DOP-C02 Practice Test 29 — 15 Questions

Question 1

A team uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that creates an S3 bucket and a DynamoDB table. The S3 bucket name must be unique across all AWS accounts. Which CloudFormation intrinsic function should be used to generate a unique bucket name?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

!Sub 'mybucket-${AWS::AccountId}'. The `!Sub 'mybucket-${AWS::AccountId}'` intrinsic function substitutes the AWS::AccountId pseudo parameter, which is guaranteed to be unique per AWS account. Since S3 bucket names must be globally unique across all AWS accounts, appending the account ID ensures the generated name does not conflict with buckets in other accounts. This approach is a common pattern for creating unique resource names in CloudFormation.

Answer

!Ref 'AWS::StackName'

Answer

!GetAtt S3Bucket.Arn

Answer

!Select [0, !Split ['-', !Ref 'AWS::Region']]

Question 2

A company uses AWS OpsWorks for configuration management. The DevOps team wants to automate the patching of operating system updates on a set of EC2 instances managed by OpsWorks. Which OpsWorks feature should be used?

Accepted Answer

Weekly Auto Update. AWS OpsWorks Stacks provides a built-in 'Weekly Auto Update' feature that automatically installs operating system updates on managed EC2 instances. This feature is specifically designed to automate OS patching without requiring custom recipes or manual intervention, making it the correct choice for the DevOps team's requirement.

Answer

Auto Scaling

Answer

Chef Automate

Answer

Lifecycle events (Setup, Configure, Deploy, etc.)

Question 3

An organization has a compliance requirement to automatically detect and alert on any IAM user creation in all AWS accounts. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail captures all IAM user creation events as `CreateUser` API calls. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a rule that matches this specific event pattern and triggers an alert via Amazon SNS. This combination provides real-time detection and notification without custom code.

Answer

Amazon GuardDuty and Amazon SNS

Answer

Amazon S3 server access logs and Amazon Athena

Answer

AWS Config and AWS Lambda

Question 4

A company is using AWS CodeBuild to run builds for a Java application. The build takes a long time because it downloads Maven dependencies every time. The team wants to speed up the build by caching dependencies. Which TWO actions should be taken? (Choose 2)

Accepted Answer

Enable Amazon S3 caching in the CodeBuild project and specify an S3 bucket to store the cache.. CodeBuild supports Amazon S3 caching, which allows you to store build artifacts (such as Maven dependencies) in a specified S3 bucket. By enabling this feature, subsequent builds can download the cached dependencies from S3 instead of re-downloading them from the internet, significantly reducing build time. Option E is correct because the buildspec file must explicitly define the cache path (e.g., /root/.m2) to tell CodeBuild which directory to cache; without this, CodeBuild does not know what to save or restore.

Answer

Use CodeBuild's 'build cache' feature without specifying a bucket; it will automatically cache to a default location.

Answer

Set the cache type to 'Local' in the CodeBuild project configuration.

Answer

Mount an Amazon EFS file system to the build container and configure Maven to use it as a local repository.

Question 5

An IAM policy is attached to a user who needs to create a CloudFormation stack that provisions an EC2 instance and an S3 bucket. The user receives an 'Access Denied' error when running the 'aws cloudformation create-stack' command. Which additional permission is required?

Accepted Answer

ec2:RunInstances and s3:CreateBucket. To successfully create a CloudFormation stack that provisions an EC2 instance and an S3 bucket, the IAM user must have permissions for the actions that CloudFormation will perform on their behalf. Specifically, ec2:RunInstances and s3:CreateBucket are required in addition to cloudformation:CreateStack. The 'Access Denied' error occurs because the user lacks these resource-level permissions. Notably, the DeletionPolicy attribute (e.g., Retain) only controls behavior when resources are deleted, not during stack creation or updates; it does not affect the permissions required for provisioning.

Answer

s3:PutObject

Answer

cloudformation:DescribeStacks

Answer

iam:PassRole

Question 6

A company uses AWS CloudTrail to log API calls in a multi-account environment. The security team wants to be alerted immediately when an IAM user or role performs a specific sensitive action (e.g., DeleteTrail, DeleteDBInstance). Which TWO services can be used together to achieve near real-time alerting? (Choose TWO.)

Accepted Answer

CloudWatch Logs metric filters and alarms. CloudTrail logs can be delivered to CloudWatch Logs, where metric filters can be created to match specific API actions (e.g., DeleteTrail, DeleteDBInstance) and trigger CloudWatch alarms for near real-time notification. Option B is correct because CloudTrail integration with CloudWatch Logs is the prerequisite step that enables the log delivery required for metric filters and alarms. Option C is incorrect: CloudTrail with Amazon S3 event notifications is not near real-time; S3 event notifications can have delays and are not designed for immediate alerting on specific API calls. Option D is incorrect: Amazon Athena is an interactive query service for ad-hoc analysis, not for real-time alerting. Option E is incorrect: AWS Config is used for resource configuration compliance and change tracking, not for real-time alerting on API calls.

Answer

CloudTrail with Amazon S3 event notifications

Answer

Amazon Athena and CloudWatch dashboards

Answer

AWS Config and AWS Lambda

Question 7

An application running on Amazon ECS with Fargate experiences intermittent failures. The task definition includes a single container with a health check command. Despite the health check passing, the application occasionally returns HTTP 500 errors. The application logs are sent to CloudWatch Logs. What is the MOST likely root cause?

Accepted Answer

The health check command only checks the process status, not the application's ability to serve requests.. A health check command in an ECS task definition typically checks the container process status (e.g., via a shell command or a simple TCP check), not the application's HTTP layer. If the health check passes but the application returns HTTP 500 errors, it indicates the container is running but the application logic is failing (e.g., unhandled exceptions, database connection issues). This mismatch between process-level health and application-level health is a common cause of intermittent failures in containerized applications.

Answer

The application is missing environment variables that are required for certain requests.

Answer

The ECS service is configured with a target tracking scaling policy that reacts too slowly.

Answer

The container port and host port in the task definition do not match the ALB target group port.

Question 8

A company is designing a disaster recovery strategy for a critical application that requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 hour. The application runs on EC2 with data stored in Amazon RDS Multi-AZ. Which approach meets these requirements?

Accepted Answer

Use a pilot light strategy with RDS cross-Region read replicas and automated backups. A pilot light strategy with RDS cross-Region read replicas and automated backups meets the RTO of 15 minutes and RPO of 1 hour. The cross-Region read replica provides near-synchronous replication with an RPO typically under 5 seconds, and automated backups enable point-in-time recovery within the 1-hour RPO. The pilot light approach allows rapid promotion of the replica to a primary instance, achieving the 15-minute RTO by keeping minimal core services running in the DR Region.

Answer

Use backup and restore with daily snapshots to another Region

Answer

Use a warm standby with a scaled-down production environment in another Region

Answer

Use a Multi-AZ deployment in the same Region for DR

Question 9

A company uses AWS CloudFormation with a template that creates an Amazon RDS DB instance. The password for the master user is stored in AWS Secrets Manager. The CloudFormation stack creation fails with the error: 'Value of property MasterUserPassword must be of type String'. How should the DevOps engineer resolve this issue?

Accepted Answer

Use the dynamic reference '{{resolve:secretsmanager:MySecret:SecretString:password}}' in the CloudFormation template.. CloudFormation supports dynamic references, which allow you to retrieve secret values from AWS Secrets Manager at stack creation time using the syntax `{{resolve:secretsmanager:secret-id:secret-string:json-key}}`. This resolves the password as a plaintext string directly in the template, satisfying the `MasterUserPassword` property's requirement for a String type. Other intrinsic functions like `Ref` or `Fn::GetAtt` return ARNs or metadata, not the secret value itself, and cannot be used directly for this purpose.

Answer

Use the Fn::ImportValue intrinsic function to import the secret value.

Answer

Use the Ref intrinsic function to reference the secret.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the secret value from Secrets Manager.

Question 10

A company uses AWS CloudFormation to manage infrastructure. They have a template that creates an Amazon RDS DB instance. The template includes a 'DeletionPolicy' attribute set to 'Retain' on the DB instance resource. The DevOps team deletes the stack. Later, they notice that the DB instance still exists and is incurring costs. What is the MOST cost-effective way to remove the DB instance?

Accepted Answer

Manually delete the DB instance using the AWS Management Console or AWS CLI.. The DB instance was created with a DeletionPolicy of 'Retain', which explicitly instructs CloudFormation to preserve the resource when the stack is deleted. Once the stack is deleted, CloudFormation no longer manages the DB instance, so the only way to remove it and stop costs is to manually delete it via the AWS Management Console or AWS CLI. This is the most cost-effective approach as it directly addresses the orphaned resource without unnecessary overhead.

Answer

Create a new CloudFormation stack that includes the same DB instance but with a DeletionPolicy of 'Delete', then delete that stack.

Answer

Use the 'aws cloudformation delete-change-set' command to remove the resource.

Answer

Update the stack: change the DeletionPolicy to 'Delete' and then delete the stack again.

Question 11

A team uses CloudFormation to deploy a multi-container Docker environment on Amazon ECS. They need to pass environment variables to the containers from Parameter Store. How should they reference these values in the CloudFormation template?

Accepted Answer

Using the 'resolve:ssm' dynamic reference. CloudFormation supports dynamic references using the 'resolve:ssm' prefix to retrieve values from AWS Systems Manager Parameter Store at stack creation or update time. This allows environment variables in an ECS task definition to be populated directly from Parameter Store without hardcoding secrets or using custom Lambda-backed custom resources.

Answer

Using the 'Ref' function with the parameter name

Answer

Using the 'Fn::ParamStore' intrinsic function

Answer

Using 'Fn::GetAtt' on the Parameter Store resource

Question 12

A DevOps team is troubleshooting a CloudFormation stack creation failure. The error message states: 'CREATE_FAILED: Resource handler returned message: "You have attempted to create more resources than the current AWS account limit"'. Which step should the team take to resolve this issue?

Accepted Answer

Check the current service limits for the resource type and request a limit increase from AWS Support.. The error message explicitly indicates that the CloudFormation stack creation failed because the AWS account has reached a service limit for a specific resource type. Option D is correct because the team must first identify which resource type exceeded its limit (e.g., EC2 instances, VPCs, or IAM roles) by checking the AWS Service Quotas console or using the Trusted Advisor dashboard, then request a limit increase from AWS Support. Simply retrying the stack creation or modifying IAM permissions will not resolve a hard service quota violation.

Answer

Delete the failed stack and recreate it with the same template.

Answer

Review the IAM permissions for the CloudFormation service role.

Answer

Modify the CloudFormation template to use a different resource type.

Question 13

A DevOps engineer runs the command shown in the exhibit. The output shows the stack status as ROLLBACK_COMPLETE. Which statement best describes the current state of the stack?

Accepted Answer

The stack creation failed and has been rolled back. No resources remain.. The ROLLBACK_COMPLETE status in AWS CloudFormation indicates that a stack creation or update operation failed and the stack has been fully rolled back. When a stack creation fails and rolls back, CloudFormation deletes all resources that were created during the failed creation attempt, leaving no resources remaining. This is the correct interpretation for a stack that was being created (not updated) and ended in ROLLBACK_COMPLETE.

Answer

The stack was created successfully and is in a steady state.

Answer

The stack update failed and has been rolled back to the previous state.

Answer

The stack is currently in the process of rolling back after a failed creation.

Question 14

A company uses AWS CloudFormation StackSets to deploy a common security baseline across multiple AWS accounts. They have a new account that needs to be added to the StackSet. The StackSet is configured with self-service permissions and uses a service-managed IAM role. What must be done to include the new account?

Accepted Answer

Add the new account to the AWS Organization.. When a StackSet uses service-managed permissions, it relies on AWS Organizations to manage accounts. To include a new account, you must add it to the AWS Organization; the StackSet will automatically deploy stack instances to that account based on the specified organizational units (OUs) or accounts. This is because service-managed permissions use a service-linked role created and managed by CloudFormation, not a manually created IAM role in the target account.

Answer

Create an IAM role in the new account that trusts the StackSet.

Answer

Create a new StackSet that includes the new account.

Answer

Manually create a stack instance for the new account in the StackSet.

Question 15

A company runs a static website on Amazon S3 with public read access. The website content is stored in an S3 bucket and served through an Amazon CloudFront distribution for better performance and security. Recently, the company noticed that some users are accessing the S3 bucket directly via the S3 endpoint, bypassing CloudFront. This increases costs and exposes the bucket to potential attacks. The company wants to ensure that all access to the website goes through CloudFront only. Which solution should the company implement?

Accepted Answer

Create an origin access identity (OAI) in CloudFront and update the S3 bucket policy to allow only the OAI to read objects.. To restrict access to the S3 bucket only through CloudFront, use an origin access identity (OAI) and a bucket policy that allows only the OAI. This way, direct access via S3 URL is denied.

Answer

Set the S3 bucket policy to deny all requests that do not come from the CloudFront distribution's IP addresses.

Answer

Configure the S3 bucket to use AWS WAF to block requests that do not have a custom header set by CloudFront.

Answer

Change the S3 bucket to be private and use presigned URLs for all requests.