DOP-C02 Practice Test 3 — 30 Questions

Question 1

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation Lambda function fails with a timeout error. What is the most likely cause?

Accepted Answer

The Lambda function is not configured to access the VPC where the RDS instance resides.. The most likely cause of the timeout error is that the Lambda function is not configured to access the VPC where the RDS instance resides. When Secrets Manager rotates a secret for an RDS database, the rotation Lambda function must connect to the database to update the credentials. If the Lambda function is not attached to the same VPC (or a VPC with proper routing and security group rules), it cannot reach the RDS instance, causing network connection attempts to hang until the function times out.

Answer

The Lambda function's execution role lacks the required IAM permissions.

Answer

The secret rotation schedule is set to less than 24 hours.

Answer

The Lambda function does not have permission to access the S3 bucket.

Question 2

A team uses AWS CodePipeline to deploy a containerized application to Amazon ECS. The pipeline uses a source stage from CodeCommit, a build stage that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that updates an ECS service. The team wants to add a manual approval step before the deploy stage to allow QA to verify the image. What is the BEST way to implement this?

Accepted Answer

Add a manual approval stage in CodePipeline between the build and deploy stages, and configure SNS to notify approvers.. CodePipeline natively supports manual approval actions that pause the pipeline at a specified stage and wait for an approver to manually approve or reject the transition. By adding a manual approval stage between the build and deploy stages, the pipeline will automatically halt after the build completes, and you can configure Amazon SNS to notify the QA team via email or other endpoints when their approval is required. This approach requires no custom infrastructure, integrates directly with the pipeline's state machine, and provides a built-in audit trail of approvals.

Answer

Configure an AWS Lambda function in the pipeline that checks a DynamoDB table for approval status and pauses until approved.

Answer

Use an Amazon SNS topic to send a notification to QA, and have them manually trigger the deploy stage by clicking a link in the email.

Answer

Use Amazon CloudWatch Events to trigger a custom action that waits for an approval signal.

Question 3

A company uses AWS CloudFormation StackSets to deploy a VPC across multiple AWS accounts in AWS Organizations. The StackSet is created with self-managed permissions. The deployment fails in some accounts with the error: 'Insufficient IAM permissions to create resources'. What is the most likely cause of this failure?

Accepted Answer

The execution IAM role is not created in the target accounts. With self-managed permissions in AWS CloudFormation StackSets, the administrator account does not automatically create the necessary IAM roles in target accounts. The execution IAM role must be manually created in each target account to grant StackSets the permissions required to create resources. The error 'Insufficient IAM permissions to create resources' directly indicates that this execution role is missing or lacks the required policies.

Answer

The StackSet does not support deploying to more than one account

Answer

The administrator account does not have a service-linked role for StackSets

Answer

The target accounts have reached their resource service quotas

Question 4

A company uses AWS CloudFormation to manage its infrastructure. The stack creation recently failed because an IAM role resource was created before the AWS Lambda function that depends on it. The template has no DependsOn clauses. What is the most likely reason for this failure and how can it be fixed?

Accepted Answer

Add a DependsOn clause to the Lambda function resource referencing the IAM role. The most likely reason for the failure is that CloudFormation, by default, parallelizes the creation of resources that do not have explicit dependencies. Since the IAM role and Lambda function have no DependsOn clause, CloudFormation may attempt to create the Lambda function before the IAM role is fully created and its permissions are propagated. Adding a DependsOn clause to the Lambda function resource referencing the IAM role ensures that CloudFormation creates the IAM role first, resolving the dependency and preventing the failure.

Answer

Use AWS Systems Manager Automation to create the resources sequentially

Answer

Use a ChangeSet to roll back the stack and modify the template

Answer

Split the template into two separate stacks and use nested stacks

Question 5

A DevOps engineer creates the CloudFormation template shown in the exhibit. When the stack is created, the EC2 instance is launched but the security group is not applied to the instance. What is the likely cause?

Accepted Answer

The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.. The CloudFormation template does not include a `SecurityGroup` or `SecurityGroupIds` property in the EC2 instance's `AWS::EC2::Instance` resource. Without this explicit reference, the instance launches with the default VPC security group, not the custom security group defined in the template. The security group resource is created successfully, but it is not attached to the instance.

Answer

The security group resource is missing a VpcId property, so it is not created in the same VPC as the instance.

Answer

The security group is created after the instance, so the instance cannot reference it.

Answer

The DependsOn clause should be removed because it causes a circular dependency.

Question 6

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database instance fails and AWS automatically fails over to the standby. After the failover, the application cannot connect to the database. The engineer checks the RDS console and sees that the instance status is Available. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The application is using the database's DNS endpoint for the old primary, which is no longer the writer.. After an RDS Multi-AZ failover, the DNS endpoint for the DB instance remains the same but its underlying IP address changes to point to the new primary (formerly the standby). If the application caches the IP address of the old primary or uses a direct connection to the old writer endpoint, it will attempt to connect to a node that is no longer the writer. The correct practice is to always connect using the RDS instance endpoint (CNAME), which automatically resolves to the current writer, and to avoid caching the resolved IP address. Since the instance status is 'Available', the new primary is ready, so the issue is a stale connection target.

Answer

The security group for the RDS instance has changed during failover.

Answer

The DNS record for the RDS endpoint has not propagated to the application's DNS resolver.

Answer

The database instance is still in the process of failover and is not yet accepting connections.

Question 7

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application is expected to have unpredictable traffic patterns. The DevOps team needs to ensure that the application can handle sudden spikes in traffic without throttling. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. DynamoDB on-demand capacity mode automatically scales to handle unpredictable traffic spikes without requiring capacity planning or throttling. This mode charges per request and can accommodate sudden bursts of traffic up to the table's previous peak, making it ideal for serverless applications with variable workloads.

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read/write capacity units.

Answer

Increase the Lambda function timeout to the maximum (15 minutes).

Answer

Set API Gateway throttling limits to a high value to prevent throttling.

Question 8

A Lambda function is unable to write logs to CloudWatch Logs. The IAM policy attached to the function's execution role is shown above. What is the issue?

Accepted Answer

The policy is missing the 'logs:CreateLogGroup' and 'logs:CreateLogStream' actions.. The Lambda function's execution role must include permissions for 'logs:CreateLogGroup' and 'logs:CreateLogStream' in addition to 'logs:PutLogEvents' to write logs to CloudWatch. The provided policy likely only grants 'logs:PutLogEvents', which allows writing to existing log streams but not creating the log group or stream. Option A is incorrect because the resource ARN can be generalized to the log group or stream without specifying the stream name. Option B is incorrect because the region mismatch would cause a different error. Option C is incorrect because the action 'logs:PutLogEvents' is necessary but not sufficient; the missing create actions are the issue.

Answer

The resource ARN is incorrect; it should include the log stream name.

Answer

The region in the ARN does not match the Lambda function's region.

Answer

The action should be 'logs:PutLogEvents' but the resource is too restrictive.

Question 9

A company is using AWS CodePipeline with multiple stages that include source, build, and deploy. The pipeline uses an Amazon S3 bucket as the source action. The team notices that the pipeline is not automatically starting when new files are uploaded to the S3 bucket. The S3 bucket has versioning enabled. What is the most likely reason?

Accepted Answer

The pipeline is configured to detect changes based on object key, but the uploaded file uses the same key as an existing object.. CodePipeline's S3 source action detects changes based on object key and ETag. When a file is uploaded with the same key as an existing object, even with versioning enabled, the ETag may not change if the content is identical, or the pipeline may not trigger if it only monitors for new keys. Versioning creates a new version ID, but CodePipeline's default detection relies on object key changes or ETag changes, not version ID changes, so uploading a file with the same key may not start the pipeline.

Answer

The S3 bucket is the same bucket used for the deploy action.

Answer

The S3 bucket is not configured to send Amazon SQS notifications to CodePipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 10

An IAM policy is attached to a user who needs to manually start a CodePipeline execution. The pipeline uses an S3 bucket named 'my-artifact-bucket' for artifacts. The user reports that they cannot start the pipeline. Which action is missing from the policy?

Accepted Answer

codepipeline:ListPipelines. The user needs to manually start a CodePipeline execution, which requires the `codepipeline:StartPipelineExecution` action. However, the question asks which action is missing from the policy, and the correct answer is `codepipeline:ListPipelines` because the user cannot even see the pipeline to start it. Without `codepipeline:ListPipelines`, the AWS Management Console or CLI will not return the pipeline in the list, preventing the user from selecting it to start execution. The other actions are either not directly required for starting a pipeline or are unrelated to the permission needed to list pipelines.

Answer

iam:PassRole

Answer

codepipeline:GetPipelineExecution

Answer

s3:PutObject

Question 11

An IAM policy is attached to a user. The user is trying to push a commit to the 'main' branch of the 'MyRepo' repository. The push is denied. What is the most likely reason?

Accepted Answer

The condition key 'codecommit:References' is not correctly formatted for an array value.. The condition key 'codecommit:References' must be formatted as an array value when used in an IAM policy to restrict pushes to specific branches. If the policy uses a string value instead of an array (e.g., 'refs/heads/main' instead of ['refs/heads/main']), the condition fails to match, and the push is denied even if the user has the 'codecommit:GitPush' action allowed. This is a common misconfiguration in IAM policies for CodeCommit.

Answer

The user does not have permission to push to any branch.

Answer

The policy does not allow the 'codecommit:GitPush' action for the main branch.

Answer

The resource ARN is incorrect.

Question 12

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The application is deployed to the instances using an in-place deployment. The instances are running Amazon Linux 2. What should the DevOps engineer check first?

Accepted Answer

Verify that the AWS CodeDeploy agent is installed and running on each EC2 instance.. The error message indicates that individual instances failed deployment, which is most commonly caused by the AWS CodeDeploy agent not running or not being installed on the EC2 instances. For an in-place deployment on Amazon Linux 2, the CodeDeploy agent must be installed and actively running to receive and execute deployment commands from the CodeDeploy service. If the agent is missing or stopped, the instance cannot participate in the deployment, leading to the 'too many individual instances failed' error.

Answer

Check the security group rules for the EC2 instances.

Answer

Check the application's port availability.

Answer

Verify that the IAM instance profile associated with the instances has the correct permissions.

Question 13

A company uses AWS CloudFormation to manage infrastructure. They have a nested stack that creates an ECS cluster. The parent stack fails with the error: 'The following resource(s) failed to create: [ECSCluster]'. Which TWO are possible causes? (Choose TWO.)

Accepted Answer

The parent stack's IAM role does not have permission to create the nested stack's resources. The parent stack's IAM role must have sufficient permissions to create all resources defined in the nested stack, including the ECS cluster. If the role lacks the necessary ECS actions (e.g., ecs:CreateCluster), CloudFormation will fail with the generic 'failed to create' error for the nested stack resource.

Answer

The parent stack is referencing an output from the nested stack that does not exist

Answer

The nested stack is in a different AWS region from the parent stack

Answer

The nested stack's name is not unique among all stacks in the account

Question 14

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with timeout errors. The DevOps team needs to troubleshoot the root cause. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Increase the canary timeout configuration to allow more time for the endpoint to respond.. Options B, D, and E are correct. B: Increasing the canary timeout configuration can resolve timeout errors if the endpoint is slow but still functional. D: Reviewing VPC Flow Logs helps identify network issues such as dropped or denied requests that could cause timeouts. E: Examining canary logs in CloudWatch Logs provides detailed error messages and execution traces to pinpoint the failure cause. Option A is incorrect because CloudTrail records API calls, not canary execution details; canary logs are in CloudWatch Logs. Option C is incorrect because canaries run in AWS Lambda, not on EC2 instances, so EC2 CPU utilization is irrelevant.

Answer

Use AWS CloudTrail to review Canary API calls.

Answer

Check the EC2 instance CPU utilization in the VPC where the canaries run.

Question 15

Which TWO steps are required to set up a cross-account CI/CD pipeline where the source stage is in Account A (CodeCommit) and the deploy stage is in Account B (ECS)? (Choose 2.)

Accepted Answer

Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action.. For a cross-account CI/CD pipeline where the source stage (CodeCommit) is in Account A and the deploy stage (ECS) is in Account B, only two steps are required: 1) Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action (Option A). 2) Update the CodePipeline service role in Account A to include a trust policy that allows assuming the role in Account B (Option C). You do not need a KMS key in Account B; if the artifact bucket in Account A is encrypted with a customer-managed AWS KMS key, the key is in Account A and its policy must grant Account B's role kms:Decrypt, but that is not one of the required setup steps in the options. Option D is incorrect because the CodeCommit repository is in Account A, not Account B. Option E is incorrect because the pipeline artifact bucket should reside in Account A, not Account B.

Answer

Configure an AWS KMS key in Account B and share it with Account A for encrypting artifacts.

Answer

Create a resource-based policy on the CodeCommit repository in Account B that grants access to the CodePipeline service role in Account A.

Answer

Create an S3 bucket in Account B to store the artifacts and grant cross-account access.

Question 16

A DevOps team is designing a solution to encrypt data at rest for an Amazon RDS for MySQL database. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use AWS KMS to create a customer managed key and assign it to the RDS instance. To encrypt data at rest for Amazon RDS for MySQL, encryption must be enabled when creating the DB instance (Option D) and a customer managed key from AWS KMS can be used (Option C). Option A is incorrect because you cannot enable encryption on an existing unencrypted RDS instance; it must be done at creation time. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest. Option E is incorrect because storing database files in an encrypted S3 bucket does not encrypt the RDS instance; RDS encryption is managed by AWS KMS and is enabled at the instance level.

Answer

Enable encryption after creating the RDS instance by modifying the instance

Answer

Enable SSL/TLS for the RDS instance

Answer

Store the database files in an encrypted S3 bucket

Question 17

A company uses AWS CodeBuild to build and test code. The build jobs need to access a private S3 bucket to download dependencies. Which THREE steps are required to securely grant access?

Accepted Answer

Configure the S3 bucket policy to allow access from the CodeBuild service principal. To grant CodeBuild access to an S3 bucket, you need an IAM role that allows the required actions, attach it to the CodeBuild project, and also ensure the bucket policy allows the role. KMS key is not required if SSE-S3 is used. VPC endpoint is optional.

Answer

Set up a VPC endpoint for S3

Answer

Create a KMS key and grant CodeBuild access to it

Question 18

A DevOps engineer is troubleshooting a production issue where an application's response time has increased. The application is deployed on Amazon ECS with Fargate. The engineer wants to identify which microservice is causing the latency. Which AWS service should be used?

Accepted Answer

AWS X-Ray to trace requests and analyze service latency.. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, allowing the engineer to pinpoint which service is introducing latency. By analyzing trace segments and subsegments, X-Ray can break down response times for each component in the application, directly addressing the need to identify the specific microservice causing the delay.

Answer

Amazon CloudWatch Synthetics canary to monitor the application endpoint.

Answer

Amazon CloudWatch Logs Insights to query application logs for errors.

Answer

Amazon CloudWatch ServiceLens to visualize service maps and traces.

Question 19

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group across three Availability Zones. The instances run a Java application that connects to an Amazon RDS Multi-AZ MySQL database. The application also uses Amazon ElastiCache for Redis for session caching. The company recently experienced a severe outage where the ALB's 5xx error rate spiked to 100% for 45 minutes. The root cause was a combination of a slow-running query on the RDS primary instance and a subsequent failover that caused the application to lose connections to the database. The failover happened because the slow query caused the primary to become unresponsive, triggering a Multi-AZ failover. During the failover, the application's connection pool exhausted, and new connections failed. The application logs show a high rate of 'java.sql.SQLTimeoutException' and 'com.mysql.cj.exceptions.CJCommunicationsException'. The DevOps team needs to implement a long-term solution that minimizes the impact of similar incidents. The solution must be cost-effective and require minimal application changes. Which combination of actions should the DevOps team take?

Accepted Answer

Implement Amazon RDS Proxy to manage database connections and add read replicas to offload read traffic.. Amazon RDS Proxy is the correct solution because it efficiently manages database connection pooling, reducing the likelihood of connection exhaustion during failovers. By maintaining a warm connection pool and automatically reconnecting to the new primary after a Multi-AZ failover, RDS Proxy minimizes application-side connection timeouts and errors like SQLTimeoutException and CJCommunicationsException. Adding read replicas offloads read traffic, reducing the load on the primary and mitigating the risk of slow queries causing unresponsiveness. This combination requires minimal application changes and is cost-effective compared to scaling the primary instance.

Answer

Use an Auto Scaling policy for EC2 based on RDS connection count and implement a read replica for the primary.

Answer

Configure Multi-AZ RDS with a synchronous standby and use Amazon RDS for MySQL with enhanced monitoring.

Answer

Increase the instance size of the RDS primary and enable Performance Insights to identify slow queries.

Question 20

A DevOps team wants to enforce that all EC2 instances launched in an AWS account have a specific tag 'Environment' with value 'Production' or 'Development'. The team uses AWS CloudFormation to provision resources. Which approach should the team use to enforce tagging compliance at launch?

Accepted Answer

Use an AWS Config rule with an auto-remediation action that applies the required tag to non-compliant resources.. AWS Config rules can evaluate EC2 instances for the presence of the 'Environment' tag with allowed values and, when combined with an auto-remediation action (e.g., using AWS Systems Manager Automation), can automatically apply the missing tag to non-compliant resources. This enforces tagging compliance at launch and throughout the resource lifecycle, even if the instance was launched without the tag. The auto-remediation action can be triggered as soon as the Config rule detects non-compliance, ensuring the tag is applied shortly after launch.

Answer

Configure a CloudFormation stack policy that denies stack updates if the tag is missing.

Answer

Add an IAM policy that denies ec2:RunInstances unless the request includes the required tag.

Answer

Create an AWS Service Catalog portfolio with a tag option constraint that requires the tag.