CodeBuild projects for template validation (e.g., cfn-lint) and deployment actions that assume IAM roles in target accounts. This design ensures cross-account access via role assumption, which is the recommended pattern for multi-account deployments, and separates validation from deployment for better control and rollback.

Answer

Use CodeBuild to run cfn-lint and then use AWS Lambda to deploy stacks across accounts.

Answer

Use CodePipeline with CodeDeploy to deploy CloudFormation stacks across accounts.

Answer

Use CodePipeline with a single CodeBuild project to run cfn-lint and deploy to all accounts.

Question 4

A company uses AWS CodeBuild to run unit tests for a Python application. The buildspec.yml file specifies a build phase that runs 'pytest'. The team wants to ensure that the build fails if any test fails, and that test results are available in the CodeBuild console. Which change should they make to the buildspec.yml?

Accepted Answer

Add a 'reports' section to the buildspec.yml that specifies the test report group and the location of the test results file.. To make test results available in the CodeBuild console, the buildspec.yml must include a 'reports' section that specifies the report group and the location of the test results file. CodeBuild automatically fails the build if a command in the build phase returns a non-zero exit code, so 'pytest' failures will cause the build to fail. The 'reports' section integrates with CodeBuild's test reporting feature, providing detailed test outcomes. The other options either describe non-existent features or do not provide the required reporting integration.

Answer

Modify the build phase to run 'pytest --junitxml=results.xml' and add an artifacts section to upload results.xml.

Answer

Add a post_build phase that checks the exit code of the build phase and fails the build if tests failed.

Answer

Set the 'fail-fast' option to true in the build phase to stop the build immediately if any test fails.

Question 5

A DevOps engineer is setting up monitoring for an Amazon DynamoDB table that experiences high read traffic. They want to monitor the read capacity consumption and be alerted when the consumed read capacity exceeds 80% of the provisioned capacity for 5 consecutive minutes. Which TWO steps should they take? (Select TWO.)

Accepted Answer

Use CloudWatch to monitor the ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits metrics.. CloudWatch directly exposes the ConsumedReadCapacityUnits and ProvisionedReadCapacityUnits metrics for DynamoDB, which are the exact metrics needed to calculate read capacity utilization. Monitoring these metrics allows the engineer to track how much of the provisioned capacity is being consumed over time, which is the foundation for setting up the desired alert.

Answer

Enable AWS CloudTrail to log DynamoDB read requests.

Answer

Set up an AWS Lambda function to monitor the DynamoDB ReadThrottleEvents metric.

Answer

Configure DynamoDB to stream all read events to CloudWatch Logs.

Question 6

A company is using AWS Elastic Beanstalk with a custom platform. The DevOps team wants to automate the creation of a new platform version whenever changes are pushed to a Git repository. The pipeline should run tests, build the platform, and then update the Elastic Beanstalk environment to use the new platform version. Which services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can run the tests and build the custom platform artifact. In this scenario, CodeBuild executes the buildspec to compile code, run unit tests, and produce the platform version (e.g., an AMI or Packer image). It integrates directly with CodePipeline to receive source changes and pass artifacts downstream for environment updates.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 7

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must deploy to Amazon ECS using blue/green deployments. The team wants to automatically roll back if the new deployment fails health checks. Which combination of AWS services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with an ECS compute platform, configure a CloudWatch alarm for health checks, and enable automatic rollback.. AWS CodeDeploy with an ECS compute platform natively supports blue/green deployments for Amazon ECS, including automatic rollback triggered by CloudWatch alarms. By configuring a CloudWatch alarm based on ECS service health checks (e.g., ELB target group health), CodeDeploy can automatically revert to the original blue task set if the new green deployment fails, meeting the requirement for zero-touch rollback.

Answer

Use AWS CloudFormation with a custom resource to perform blue/green deployment.

Answer

Use AWS Elastic Beanstalk with blue/green environment swapping.

Answer

Use AWS CodePipeline with ECS deployment action and manual approval for rollback.

Question 8

A DevOps engineer updates an ECS service via CloudFormation. The stack update fails with the message 'Resource update cancelled'. The engineer notices that the ECS service's desired count was temporarily reduced during the update. What is the most likely cause of the failure?

Accepted Answer

The ECS service's minimum healthy percent was set to 100, causing the desired count reduction to zero to be rejected.. The error 'Resource update cancelled' occurs because CloudFormation detected that the ECS service update was not progressing as expected. When the minimum healthy percent is set to 100, the deployment process cannot reduce the desired count to zero (or below the current running count) without violating the requirement that 100% of the tasks remain healthy. This causes the update to be cancelled as CloudFormation waits indefinitely for the deployment to complete, eventually timing out and rolling back.

Answer

The ECS service's target group had an unhealthy instance that prevented the deregistration.

Answer

The ECS service deployment circuit breaker was triggered due to a timeout.

Answer

The ECS service did not have the required IAM role to call ecs:UpdateService.

Question 9

An operations team manages a fleet of Amazon EC2 instances that require periodic software updates. They want to use AWS Systems Manager to apply patches automatically while ensuring that patches are tested before production deployment. Which approach meets these requirements?

Accepted Answer

Use AWS Systems Manager Patch Manager with maintenance windows, and configure a patch baseline that approves patches after a test period.. AWS Systems Manager Patch Manager, when combined with maintenance windows and a patch baseline configured with an approval delay after a test period, allows patches to be automatically applied to test instances first and then, after a defined waiting period, to production instances. This ensures patches are tested before production deployment without manual intervention, meeting the requirement for automated, staged patching.

Answer

Use AWS Systems Manager Automation to create a runbook that patches instances one by one.

Answer

Create a patch baseline and assign it to all instances; enable automatic approval for all patches.

Answer

Use AWS Systems Manager Run Command to manually run patch commands on test instances, then on production.

Question 10

An organization wants to ensure that all objects stored in the S3 bucket are encrypted at rest using server-side encryption with S3 managed keys (SSE-S3). The bucket policy above is intended to enforce this. However, a user reported that they can still upload unencrypted objects. What is the MOST likely reason?

Accepted Answer

The condition is applied to the GetObject action, not the PutObject action.. The bucket policy condition `s3:x-amz-server-side-encryption` is applied to the `s3:GetObject` action instead of `s3:PutObject`. This means the policy only checks encryption headers when reading objects, not when uploading them. To enforce encryption at upload time, the condition must be attached to the `s3:PutObject` action, which is the operation that accepts the `x-amz-server-side-encryption` header.

Answer

The bucket policy is not attached to the bucket because of a circular dependency.

Answer

The bucket policy does not apply to objects uploaded by the root user.

Answer

The condition should use 's3:x-amz-server-side-encryption-aws-kms-key-id' instead.

Question 11

A company uses Terraform with an S3 backend to manage infrastructure. The DevOps engineer notices that after a colleague runs 'terraform apply' locally, the state file in S3 becomes corrupted and subsequent runs fail. What is the BEST way to prevent this issue?

Accepted Answer

Use DynamoDB for state locking and enable consistency checks.. Enabling DynamoDB for state locking prevents concurrent modifications that can corrupt the state file. When a user runs 'terraform apply', Terraform acquires a lock in DynamoDB, ensuring only one operation modifies the state at a time. Consistency checks (e.g., using DynamoDB's conditional writes) further validate that the state hasn't been tampered with, directly addressing the corruption issue.

Answer

Store the state file locally and commit it to version control.

Answer

Use S3 server-side encryption to protect the state file.

Answer

Enable S3 versioning on the state bucket to recover previous versions.

Question 12

A company uses AWS CodePipeline to deploy a critical application. The pipeline has a manual approval step before deployment. Which TWO actions should be taken to improve security and auditability? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all approval actions.. Enabling AWS CloudTrail to log all approval actions provides a detailed, immutable audit trail of who approved or rejected a pipeline stage, when it happened, and from which IP address. This is essential for compliance and forensic analysis, as CloudTrail captures the `Approval` API calls made by CodePipeline, including the `approve` and `reject` actions, along with the IAM user or role identity. Without CloudTrail, there is no native logging of manual approval events, making it impossible to prove accountability.

Answer

Remove the approval step and rely on post-deployment monitoring.

Answer

Replace the manual approval with an automated approval based on test results.

Answer

Use a shared IAM user for all approvers to simplify management.

Question 13

A DevOps engineer is designing a secure CI/CD pipeline. Which TWO of the following are best practices for securing secrets in the pipeline?

Accepted Answer

Use encrypted environment variables in CodeBuild.. Options A and E are correct. Option A: CodeBuild allows environment variables to be encrypted using AWS KMS, which is a secure way to handle secrets in the pipeline. Option E: AWS Secrets Manager is a dedicated service for securely storing and retrieving secrets, and integrating it with the pipeline ensures secrets are not exposed. Option B is incorrect because storing secrets in a parameter file in the source repository exposes them to anyone with repository access, violating security best practices. Option C is incorrect because hardcoding secrets in CloudFormation template parameters can lead to exposure in logs or template outputs, and is not secure. Option D is incorrect because while S3 bucket policies can restrict access, they do not encrypt the secrets themselves, and S3 is not designed for managing secrets; AWS Secrets Manager or Parameter Store are better choices.

Answer

Store secrets in a parameter file in the source repository.

Answer

Hardcode secrets in CloudFormation template parameters.

Answer

Use S3 bucket policies to restrict access to secret files.

Question 14

A company uses AWS CodeCommit for source control. Developers need to automatically run tests on every push to a feature branch, but only if the push includes changes to the 'src/' directory. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CodePipeline. AWS CodePipeline can be configured to trigger a pipeline execution when a push occurs to a specific branch in CodeCommit, and it supports path-based filtering using the 'PathFilter' condition in the source action. By combining CodePipeline with AWS Lambda, you can run custom validation logic (e.g., checking if changes are within the 'src/' directory) before invoking further actions like tests. This pair allows you to conditionally run tests only when the push includes changes to 'src/'.

Answer

Amazon CloudWatch Logs

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Question 15

A company uses DynamoDB global tables for a multi-region application. They notice that write conflicts are occurring. Which TWO strategies can reduce write conflicts?

Accepted Answer

Use conditional writes in the application code. Conditional writes prevent overwriting data unless a specified condition is met, thereby reducing write conflicts by ensuring that updates are only applied when the data is in a known state. Application-level conflict resolution allows the application to handle conflicts when they occur, using custom logic to merge or resolve differences, which reduces the impact of conflicts on the database. Option D (increasing write capacity) does not reduce conflicts; it only increases throughput capacity. Option A (reducing read capacity) is unrelated to write conflicts. Option B (DynamoDB Streams with last writer wins) is the default behavior and does not reduce conflicts; it may cause data loss.

Answer

Reduce read capacity units to limit concurrent reads

Answer

Enable DynamoDB Streams with last writer wins

Answer

Increase write capacity units on the table

Question 16

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service can be used to achieve this?

Accepted Answer

Use AWS Config with a custom Lambda function to rotate keys when they are older than 90 days.. AWS IAM does not have a built-in automatic rotation feature for access keys. AWS Secrets Manager can store secrets and rotate them, but it does not natively rotate IAM access keys; it supports rotation for RDS, Redshift, and DocumentDB, but not IAM. AWS CloudTrail is a logging service and cannot rotate keys. However, AWS Config can be used with a custom AWS Lambda function to create a rule that triggers rotation when access keys are older than 90 days. Therefore, option D is the correct answer.

Answer

Store the access keys in AWS Secrets Manager and enable automatic rotation.

Answer

Use AWS CloudTrail to detect old keys and send notifications to administrators.

Answer

Use IAM's built-in access key rotation feature.

Question 17

A company runs a critical application on Amazon ECS with Fargate. The application emits structured logs in JSON format. The DevOps team wants to monitor for specific error codes and receive near-real-time alerts. The team also needs to retain logs for 5 years for compliance. Which TWO steps should the team implement?

Accepted Answer

Create a CloudWatch Logs metric filter to count occurrences of specific error codes and create an alarm. CloudWatch Logs metric filters can parse JSON-structured logs to count occurrences of specific error codes, and you can create a CloudWatch alarm on that metric to trigger near-real-time notifications via SNS. This is a native, low-latency solution for monitoring specific patterns in ECS Fargate logs without additional infrastructure.

Answer

Use Amazon Kinesis Data Analytics to analyze logs in real-time and send alerts

Answer

Enable AWS CloudTrail to log the application's API calls

Answer

Stream logs to Amazon S3 via Amazon Kinesis Data Firehose and use S3 event notifications to trigger alerts

Question 18

A company uses AWS CloudFormation to provision infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the stack to change the DB instance class from db.t2.micro to db.t3.medium. Which THREE of the following must be true for the update to succeed? (Choose three.)

Accepted Answer

The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.. CloudFormation stacks in a terminal failure state like ROLLBACK_COMPLETE cannot be updated; they must be deleted and recreated. This is a fundamental constraint of the CloudFormation service, as the stack is considered non-functional and unable to process further operations.

Answer

Deletion protection must be disabled on the DB instance.

Answer

A change set must be created and executed for the update.

Question 19

A DevOps team is investigating a performance issue where an application's response time spiked during a deployment. The deployment used AWS CodeDeploy to update an Auto Scaling group. Which THREE actions should the team take to identify the root cause? (Choose THREE.)

Accepted Answer

Review the CodeDeploy deployment logs for errors.. CodeDeploy deployment logs contain detailed information about the deployment process, including any errors or failed steps that could impact performance. Option B is correct because application logs on the new EC2 instances can reveal errors, misconfigurations, or resource contention that may have caused the spike. Option E is correct because comparing CloudWatch metrics (e.g., CPU utilization, latency, request count) before and after the deployment helps pinpoint changes that correlate with the performance issue. Option C is wrong because reviewing the deployment group configuration—which defines how deployments occur (e.g., traffic routing, instance selection)—is unlikely to directly identify the root cause of a performance spike; it is more relevant for deployment strategy issues. Option D is wrong because AWS CloudTrail records API calls for auditing and security, not application performance; unauthorized API calls are unlikely to cause a transient performance spike during deployment.

Answer

Review the CodeDeploy deployment group configuration.

Answer

Check AWS CloudTrail for any unauthorized API calls during the deployment.

Question 20

A company's DevOps team is designing a disaster recovery plan for a critical application. The application runs on EC2 instances with an RDS MySQL database. The Recovery Time Objective (RTO) is 15 minutes, and the Recovery Point Objective (RPO) is 1 hour. Which approach BEST meets these requirements?

Accepted Answer

Use a multi-Region application with Route 53 latency-based routing and RDS read replicas in the DR Region.. The best approach for a multi-Region disaster recovery with RTO of 15 minutes and RPO of 1 hour. By deploying the application in multiple regions and using RDS cross-Region read replicas, data is asynchronously replicated with an RPO typically within seconds to minutes, well within 1 hour. In the event of a failure, the read replica can be promoted to a primary instance, and Route 53 routing (preferably failover routing, but latency-based routing can also redirect traffic) can shift traffic to the DR region. This failover can be completed within a few minutes, meeting the 15-minute RTO. Option A fails because daily snapshots exceed the 1-hour RPO and restore times exceed the RTO. Option C incorrectly relies on RDS Multi-AZ, which is a single-region high-availability feature and does not provide cross-region replication; thus it cannot serve as a disaster recovery solution across regions. Option D, pilot light with snapshots, has a longer RTO as it requires restoring instances from snapshots and starting them, likely exceeding 15 minutes.

Answer

Use backup and restore with daily snapshots stored in S3 and cross-Region replication.

Answer

Use a warm standby strategy with a scaled-down copy of the production environment in the DR Region, and replicate data using RDS Multi-AZ with synchronous replication.

Answer

Use a pilot light strategy with EC2 instances stopped and RDS snapshots copied to the DR Region.