DOP-C02 Practice Test 26 — 15 Questions

Question 1

A DevOps team observes that an Amazon CloudFront distribution is returning HTTP 504 errors for a small percentage of requests. The origin is an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The team has already checked the ALB's access logs and found that the ALB returns 200 OK for all requests. What should the team investigate NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the ALB's idle timeout settings and compare with CloudFront origin timeout.. The ALB returns 200 OK for all requests, so the origin itself is not failing. However, HTTP 504 errors from CloudFront typically indicate that the origin (ALB) is not responding within CloudFront's timeout window. The ALB's idle timeout (default 60 seconds) can cause the ALB to close idle connections, while CloudFront's origin timeout (default 30 seconds) is separate. If the ALB's idle timeout is shorter than the time CloudFront waits for a response, the ALB may close the connection before CloudFront receives the full response, leading to a 504. Option D directly addresses this mismatch.

Answer

Check the ALB target group health check settings and ensure instances are healthy.

Answer

Examine the request headers in CloudFront logs to identify unusual patterns.

Answer

Review the CloudFront cache hit ratio and optimize caching strategies.

Question 2

A team is using AWS CodeDeploy to deploy an application to EC2 instances. They want to ensure that if a deployment fails, the instances are automatically rolled back to the previous version. What should they configure?

Accepted Answer

Enable automatic rollback in the deployment group settings.. CodeDeploy supports automatic rollback configuration. When enabled, if a deployment fails, CodeDeploy automatically redeploys the last successful revision. Option A is wrong because a hook is a lifecycle event, not a rollback mechanism. Option B is wrong because a deployment group contains instances but does not have a rollback setting. Option C is wrong because a deployment configuration specifies traffic routing and failure thresholds, not automatic rollback.

Answer

Add a BeforeBlockTraffic hook to the AppSpec file to run a rollback script.

Answer

Set the deployment configuration to 'CodeDeployDefault.OneAtATime' for a gradual deployment.

Answer

Configure the deployment group to use the same Auto Scaling group for rollback.

Question 3

A company runs a critical application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) in front. During a load test, the team notices a sudden increase in 5xx errors from the ALB, and some tasks become unhealthy. The task logs show occasional 'OutOfMemoryError' exceptions. The task definition currently has 512 CPU units and 1024 MiB memory. What should the team do to mitigate the issue while maintaining a cost-effective approach?

Accepted Answer

Increase the task definition memory to 2048 MiB while keeping CPU at 512 units.. The application is experiencing OutOfMemoryError, indicating the current 1024 MiB memory allocation is insufficient. Increasing memory to 2048 MiB while keeping CPU at 512 units directly resolves the memory constraint without unnecessary CPU cost. ECS Fargate allows independent scaling of CPU and memory within valid combinations, and this change maintains a cost-effective approach by only increasing the resource that is actually constrained.

Answer

Increase the task definition CPU to 1024 units and memory to 2048 MiB.

Answer

Configure the ECS service to use a rolling update with a longer health check grace period.

Answer

Decrease the task definition memory to 512 MiB to force garbage collection more frequently.

Question 4

Refer to the exhibit. The DevOps engineer runs the commands and sees the output. What is the most likely issue with the instance?

Accepted Answer

The underlying hardware is having issues (system status check failed).. The SystemStatus is 'impaired', indicating a problem with the underlying physical host (system status check failed). The InstanceStatus is 'ok', so the OS is functioning normally. Option B is incorrect because the system status check shows impairment, so there is an issue. Option C is incorrect because the instance is running, not stopped. Option D is incorrect because the impairment is at the system level, not the OS level.

Answer

The instance is healthy and no issues exist.

Answer

The instance is stopped.

Answer

The instance has a failed status check due to OS-level issues.

Question 5

A DevOps engineer is designing a configuration management solution for a fleet of EC2 instances. The instances are ephemeral and frequently replaced by an Auto Scaling group. The engineer needs to ensure that newly launched instances are automatically configured with the latest software packages and settings. Which AWS service should be used?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the correct choice because it provides a configuration management solution that ensures EC2 instances maintain a desired state. It uses associations to define the software packages, settings, and policies that should be applied to instances, and it automatically applies these configurations to newly launched instances, including those in an Auto Scaling group, without requiring custom scripts or manual intervention.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks Stacks

Answer

AWS CloudFormation

Question 6

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are deployed in multiple AWS regions. The team wants to aggregate the canary results into a single dashboard in the US East (N. Virginia) region. What is the MOST efficient way to achieve this?

Accepted Answer

Create a cross-region CloudWatch dashboard and add metrics from each region using metric math.. CloudWatch cross-region dashboards allow you to aggregate metrics from multiple regions into a single dashboard without data movement. By using metric math, you can reference metric IDs from different regions directly in the dashboard widget, enabling real-time aggregation of Synthetics canary success/failure rates and latency metrics from all regions into a unified view in US East (N. Virginia). This approach avoids unnecessary data replication, reduces latency, and minimizes operational overhead.

Answer

Replicate the canaries to US East (N. Virginia) and run them from there.

Answer

Set up a Lambda function in each region to push canary results to a central S3 bucket, then create a dashboard from S3.

Answer

Create a CloudWatch Logs Insights query across all regions and visualize results.

Question 7

An organization uses AWS Systems Manager Incident Manager for incident response. They have created a response plan with an engagement plan that pages the on-call engineer via SMS. The engineer acknowledges the incident but then does not take any further action. What is the BEST way to automate escalation?

Accepted Answer

Configure an escalation plan in the response plan that pages a secondary contact after a specified timeout.. Systems Manager Incident Manager supports escalation plans with timeouts and multiple engagement levels. Option A is wrong because manual re-paging does not provide automated escalation and requires human intervention. Option B is wrong because CloudWatch Events can trigger actions but is not the built-in escalation mechanism within Incident Manager; that capability is provided by escalation plans. Option C is wrong because while a Lambda function could be used, it is not the best or simplest approach; Incident Manager natively supports escalation plans.

Answer

Manually re-page the on-call engineer with a higher urgency.

Answer

Use Amazon CloudWatch Events to trigger a second SMS if the incident is not resolved within a time frame.

Answer

Create an AWS Lambda function that checks the incident status and pages the next responder if no action is taken.

Question 8

A DevOps engineer is configuring AWS Config rules to detect non-compliant security groups. The rule should trigger if any security group allows inbound SSH (port 22) from 0.0.0.0/0. Which AWS managed Config rule should be used?

Accepted Answer

restricted-ssh. 'restricted-ssh' is the managed rule that checks for SSH access from 0.0.0.0/0. Option A is wrong because 'vpc-sg-open-only-to-authorized-ports' is not specific to SSH. Option B is wrong because 'ec2-security-group-attached-to-eni' checks attachment, not rules. Option D is wrong because 'incoming-ssh-disabled' is not a managed rule.

Answer

vpc-sg-open-only-to-authorized-ports

Answer

ec2-security-group-attached-to-eni

Answer

incoming-ssh-disabled

Question 9

A company is using AWS Elastic Beanstalk for a production environment. They have observed that during deployments, the environment's health status intermittently becomes 'Severe' even though the application is functioning correctly. The deployment uses rolling updates with a batch size of 50%. Which TWO configuration changes would improve deployment stability without completely redesigning the deployment process? (Select TWO.)

Accepted Answer

Increase the health check interval to allow more time for the application to stabilize.. Increasing the health check interval gives the application more time to stabilize after an update, reducing false 'Severe' health statuses. Option E is correct because decreasing the batch size to 25% reduces the number of instances updated at once, limiting the blast radius of any issues. Option A (switching to immutable updates) changes the deployment strategy, which may not be desired. Option C (increasing batch size to 75%) increases the number of instances updated simultaneously, worsening stability. Option D (decreasing deployment cooldown time) would shorten the wait between batches, not allowing enough time for the application to stabilize, potentially increasing instability.

Answer

Switch from rolling to immutable updates.

Answer

Increase the batch size to 75%.

Answer

Decrease the deployment cooldown time.

Question 10

A DevOps engineer is troubleshooting a failed build in AWS CodeBuild. The build log shows: 'Error: Cannot find module 'lodash'.' The buildspec.yml file lists 'npm install' as a command. What is the most likely cause?

Accepted Answer

The package.json file is missing or does not include lodash.. The error 'Cannot find module 'lodash'' indicates that the lodash package is not installed. Since the buildspec includes 'npm install', the most likely cause is that the package.json file is missing or does not list lodash as a dependency. Without package.json or with incorrect dependencies, npm install will not install lodash, leading to the error.

Answer

The npm install command is running before the source is downloaded.

Answer

The lodash package is not compatible with the Node.js version.

Answer

The build environment does not have internet access to download packages.

Question 11

A company requires that all secrets (e.g., database passwords) used by Lambda functions be rotated automatically every 30 days. Which combination of services should be used?

Accepted Answer

AWS Secrets Manager and AWS Lambda. AWS Secrets Manager is the correct choice because it natively supports automatic secret rotation on a configurable schedule (e.g., every 30 days) using a Lambda function as the rotation handler. Secrets Manager directly integrates with Lambda to invoke the rotation logic, updating the secret value and propagating the change to the target database or service without custom infrastructure. CloudHSM, Parameter Store, and KMS do not provide built-in, scheduled rotation of secrets with automatic Lambda invocation.

Answer

AWS CloudHSM and AWS Lambda

Answer

AWS Systems Manager Parameter Store and AWS Lambda

Answer

AWS KMS and AWS Lambda

Question 12

A development team uses AWS CodeStar to set up a continuous delivery pipeline for a web application. The application is deployed to an Elastic Beanstalk environment. After a successful deployment, the team wants to automatically run integration tests against the deployed application. What is the SIMPLEST way to achieve this?

Accepted Answer

Add a test stage in CodePipeline after the deploy stage that uses CodeBuild to run integration tests.. CodePipeline natively supports a test stage after the deploy stage, and using CodeBuild to run integration tests is the simplest and most integrated approach. This keeps the entire CI/CD workflow within CodePipeline without requiring external triggers, custom scripts, or platform hooks. CodeBuild can be configured to run tests against the deployed Elastic Beanstalk environment URL, and the pipeline will only proceed if the tests pass.

Answer

Configure the Elastic Beanstalk environment to run integration tests after deployment via a custom platform hook.

Answer

Use Amazon CloudWatch alarms to trigger a Lambda function that runs the tests.

Answer

Add a post-deployment script in the CodeDeploy appspec file to run tests.

Question 13

A DevOps team is using AWS CodeBuild to run unit tests and package a Java application. They want to cache the Maven local repository (~/.m2) between builds to improve build times. Which TWO steps are necessary to enable caching in CodeBuild? (Select TWO.)

Accepted Answer

Add a 'cache' section in the buildspec file specifying the paths to cache.. To enable caching for the Maven local repository in AWS CodeBuild, two steps are required: (1) Add a `cache` section in the buildspec file specifying the paths to cache (e.g., ~/.m2) — this is option D. (2) Create an S3 bucket to store the cache and configure the CodeBuild project to use that bucket for caching — this is option E. Option A (setting MAVEN_OPTS) is not necessary because the default Maven repository path is already ~/.m2. Option B (uploading as a build artifact) is for saving output artifacts, not for caching. Option C ('Local cache' mode) is a different feature used for Docker layer caching, not for Maven dependencies. Therefore, options D and E are correct.

Answer

Set the MAVEN_OPTS environment variable to use a custom repository path.

Answer

Configure the buildspec to upload the Maven repository as a build artifact.

Answer

Enable 'Local cache' mode in the CodeBuild project.

Question 14

A company runs a critical web application on EC2 instances in an Auto Scaling group. The application uses an Application Load Balancer (ALB) with health checks pointing to /health. Recently, the application experienced intermittent failures where the ALB would mark instances as unhealthy and route traffic away, causing a reduction in capacity. The development team noticed that the /health endpoint occasionally returns HTTP 503 when the application is under heavy load, but the application can recover quickly. The team wants to avoid unnecessary instance replacements while ensuring availability. Which solution should the DevOps engineer implement?

Accepted Answer

Increase the health check interval and increase the unhealthy threshold. Increasing the health check interval and increasing the unhealthy threshold makes the health check less sensitive to transient errors, such as occasional 503 responses under heavy load. This prevents unnecessary instance replacements while maintaining availability. Option A is incorrect because implementing a custom Lambda health check that ignores 503 responses would not leverage the built-in ALB health check tuning and adds complexity. Option B is incorrect because decreasing the unhealthy threshold would make instances more easily marked unhealthy, worsening the problem. Option D is incorrect because decreasing the health check interval increases the frequency of checks, which might cause more frequent detections of transient errors, and decreasing the healthy threshold does not address the issue of avoiding unnecessary replacements.

Answer

Implement a custom health check using Lambda that ignores 503 responses

Answer

Decrease the unhealthy threshold to mark instances unhealthy faster

Answer

Decrease the health check interval and decrease the healthy threshold

Question 15

A DevOps engineer is configuring a webhook trigger in AWS CodePipeline to automatically start a pipeline when changes are pushed to a specific branch in a CodeCommit repository. The webhook is created and the trigger is set to the 'main' branch. However, when a developer pushes a commit to the 'main' branch, the pipeline does not start. What is the MOST likely reason?

Accepted Answer

The CloudWatch Events rule that triggers the pipeline on repository changes is not configured.. AWS CodePipeline uses Amazon CloudWatch Events (now Amazon EventBridge) to detect repository changes and trigger pipeline executions. When a webhook is created in CodePipeline, it automatically sets up a CloudWatch Events rule that listens for CodeCommit repository state changes (e.g., push to a branch). If this rule is missing, misconfigured, or deleted, the pipeline will not start despite the webhook being present. The webhook itself only registers the endpoint; the actual event routing depends on the CloudWatch Events rule.

Answer

The webhook is not properly registered with CodeCommit due to a conflict with an existing webhook.

Answer

The CodeCommit repository is set to send events to Amazon S3, which conflicts with the webhook.

Answer

The pipeline requires an Amazon SNS notification to be configured for the trigger to work.