DOP-C02 Practice Test 30 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team notices that stack updates sometimes fail because of resource conflicts. The team wants to prevent concurrent updates to the same stack. What should they do?

Accepted Answer

No action needed; CloudFormation already prevents concurrent stack updates. AWS CloudFormation inherently prevents concurrent updates to the same stack. When an update operation is initiated, CloudFormation places a lock on the stack, rejecting any subsequent update requests until the current operation completes. This behavior is built into the service and requires no additional configuration, making option C correct.

Answer

Use an AWS Organizations service control policy to restrict updates

Answer

Create an IAM policy that denies cloudformation:UpdateStack if a stack update is in progress

Answer

Enable CloudTrail to log all stack update attempts and manually review

Question 2

A company has a monorepo in AWS CodeCommit with multiple microservices. They want to use AWS CodePipeline to build and deploy only the microservice that changed. What is the MOST efficient approach?

Accepted Answer

Use an AWS Lambda function triggered by CloudWatch Events for CodeCommit to start the specific pipeline for the changed microservice.. Option C is correct because Lambda can parse the commit and trigger the appropriate pipeline. Option A is wrong because it builds everything. Option B is wrong because it requires multiple repos. Option D is wrong because it still builds all.

Answer

Configure a single pipeline that always builds all microservices.

Answer

Create separate CodeCommit repositories for each microservice.

Answer

Use a single pipeline with multiple build actions that each check if their microservice changed.

Question 3

A company uses AWS KMS to encrypt data in S3. They want to audit who used which KMS key and when. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all AWS KMS API calls, including the key ID, the principal who made the request, the time of the request, and the source IP address. These logs are delivered to an S3 bucket and can be queried using CloudTrail Insights or Athena to audit KMS key usage for S3 decryption events.

Answer

Amazon CloudWatch

Answer

Amazon GuardDuty

Answer

AWS Config

Question 4

A company uses AWS CodePipeline with an Amazon S3 source, AWS CodeBuild, and AWS CodeDeploy. The deployment stage fails intermittently with the error 'Deployment failed because the deployment group does not exist'. The pipeline has been working for months. What is the MOST likely cause?

Accepted Answer

The pipeline's cross-region action configuration references the deployment group in a different region without specifying the region.. Option D is correct because the deployment group ARN is passed as a parameter; if the region is not specified, the default region may differ from the pipeline's region. Option A is wrong because IAM permissions are not tied to region. Option B is wrong because the deployment group name is not case-sensitive. Option C is wrong because the pipeline is not being recreated, only the deployment group reference changes.

Answer

The deployment group name contains a typo in the pipeline definition.

Answer

The IAM role for CodePipeline does not have sufficient permissions in all regions.

Answer

The pipeline was recreated without specifying the deployment group.

Question 5

A company experiences intermittent high latency for a web application running on EC2 behind an ALB. They want to monitor and automatically replace instances that have high CPU. Which solution meets this requirement?

Accepted Answer

Create a CloudWatch alarm on CPU utilization that triggers an Auto Scaling policy to replace the instance. Option A is correct because you can configure a CloudWatch alarm on the EC2 instance's CPU utilization metric, and then use that alarm to trigger an Auto Scaling lifecycle hook or a scaling policy that terminates the unhealthy instance and launches a replacement. This directly ties performance monitoring to automated instance replacement, meeting the requirement to replace instances with high CPU.

Answer

Use Auto Scaling scheduled scaling actions to replace instances at peak times

Answer

Use AWS Lambda to periodically check CPU and terminate high-CPU instances

Answer

Configure the ALB health check to mark instances unhealthy when CPU is high

Question 6

A DevOps engineer needs to automate the creation of a CI/CD pipeline using infrastructure as code. Which AWS service is BEST suited to define and provision the pipeline resources?

Accepted Answer

AWS CloudFormation. Option B is correct because CloudFormation is IaC. Option A is wrong because CodePipeline is the pipeline itself, not IaC. Option C is wrong because EB is PaaS. Option D is wrong because Service Catalog is for product portfolios.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS Service Catalog

Question 7

A DevOps engineer is troubleshooting a CloudFormation stack that failed to update. The error message indicates a circular dependency among resources. The template includes an Auto Scaling group, a launch template, and an IAM instance profile. The launch template references the IAM instance profile, and the Auto Scaling group references the launch template. The IAM instance profile's role references the Auto Scaling group name in its trust policy. How can the engineer resolve the circular dependency?

Accepted Answer

Pass the Auto Scaling group name as a parameter to the IAM role's trust policy, and create the Auto Scaling group with a condition that depends on the role. Option B resolves the circular dependency by decoupling the Auto Scaling group name from the IAM role's trust policy at template creation time. By passing the group name as a parameter and using a condition to create the Auto Scaling group only after the role exists, CloudFormation can determine the correct creation order without a circular reference. This approach allows the trust policy to reference a value that is not yet known at template parsing, breaking the dependency cycle.

Answer

Use DependsOn clauses to explicitly order the resource creation

Answer

Place the launch template and Auto Scaling group in a nested stack

Answer

Hardcode the Auto Scaling group name in the IAM role's trust policy

Question 8

A company is migrating to AWS and needs to comply with PCI DSS. They must encrypt all data at rest and in transit. Which THREE services or features should they use?

Accepted Answer

Elastic Load Balancing (ELB) with TLS termination.. Option A is correct because Elastic Load Balancing (ELB) with TLS termination ensures encryption of data in transit between clients and the load balancer, which is a PCI DSS requirement for protecting cardholder data over public networks. By terminating TLS at the ELB, you can offload the cryptographic overhead while maintaining compliance with the encryption-in-transit mandate.

Answer

AWS CloudTrail to log all API calls.

Answer

AWS WAF to protect web applications.

Question 9

A DevOps engineer needs to securely store database credentials for an application running on EC2. The credentials must be rotated automatically every 30 days. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with the RDS rotation Lambda blueprint.. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It provides a built-in RDS rotation Lambda blueprint that can be configured to rotate credentials every 30 days without custom code. This fully managed rotation capability meets the requirement for automatic, scheduled rotation with minimal operational overhead.

Answer

Store credentials in AWS Systems Manager Parameter Store and use a Lambda function to rotate them.

Answer

Store credentials in an S3 bucket encrypted with KMS and use S3 Lifecycle policies to rotate the objects.

Answer

Use IAM roles to grant the EC2 instance access to the database, eliminating the need for credentials.

Question 10

A DevOps engineer needs to receive notifications when an EC2 instance's status check fails. Which TWO services should the engineer use? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Alarms (Option E) can monitor EC2 instance status checks (both system and instance checks) and trigger an action when the alarm state changes to ALARM. Amazon SNS (Option B) is the service that delivers the notification by publishing messages to subscribers (e.g., email, SMS, HTTP endpoints) when the CloudWatch alarm triggers. Together, they provide a complete monitoring and notification pipeline for status check failures.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS Config

Question 11

Which THREE actions should be taken to ensure that an AWS CloudFormation stack update does not cause downtime for a production application that runs on an Auto Scaling group behind an Application Load Balancer? (Select THREE.)

Accepted Answer

Configure an 'UpdateWaitCondition' in the CloudFormation template to pause the stack update until a healthy signal is received from the new instances.. Option A is correct because an 'UpdateWaitCondition' in a CloudFormation template can pause the stack update until a healthy signal is received from the new instances. This ensures that the update proceeds only after the new instances have passed health checks, preventing premature traffic routing and potential downtime.

Answer

Add a custom resource that triggers an AWS Lambda function to take a snapshot of the database before the update.

Answer

Ensure that the Auto Scaling group spans at least three Availability Zones to distribute instances.

Question 12

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They need to ensure that the stack can be updated to modify a resource's property that requires replacement. Which CloudFormation stack policy should they use?

Accepted Answer

No stack policy, or a policy that allows updates to all resources.. Option A is correct because CloudFormation stack policies are designed to prevent accidental updates to critical resources, not to block updates that require replacement. By default, if no stack policy is applied, all resources can be updated, including those that require replacement. A policy that allows updates to all resources (or no policy) is necessary to permit a stack update that modifies a property requiring resource replacement, as the replacement process involves creating a new resource and deleting the old one, which is a valid update action.

Answer

A stack policy with an AllowAll statement.

Answer

A stack policy with a DenyAll statement.

Answer

A stack policy that explicitly denies updates to the resource.

Question 13

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The team checks the logs and finds that the application installation script fails on some instances due to missing dependencies. What is the BEST long-term solution?

Accepted Answer

Create a custom AMI that includes all dependencies and use it in the Auto Scaling group.. Option A is correct because baking dependencies into the AMI ensures all instances have them. Option B is wrong because it does not fix the root cause. Option C is wrong because it only works for in-place deployments. Option D is wrong because it does not prevent script failures.

Answer

Use an Elastic Load Balancer health check to automatically replace failed instances.

Answer

Modify the CodeDeploy AppSpec file to run the installation script as root.

Answer

Implement a retry mechanism in the deployment script to install dependencies again.

Question 14

Which TWO actions can be taken to protect an S3 bucket from being publicly accessible? (Select TWO.)

Accepted Answer

Use an SCP to deny s3:PutBucketPolicy.. Option A is correct because an SCP (Service Control Policy) can explicitly deny the s3:PutBucketPolicy action at the AWS Organizations level, which prevents any IAM principal in affected accounts from attaching a public bucket policy. This is a preventive guardrail that overrides any permissive IAM permissions, ensuring the bucket cannot be made publicly accessible via policy statements.

Answer

Enable default encryption on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Use CloudFront to serve the bucket content.

Question 15

A company needs to store sensitive data in Amazon S3 with encryption at rest. Which option provides the MOST control over the encryption keys?

Accepted Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C). SSE-C (Server-Side Encryption with Customer-Provided Keys) gives you full control over the encryption keys because you provide and manage the key material yourself. Amazon S3 performs the encryption and decryption operations, but it never stores your keys; you must supply the key with each request. This is the only option where the customer retains complete ownership and lifecycle management of the encryption keys, including rotation and deletion.

Answer

Client-Side Encryption

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)