DOP-C02 Practice Test 29 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a slow AWS CodeBuild project. The build is a Java application that compiles source code and runs tests. The build environment uses a general1.large compute type. The build duration has increased from 5 minutes to 15 minutes over the past month. The engineer notices that the build logs show 'Downloading...' messages for Maven dependencies for several minutes. What is the most cost-effective way to reduce the build time?

Accepted Answer

Enable local caching in the CodeBuild project for dependencies. Option C is correct by enabling local caching for Maven dependencies, which eliminates repeated downloads. Option A is incorrect because increasing compute type might not solve the download bottleneck. Option B is incorrect because VPC peering does not affect dependency download speed from public repositories. Option D is incorrect because CodeArtifact would still require downloading from the repository.

Answer

Configure the build to use a VPC with a NAT gateway

Answer

Use AWS CodeArtifact as a proxy for Maven dependencies

Answer

Change the compute type to general1.2xlarge

Question 2

A development team uses AWS CodeCommit and wants to enforce that all commits include a JIRA issue key in the commit message. They want to reject any push that does not contain a valid JIRA key. Which approach should the engineer use?

Accepted Answer

Use a Lambda function triggered by CodeCommit push events that calls codecommit:PutRepositoryTriggers to reject. Option D is correct because CodeCommit can trigger a Lambda function on push events, and the Lambda can validate commit messages and reject the push. Option A is incorrect because pre-commit hooks are client-side and not enforced by AWS. Option B is incorrect because CodeCommit does not support server-side hooks natively. Option C is incorrect because CloudWatch Events can trigger Lambda but not reject pushes directly.

Answer

Create a CloudWatch Events rule that triggers a Lambda function on push

Answer

Use AWS CodeCommit hooks to validate commit messages

Answer

Configure a pre-commit hook in the Git client

Question 3

Refer to the exhibit. A DevOps engineer is troubleshooting a cross-account deployment where an AWS CodeBuild project in Account A needs to upload build artifacts to an S3 bucket in Account B. The engineer attaches this IAM policy to the CodeBuild service role in Account A. However, the upload fails. What is the most likely reason?

Accepted Answer

The condition requires bucket-owner-full-control ACL, but the bucket policy may not allow it. Option C is correct because the policy only allows PutObject with the condition that the ACL is 'bucket-owner-full-control'. If the bucket policy in Account B does not accept objects with that ACL, the upload might fail. Option A is incorrect because the action is PutObject. Option B is incorrect because GetObject is not needed for upload. Option D is incorrect because the bucket policy is not shown.

Answer

The bucket policy in Account B grants s3:PutObject to Account A

Answer

The policy does not include s3:PutObjectAcl permission

Answer

The policy does not include s3:GetObject permission

Question 4

A company uses AWS CloudFormation to manage its infrastructure. The stack creation recently failed because an IAM role resource was created before the AWS Lambda function that depends on it. The template has no DependsOn clauses. What is the most likely reason for this failure and how can it be fixed?

Accepted Answer

Add a DependsOn clause to the Lambda function resource referencing the IAM role. The most likely reason for the failure is that CloudFormation, by default, parallelizes the creation of resources that do not have explicit dependencies. Since the IAM role and Lambda function have no DependsOn clause, CloudFormation may attempt to create the Lambda function before the IAM role is fully created and its permissions are propagated. Adding a DependsOn clause to the Lambda function resource referencing the IAM role ensures that CloudFormation creates the IAM role first, resolving the dependency and preventing the failure.

Answer

Use AWS Systems Manager Automation to create the resources sequentially

Answer

Use a ChangeSet to roll back the stack and modify the template

Answer

Split the template into two separate stacks and use nested stacks

Question 5

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodeBuild and Amazon ECS. Which TWO actions will help reduce the frequency of Docker image pulls from the public Docker Hub registry?

Accepted Answer

Store the base image in Amazon ECR and use it in the build. Options A and B are correct. Option A: Using a VPC with a NAT gateway does not reduce pulls. Option C: CodeArtifact can cache images, reducing pulls from Docker Hub. Option D: CodeBuild local caching can cache layers, reducing pulls. Option E: ECR is a registry, not a cache for Docker Hub.

Answer

Create a Docker Hub access token and store it in AWS Secrets Manager

Answer

Enable CodeBuild local caching for the cache type 'LOCAL_DOCKER_LAYER_CACHE'

Answer

Configure CodeBuild to use a VPC with a NAT gateway

Question 6

A company uses AWS CloudFormation to deploy a multi-tier application. The engineer wants to ensure that the stack is not accidentally deleted and that critical resources like databases are retained even if the stack is deleted. Which THREE steps should the engineer take?

Accepted Answer

Create a StackPolicy that denies updates to the RDS instance. Options A, C, and D are correct. Option A: Enable termination protection to prevent stack deletion. Option C: Set DeletionPolicy to Retain on the RDS instance so it is not deleted. Option D: Use a StackPolicy to protect resources from updates. Option B is incorrect because stack policy does not prevent deletion. Option E is incorrect because nested stacks do not provide protection.

Answer

Use nested stacks to isolate the database

Answer

Use a StackPolicy to deny delete actions

Question 7

A DevOps team uses AWS CodePipeline with an Amazon S3 source action. The pipeline deploys a static website to an S3 bucket. The engineer wants to ensure that only approved changes are deployed to production. The team uses Git feature branches and wants to deploy only when a pull request is merged to the main branch. Which THREE actions should the engineer take?

Accepted Answer

Configure a CloudWatch Events rule to start the pipeline when a CodeCommit pull request is merged. Options A, C, and D are correct. Option A: Use CodeCommit as the source and configure a trigger for pull request merge events. Option C: Add a manual approval stage before deployment. Option D: Use a CloudWatch Events rule to trigger the pipeline on pull request merge. Option B is incorrect because it would deploy from any branch. Option E is incorrect because it does not enforce approval.

Answer

Use an S3 source and configure event notifications for all object uploads

Answer

Set the pipeline to execute on every push to any branch

Question 8

A development team uses AWS CodeCommit as a source repository for their AWS CodePipeline. They want to automatically trigger a pipeline execution when a new branch is created. Which solution should they implement?

Accepted Answer

Use Amazon CloudWatch Events to trigger the pipeline on a CodeCommit 'Reference Created' event.. Option B is correct because CloudWatch Events can trigger on code commit events like branch creation. Option A is wrong because webhooks are for third-party sources. Option C is wrong because polling is inefficient and not best practice. Option D is wrong because S3 events are for S3 source, not CodeCommit.

Answer

Create an S3 event notification to invoke the pipeline when a branch is created.

Answer

Configure a webhook in CodePipeline to detect branch creation events.

Answer

Set up a polling mechanism in CodePipeline to check for new branches every minute.

Question 9

Which THREE AWS services can be used as a source action in AWS CodePipeline? (Choose three.)

Accepted Answer

Amazon S3. Options A, B, and D are correct. Option C is wrong because DynamoDB is not a source. Option E is wrong because CloudFormation is not a source.

Answer

Amazon DynamoDB

Answer

AWS CloudFormation

Question 10

A team uses AWS CodeBuild to run unit tests. They notice that builds are taking longer than expected. The build environment includes many dependencies that are downloaded every time. Which change would MOST reduce build time?

Accepted Answer

Store dependencies in an Amazon S3 bucket and configure CodeBuild to use S3 cache.. Option D is correct because dependency caching avoids re-downloading. Option A is wrong because more CPU may not help if network is bottleneck. Option B is wrong because EFS is not supported. Option C is wrong because local cache is limited.

Answer

Enable local caching for dependencies.

Answer

Increase the compute type to a larger instance.

Answer

Use Amazon EFS to share dependencies across builds.

Question 11

Refer to the exhibit. A DevOps engineer runs the above commands. The build project 'my-project' uses an S3 bucket as source and another S3 bucket for artifacts. The build fails with an 'Access Denied' error when trying to download the source code. What is the most likely cause?

Accepted Answer

The service role does not have s3:GetObject permission on the source bucket. Option B is correct because the service role must have s3:GetObject permission on the source bucket. Option A is incorrect because the source type is S3, not CodeCommit. Option C is incorrect because the encryption key is the default S3 key, not a custom KMS key. Option D is incorrect because the source bucket is specified.

Answer

The encryption key is a KMS key that the role cannot access

Answer

The source type is S3, but the project expects CodeCommit

Answer

The source location is incorrect

Question 12

An organization uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests that take 30 minutes. The team wants to speed up feedback without skipping tests. Which action should they take?

Accepted Answer

Configure parallel build actions in the Test stage to run tests concurrently.. Option A is correct because parallel actions reduce total time. Option B is wrong because it skips tests. Option C is wrong because increasing instance size may not help if tests are I/O bound. Option D is wrong because it does not speed tests.

Answer

Use a larger build environment for the Test stage.

Answer

Remove the Test stage and rely on post-deployment testing.

Answer

Move the Test stage to after deployment.

Question 13

Refer to the exhibit. A DevOps engineer deploys this CloudFormation template. The EC2 instance launches, but the httpd service does not start. The engineer connects to the instance and finds that the user data script did not run. What is the most likely cause?

Accepted Answer

The AMI does not have yum installed. Option D is correct because the default AMI for t2.micro may be Amazon Linux 2, which uses 'dnf' or 'amazon-linux-extras' instead of 'yum'. Option A is incorrect because the syntax looks correct. Option B is incorrect because SystemD is used. Option C is incorrect because tags do not affect user data execution.

Answer

The UserData is not base64 encoded correctly

Answer

The tags prevent user data from executing

Answer

The AMI uses a different init system than systemd

Question 14

A company uses AWS CodeCommit as a source repository and AWS CodeBuild for building artifacts. The DevOps team wants to ensure that all commits to the main branch trigger a build. Which steps should be taken? (Choose THREE.)

Accepted Answer

Configure the CodeBuild project to use the CodeCommit repository as the source and specify the main branch. Option A is correct because configuring the CodeBuild project to use the CodeCommit repository as the source and specifying the main branch ensures that CodeBuild knows which repository and branch to monitor for changes. This is the foundational step that links the source code to the build project, enabling automated builds when commits are pushed to the main branch.

Answer

Configure a webhook in the CodeCommit repository to notify CodeBuild

Answer

Use AWS CodeDeploy to trigger the build on commits

Question 15

A company uses AWS CodeDeploy with a blue/green deployment configuration. After a deployment, the new instances are not registered with the load balancer, causing downtime. What is the MOST likely cause?

Accepted Answer

The CodeDeploy deployment group does not have a load balancer configured or the deregistration delay is too long.. Option C is correct because without a health check, CodeDeploy doesn't know when to register. Option A is wrong because ELB health checks are separate. Option B is wrong because original instances are deregistered after. Option D is wrong because CodeDeploy does registration.

Answer

The IAM role for CodeDeploy does not have permission to register instances with the load balancer.

Answer

The original instances are still registered with the load balancer.

Answer

The load balancer health check is misconfigured.