DOP-C02 Practice Test 31 — 15 Questions

Question 1

Refer to the exhibit. A team uses this buildspec.yml file in AWS CodeBuild. After the build, they expect the artifacts to be placed in a folder structure, but all files are in the root of the output artifact. What is the reason?

Accepted Answer

The 'discard-paths' option is set to 'yes', which flattens the directory structure.. Option A is correct because 'discard-paths: yes' flattens the structure. Option B is wrong because it only shows files. Option C is wrong because 'base-directory' is not set. Option D is wrong because it would be 'no'.

Answer

The 'files' section only includes '**/*' which does not preserve paths.

Answer

The 'base-directory' is not specified, so CodeBuild uses the root of the build output.

Answer

The 'name' property is missing, causing artifacts to be stored without structure.

Question 2

An organization uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon S3 bucket with a bucket policy that restricts access to a specific IAM role. During a recent security audit, it was discovered that the bucket policy was modified manually via the AWS Management Console, and the change was not reflected in the CloudFormation template. The security team wants to detect and remediate such drift automatically. Which combination of steps should be taken to achieve this?

Accepted Answer

Enable drift detection on the CloudFormation stack and use Amazon EventBridge to trigger an AWS Lambda function that restores the original bucket policy when drift is detected.. Option D is correct because it directly addresses the requirement to both detect and automatically remediate drift in a CloudFormation-managed S3 bucket policy. CloudFormation drift detection identifies manual changes to the bucket policy, and Amazon EventBridge can trigger an AWS Lambda function that uses the CloudFormation UpdateStack API to restore the original policy from the template, ensuring the infrastructure remains in sync with the IaC definition.

Answer

Use AWS CloudTrail to monitor PutBucketPolicy events and send alerts to the security team via Amazon SNS.

Answer

Create an AWS Config rule to check if the bucket policy matches the desired policy, and use an AWS Lambda function to automatically correct any noncompliant buckets.

Answer

Configure S3 event notifications to invoke an AWS Lambda function whenever the bucket policy is modified.

Question 3

A company uses AWS CodeBuild to compile and test code. The buildspec.yaml includes a pre_build phase that runs 'aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com'. The build fails with 'Error: Cannot connect to the Docker daemon'. What is the most likely cause?

Accepted Answer

The CodeBuild project does not have privileged mode enabled.. Option D is correct because CodeBuild runs in a managed environment where the Docker daemon is only available if the compute type is set to a privileged mode (e.g., by setting 'privileged: true' in buildspec). Option A is wrong because the command is syntactically correct. Option B is wrong because the ECR login command is correct. Option C is wrong because the region is specified.

Answer

The region specified does not match the ECR repository region.

Answer

The Docker login command syntax is incorrect.

Answer

The AWS CLI is not installed in the CodeBuild environment.

Question 4

A company uses AWS Elastic Beanstalk for deploying a web application. The development team wants to implement a blue/green deployment strategy to minimize downtime. Which approach should they use?

Accepted Answer

Create a new Elastic Beanstalk environment and swap the environment CNAMEs.. Option D is correct because Elastic Beanstalk supports blue/green deployments by swapping CNAME records between two environments. Option A is wrong because Elastic Beanstalk does not natively use CodeDeploy for blue/green; it has its own swap method. Option B is wrong because updating the Auto Scaling group is not a blue/green approach. Option C is wrong because updating the load balancer target group is more of a rolling update.

Answer

Update the Auto Scaling group launch configuration and gradually replace instances.

Answer

Create a new CodeDeploy deployment group and use the blue/green deployment configuration.

Answer

Create a new target group and register instances from the old environment.

Question 5

A DevOps engineer is troubleshooting a CodePipeline that has a Build stage using AWS CodeBuild. The build logs show 'Error: No such file or directory' for a file that is present in the source repository. What is the most likely cause?

Accepted Answer

The buildspec.yaml specifies an incorrect path for the file relative to the source root.. Option A is correct because CodeBuild uses a source code location; if the buildspec.yaml references a relative path that does not exist in the root, it may fail. Options B, C, and D are less likely because environment variables, build commands, and artifacts are not directly related to file existence in the source.

Answer

The build commands are not executed because the pre_build phase failed.

Answer

The artifact definition in the buildspec.yaml is incorrect.

Answer

The environment variables in CodeBuild are not set correctly.

Question 6

A company uses AWS CodePipeline to deploy a critical application. The pipeline has a manual approval step before deployment. Which TWO actions should be taken to improve security and auditability? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all approval actions.. Options A and D are correct. Option B is wrong because approval is manual. Option C is wrong because it reduces security. Option E is wrong because it bypasses approval.

Answer

Remove the approval step and rely on post-deployment monitoring.

Answer

Replace the manual approval with an automated approval based on test results.

Answer

Use a shared IAM user for all approvers to simplify management.

Question 7

Refer to the exhibit. A DevOps engineer attaches this IAM policy to a user. The user reports that they cannot start a pipeline execution for 'my-pipeline' using the AWS CLI. What is the MOST likely reason?

Accepted Answer

The user is missing the 'codepipeline:ListPipelines' permission needed to list pipelines before execution.. Option C is correct because the user needs 'codepipeline:StartPipelineExecution' permission, which is allowed. But the CLI command may require 'codepipeline:ListPipelines' to list pipelines, which is missing. Option A is wrong because the actions are allowed. Option B is wrong because resource ARN is correct. Option D is wrong because there is no such condition.

Answer

The IAM policy does not allow the 'codepipeline:StartPipelineExecution' action.

Answer

The resource ARN for the pipeline is incorrect.

Answer

The policy has a condition that restricts execution to certain times.

Question 8

A DevOps engineer is setting up a CI/CD pipeline for a microservices application using AWS CodePipeline. The pipeline includes a Test stage that runs integration tests against a staging environment. The engineer wants to ensure that manual approval is required before deploying to production. Which action should be taken?

Accepted Answer

Add a manual approval action in the pipeline stage before production deployment.. Option A is correct because a manual approval action in CodePipeline requires a reviewer to approve before proceeding to the next stage. Option B is wrong because CodeCommit does not provide approval workflows for pipeline stages. Option C is wrong because CloudWatch can monitor but not block. Option D is wrong because the pipeline can be triggered after approval, but the approval is a stage action.

Answer

Configure a CodeCommit approval rule template to block the merge.

Answer

Use CloudWatch Events to send a notification and wait for a custom signal.

Answer

Set the pipeline to only run on manual invocation.

Question 9

Refer to the exhibit. A developer runs the AWS CLI command to start a build in AWS CodeBuild. The build project 'my-project' uses an S3 bucket as the source. What is the MOST likely cause of the error?

Accepted Answer

The CodeBuild service role does not have s3:GetObject permission on the source bucket.. Option B is correct because the CodeBuild service role needs S3 access. Option A is wrong because the error is about the role. Option C is wrong because the error says 'provided role'. Option D is wrong because the bucket is specified.

Answer

The S3 bucket name is misspelled in the build project configuration.

Answer

The developer's IAM user does not have s3:GetObject permission.

Answer

The S3 bucket is in a different region than the CodeBuild project.

Question 10

A company uses AWS CloudTrail to monitor API activity. During an incident, they need to quickly identify any unauthorized IAM role assumption attempts. Which CloudTrail feature should be used to filter and alert on this specific event?

Accepted Answer

Enable CloudTrail Insights to detect anomalous AssumeRole events.. Option A is correct because CloudTrail Insights identifies unusual API activity like role assumption anomalies. Option B is wrong because CloudWatch Logs filters would require manual setup. Option C is wrong because S3 event notifications are for object-level events. Option D is wrong because VPC Flow Logs track network traffic, not API calls.

Answer

Configure VPC Flow Logs to capture traffic to the IAM endpoint.

Answer

Use S3 event notifications on the CloudTrail bucket for PutObject events.

Answer

Set up a CloudWatch Logs metric filter on the CloudTrail log group for 'AssumeRole' events.

Question 11

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The pipeline has a Source stage that polls the repository for changes. Recently, developers have noticed that the pipeline does not always trigger when code is pushed to the main branch. What is the most likely cause?

Accepted Answer

The number of pushes to the repository has exceeded the CodePipeline poll rate limit.. Option B is correct because excessive pushes to the repository can cause throttling of CodePipeline's polling mechanism. Option A is wrong because CodePipeline does not require a webhook; polling is a valid method. Option C is wrong because CloudWatch Events are not used for polling. Option D is wrong because IAM permissions for CodeCommit are separate from CodePipeline's service role.

Answer

The repository does not have a webhook configured to notify CodePipeline of changes.

Answer

The IAM role used by CodePipeline does not have permission to read from CodeCommit.

Answer

CloudWatch Events is not enabled for the repository.

Question 12

Which TWO AWS services can be used to distribute incoming traffic across multiple AWS resources in different Availability Zones within a single region?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network and Anycast static IP addresses to route incoming traffic to the optimal endpoint, such as an Application Load Balancer or EC2 instance, across multiple Availability Zones within a single region. It improves performance and reliability by directing traffic to the healthiest endpoint and automatically rerouting in case of failure, making it a valid service for distributing traffic across AZs.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Question 13

A team uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS instance. During an update, the stack fails with 'CREATE_FAILED' for the DB instance resource, and the error message indicates 'The DB instance already exists.' What is the most likely cause?

Accepted Answer

An RDS instance with the same identifier already exists in the account and region.. Option B is correct because if the stack was previously deleted without retaining the resource, the DB instance may have been left behind. Option A is wrong because RDS does not have a deletion policy that prevents deletion. Option C is wrong because UpdateReplace policy would replace but not cause 'already exists' error. Option D is wrong because deletion protection would prevent deletion but not cause 'already exists' if the stack is new.

Answer

The stack update is trying to replace the DB instance without a proper UpdateReplace policy.

Answer

The stack has a DeletionPolicy of Retain on the RDS instance.

Answer

The RDS instance has deletion protection enabled.

Question 14

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment is set to 'AllAtOnce'. The application revision is a simple index.html. What is the most likely cause?

Accepted Answer

The CodeDeploy agent is not installed or running on the EC2 instances.. Option D is correct because the CodeDeploy agent must be installed on each EC2 instance in the Auto Scaling group to receive and execute deployments. Option A is wrong because AllAtOnce means all instances deploy simultaneously. Option B is wrong because S3 permissions are needed but would cause a different error. Option C is wrong because the revision is a single file, not a zip, but CodeDeploy requires a revision format; however, the error message suggests instance failure.

Answer

The IAM instance profile does not have permissions to download from Amazon S3.

Answer

The application revision is not a compressed archive.

Answer

The deployment configuration 'AllAtOnce' is incompatible with Auto Scaling groups.

Question 15

A developer wants to automate the testing of a serverless application built with AWS Lambda and Amazon API Gateway. Which AWS service is best suited for running integration tests as part of a CI/CD pipeline?

Accepted Answer

AWS CodeBuild. Option C is correct because AWS CodeBuild can run integration tests in a managed environment; it supports custom test frameworks. Option A is wrong because CodeDeploy is for deployment, not testing. Option B is wrong because CloudFormation is for infrastructure provisioning. Option D is wrong because CloudWatch is for monitoring and logging, not running tests.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Answer

AWS CloudFormation

DOP-C02 Practice Test 31 — 15 Questions

Exhibit

DOP-C02 Practice Test 31 — 15 Questions

Exhibit