DOP-C02 Practice Test 5 — 25 Questions

Question 1

A DevOps engineer is managing a CI/CD pipeline using AWS CodePipeline with multiple stages: Source (CodeCommit), Build (CodeBuild), Test (CodeBuild), and Deploy (CodeDeploy). The engineer wants to add manual approval steps before the Test and Deploy stages. Additionally, the pipeline should automatically roll back the deployment if the Deploy stage fails. Which two actions should the engineer take to implement these requirements? (Choose two.)

Accepted Answer

Insert a new stage between Build and Test, and add an Approval action to that stage.. Option B is correct because manual approval actions in AWS CodePipeline must be added as a separate stage, not within an existing stage. By inserting a new stage between Build and Test and adding an Approval action, the pipeline pauses before the Test stage, allowing manual review. Option C is correct because CodeDeploy deployment groups support automatic rollback on deployment failure, which can be enabled in the deployment group configuration to revert to the last known good revision.

Answer

Add an Approval action in the Test stage before the Test build action.

Answer

Add a Lambda function in the pipeline that triggers a rollback if the Deploy stage fails.

Answer

Configure the pipeline's Deploy stage to have a 'Rollback' action that runs on failure.

Question 2

A company runs a stateless web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer. The operations team needs to ensure that the application remains available if one AZ fails. Which solution is MOST resilient?

Accepted Answer

Configure the Auto Scaling group to launch instances in three Availability Zones with a desired capacity of 3.. Option C is correct because distributing instances across three Availability Zones (AZs) with a desired capacity of 3 ensures that even if one AZ fails, the remaining two AZs still have at least 2 instances running, maintaining service capacity. The Application Load Balancer (ALB) automatically routes traffic away from the failed AZ, and the Auto Scaling group will replace lost instances in the healthy AZs, providing the highest resilience against a single-AZ failure.

Answer

Configure the Auto Scaling group to launch instances in a single Availability Zone with a desired capacity of 6.

Answer

Configure the Auto Scaling group to launch instances in two Availability Zones with a desired capacity of 4.

Answer

Configure the Auto Scaling group to launch instances in two Availability Zones with a desired capacity of 6, all in one AZ.

Question 3

A company is running a microservices application on Amazon ECS with AWS Fargate. The operations team needs to monitor application performance and troubleshoot slow API responses. They currently use Amazon CloudWatch Logs for container logs and have enabled Container Insights. However, they are unable to see detailed latency breakdowns per API endpoint. Which solution would provide the most granular visibility into API performance?

Accepted Answer

Use AWS X-Ray to instrument the application and collect trace data.. AWS X-Ray provides end-to-end tracing of requests as they travel through microservices, capturing detailed latency breakdowns per API endpoint, including downstream calls, database queries, and external HTTP requests. This gives the operations team the granular visibility needed to pinpoint exactly where slow responses occur, unlike aggregated metrics or log-based queries.

Answer

Enable detailed CloudWatch metrics for ECS and Fargate, including CPU and memory.

Answer

Enable CloudWatch Logs Insights to query API logs for slow requests.

Answer

Deploy the AWS Distro for OpenTelemetry collector on each task to send metrics to CloudWatch.

Answer

Set up VPC Flow Logs to analyze network latency between services.

Question 4

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. During a security incident, the security team needs to isolate a compromised instance for forensic analysis without affecting the application's availability. What is the MOST effective action to take?

Accepted Answer

Deregister the instance from the target group and stop the instance for forensic analysis.. Deregistering the instance from the target group removes it from the Application Load Balancer's routing, ensuring no new traffic is sent to it while existing connections drain (connection draining). Stopping the instance preserves its memory and disk state for forensic analysis without impacting application availability, as the remaining healthy instances continue to serve traffic.

Answer

Modify the security group of the instance to deny all inbound and outbound traffic.

Answer

Terminate the compromised instance immediately to prevent further damage.

Answer

Change the subnet route table to route traffic away from the compromised instance.

Question 5

A DevOps team is investigating a production incident where an Amazon RDS for MySQL database experienced a sudden spike in connections and CPU utilization. The team suspects a SQL injection attack. Which TWO actions should the team take to investigate and mitigate the incident?

Accepted Answer

Enable automated backups and ensure point-in-time recovery is configured.. Option B is correct because enabling automated backups and point-in-time recovery ensures that the database can be restored to a state before the suspected SQL injection attack, preserving data integrity and enabling forensic analysis. Option C is correct because RDS Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) to correlate with the spike, while audit logs capture actual SQL queries, which are essential for identifying malicious patterns and confirming the attack vector.

Answer

Delete the error logs to free up storage space.

Answer

Create a read replica to offload traffic from the primary instance.

Answer

Increase the DB instance size to handle the increased load.

Question 6

An incident response team is analyzing an IAM policy attached to a role used by a forensic tool. The tool needs to create snapshots of EBS volumes during an incident. However, when the tool runs from an IP address in the 203.0.113.0/24 range, the CreateSnapshot API call fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The aws:ViaAWSService condition is set to false, but the tool is invoked by an AWS service such as Systems Manager, making the condition evaluate to true and denying access.. The aws:ViaAWSService condition key evaluates to true when an API call is made by an AWS service on behalf of a principal. If the policy sets this condition to false, it denies any call that originates from an AWS service (e.g., Systems Manager Automation). In this scenario, the forensic tool is likely invoked by Systems Manager, causing the condition to evaluate to true and triggering the deny, even though the source IP is allowed. This explains why CreateSnapshot fails with access denied despite the IP being in the allowed range.

Answer

The policy does not grant ec2:CreateSnapshot on specific resource ARNs, only on all resources.

Answer

The Deny statement explicitly denies ec2:DeleteSnapshot, but the error is for CreateSnapshot, so it is unrelated.

Answer

The source IP address 203.0.113.0/24 is not included in the Condition block, so access is implicitly denied.

Question 7

A financial services company is migrating its applications to AWS. The compliance team requires that all Amazon S3 buckets containing personally identifiable information (PII) must have server-side encryption enabled and block public access. The DevOps team discovers that some S3 buckets are not compliant. Which TWO actions should the team take to enforce these requirements automatically for all current and future buckets? (Select TWO.)

Accepted Answer

Use AWS Config managed rules to detect noncompliant buckets and automatically remediate by applying encryption and blocking public access.. AWS Config managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-public-read-prohibited) can automatically detect noncompliant S3 buckets. Combined with AWS Config auto-remediation using Systems Manager Automation documents, the team can enforce encryption and block public access without manual intervention, ensuring all current and future buckets remain compliant.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts when noncompliant buckets are created.

Answer

Attach an IAM permissions boundary to all users that prevents them from creating or modifying S3 buckets.

Answer

Apply an S3 bucket policy to each existing bucket that denies all access unless encryption is enabled.

Question 8

A company runs a critical application on Amazon ECS with Fargate. The application is deployed across multiple Availability Zones and uses an Application Load Balancer (ALB) as the front-end. During a recent incident, users experienced intermittent connectivity failures. The DevOps team suspects that tasks are being stopped due to resource exhaustion. Which combination of metrics and actions should the team use to diagnose and prevent recurrence?

Accepted Answer

Monitor CPU and memory utilization metrics in CloudWatch; increase the task size (CPU and memory) in the task definition.. Option A is correct because CPU and memory utilization metrics in CloudWatch directly indicate resource exhaustion, which is the suspected cause of tasks being stopped. Increasing the task size (CPU and memory) in the task definition provides more resources per task, preventing the OOM killer or CPU throttling from stopping tasks, without changing the number of tasks or scaling logic.

Answer

Set up CloudWatch Logs for the application and check for out-of-memory errors; then increase the number of tasks.

Answer

Monitor NetworkPacketsIn and NetworkPacketsOut metrics in CloudWatch; increase the number of tasks.

Answer

Monitor the ALB error metrics (5xx count) and scale the ECS service based on request count.

Question 9

A company is using AWS Organizations with multiple accounts. The Security team wants to centrally manage IAM roles that can be assumed by users in member accounts. Which solution should be used to enforce that only specific roles can be assumed across accounts, while ensuring that the policy updates are automatically applied to all accounts?

Accepted Answer

Create an IAM role in the Security account with a trust policy that references a service control policy (SCP) in AWS Organizations.. Option C is correct because it leverages AWS Organizations and Service Control Policies (SCPs) to centrally enforce which IAM roles can be assumed across member accounts. An SCP applied to an OU or account can explicitly deny the `sts:AssumeRole` action for any role that does not match a specific ARN pattern, ensuring that only the Security account's designated roles are assumable. Since SCPs are automatically inherited by all accounts in the organization, policy updates are applied without manual intervention.

Answer

Create an IAM role in each member account with a trust policy that allows the Security account, and use AWS CloudFormation StackSets to deploy the roles.

Answer

Use AWS Single Sign-On (SSO) to assign permissions to users across accounts.

Answer

Create a resource-based policy on each IAM role in the member accounts that allows the Security account to assume the role.

Question 10

Drag and drop the steps to set up an AWS CodePipeline with a source stage from CodeCommit and a deploy stage to Elastic Beanstalk.

Accepted Answer

Create S3 bucket, then create CodeCommit repository and push code, then create pipeline, then configure source, then configure deploy.. The correct order is: first create the S3 bucket for artifacts, then create the CodeCommit repository and push code, then create the pipeline, then configure source, then configure deploy.

Answer

Create pipeline, then create S3 bucket, then create CodeCommit repository and push code, then configure source, then configure deploy.

Answer

Configure source, then configure deploy, then create S3 bucket, then create CodeCommit repository and push code, then create pipeline.

Answer

Create CodeCommit repository and push code, then create S3 bucket, then create pipeline, then configure deploy, then configure source.

Question 11

Drag and drop the steps to troubleshoot a failed deployment in AWS CodeDeploy into the correct order.

Accepted Answer

Check CodeDeploy Console → Review Agent Logs → Validate AppSpec File → Verify Instance Configuration → Redeploy. Troubleshooting starts with console, then agent logs, then AppSpec, then instance configuration, then redeploy.

Answer

Review Agent Logs → Check CodeDeploy Console → Validate AppSpec File → Verify Instance Configuration → Redeploy

Answer

Validate AppSpec File → Check CodeDeploy Console → Review Agent Logs → Verify Instance Configuration → Redeploy

Answer

Redeploy → Check CodeDeploy Console → Review Agent Logs → Validate AppSpec File → Verify Instance Configuration

Question 12

Drag and drop the steps to troubleshoot an AWS CloudTrail that is not logging API calls.

Accepted Answer

Verify CloudTrail is enabled, then Check bucket policy, then Check log file integrity, then Check IAM role, then Test CloudTrail logging. First verify CloudTrail is enabled, then check bucket policy, then check integrity, then check IAM role, then test.

Answer

Check bucket policy, then Check IAM role, then Verify CloudTrail is enabled, then Check log file integrity, then Test CloudTrail logging

Answer

Verify CloudTrail is enabled, then Check log file integrity, then Check bucket policy, then Check IAM role, then Test CloudTrail logging

Answer

Check IAM role, then Verify CloudTrail is enabled, then Check bucket policy, then Check log file integrity, then Test CloudTrail logging

Question 13

A DevOps engineer is designing an infrastructure as code solution for a microservices application that runs on Amazon ECS with Fargate. The application requires a shared Application Load Balancer (ALB) and multiple ECS services. Which CloudFormation resources are required to expose each service behind the ALB? (Choose THREE.)

Accepted Answer

AWS::ElasticLoadBalancingV2::Listener. AWS::ElasticLoadBalancingV2::Listener is correct because it defines the protocol and port (e.g., HTTP:80) on which the ALB accepts traffic. Without a listener, the ALB cannot receive incoming requests. This resource is essential for routing traffic to target groups that are associated with ECS services.

Answer

AWS::ElasticLoadBalancingV2::LoadBalancer

Answer

AWS::AutoScaling::AutoScalingGroup

Question 14

A company is using AWS Elastic Beanstalk with a custom platform. The platform is based on Amazon Linux 2 and includes a pre-installed application. The DevOps team needs to inject environment-specific configuration files into the EC2 instances during deployment. Which approach should be used?

Accepted Answer

Use .ebextensions configuration files in the application source bundle. Option B is correct because .ebextensions configuration files are the native mechanism in Elastic Beanstalk to inject environment-specific configuration into EC2 instances during deployment. These YAML or JSON files, placed in the .ebextensions directory of the application source bundle, are processed by the Elastic Beanstalk platform engine to execute commands, create files, or modify configuration before the application starts, ensuring the custom platform receives the necessary environment-specific settings.

Answer

Use AWS CloudFormation to update the environment with new configuration

Answer

Use EC2 user-data scripts to download configuration from S3

Answer

Store configuration in AWS Systems Manager Parameter Store and retrieve it in the application

Question 15

A company uses AWS CodePipeline with a source stage from Amazon S3 and a deploy stage to AWS Elastic Beanstalk. The pipeline has been working for months, but recently the deploy stage started failing with the error 'The S3 object does not exist.' The source artifact is uploaded to the S3 bucket by an external system. Which TWO actions should be taken to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the external system does not overwrite the object after the pipeline execution starts.. Option A is correct because the deploy stage fails with 'The S3 object does not exist' when the external system overwrites the source artifact after the pipeline execution starts. CodePipeline references the object by its key at the time the pipeline is triggered; if the object is replaced (i.e., deleted and re-uploaded with the same key), the pipeline may attempt to download a version that no longer exists, especially if the S3 bucket is not versioned. Ensuring the external system does not overwrite the object during execution prevents this race condition.

Answer

Change the source stage to use AWS CodeCommit instead of S3.

Answer

Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Answer

Increase the timeout for the deploy stage in the pipeline.

Question 16

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is Blue/Green. During a recent deployment, the new instances passed all health checks, but traffic was not routed to them. What is the most likely reason?

Accepted Answer

The target group associated with the Auto Scaling group is not properly configured to route traffic.. In a Blue/Green deployment with CodeDeploy and an Auto Scaling group, traffic routing is handled by a load balancer target group. If the target group is not properly configured to route traffic to the new instances (e.g., missing or incorrect listener rules, deregistration delay, or health check thresholds), the instances may pass health checks but never receive traffic. This is the most likely cause because the deployment succeeded in provisioning and validating the new instances, but the load balancer did not forward requests to them.

Answer

The deployment group is not configured to use a load balancer.

Answer

The Auto Scaling group's lifecycle hook failed to signal readiness.

Answer

The CodeDeploy agent on the new instances is not installed.

Question 17

A DevOps engineer receives a CloudWatch alarm that an Auto Scaling group has been in an 'Insufficient data' state for 20 minutes. What does this indicate?

Accepted Answer

The alarm has not received enough metric data to evaluate. The 'Insufficient data' state in CloudWatch alarms indicates that the alarm has not received enough metric data points to determine whether the threshold has been breached. This can occur when the metric is not being published, the data collection period is too short, or the metric namespace is misconfigured. It does not directly indicate instance health, scaling needs, or agent installation status.

Answer

All instances in the Auto Scaling group are unhealthy

Answer

The Auto Scaling group needs to scale up

Answer

The CloudWatch agent is not installed on the instances

Question 18

A DevOps engineer needs to restrict access to an S3 bucket so that only users from a specific AWS account can read objects. Which TWO methods can achieve this?

Accepted Answer

Create an IAM role in the source account with read access to the bucket, and allow users in that account to assume the role.. Option A is correct because an IAM role in the source account can be granted read access to the S3 bucket via a bucket policy that allows the role's ARN. Users in the source account assume this role, which temporarily provides them with the necessary permissions to read objects. This cross-account access pattern is secure and follows AWS best practices for delegating access across accounts.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Generate pre-signed URLs for each object and distribute them only to users in the target account.

Answer

Set a bucket ACL that grants read access to the target account's canonical ID.

Question 19

A company uses AWS CloudFormation to deploy infrastructure. A recent stack update failed, and the engineer needs to roll back to the previous stable state. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the 'Rollback' action in the CloudFormation console.. Option C is correct because CloudFormation provides a built-in 'Rollback' action that automatically reverts a stack to its last known stable state when a stack update fails. This rollback occurs by default on failure, but if the engineer needs to manually trigger it after a failed update, they can use the 'Rollback' action in the CloudFormation console or API (e.g., `aws cloudformation rollback-stack`). This ensures the infrastructure returns to the previous working configuration without manual intervention.

Answer

Use AWS CloudFormation Drift Detection.

Answer

Use AWS CloudFormation StackSets.

Answer

Create a Change Set and execute it.

Question 20

A company is using Amazon S3 to store critical data. The company requires that all versions of objects be retained, including deleted objects, to meet compliance requirements. Which S3 feature should be enabled?

Accepted Answer

S3 Versioning. Option A is correct because S3 Versioning keeps all versions of objects, including deleted ones (marked with delete markers). Option B is wrong because MFA Delete adds an extra layer of security but does not retain all versions. Option C is wrong because S3 Object Lock prevents deletion but requires versioning to be enabled; however, versioning itself is the feature that retains all versions. Option D is wrong because lifecycle policies can transition or expire objects, not retain all versions.

Answer

S3 Object Lock

Answer

S3 Lifecycle policies

Answer

MFA Delete