DOP-C02 Practice Test 32 — 15 Questions

Question 1

A DevOps team uses AWS CloudFormation with nested stacks. They are experiencing stack update failures because changes to a nested stack cause resource conflicts. Which THREE best practices should they follow to manage nested stack updates? (Choose THREE.)

Accepted Answer

Apply a stack policy to prevent updates to critical resources in the nested stacks.. Options A, C, and D are correct. Using change sets previews changes; using stack policies protects critical resources; using resource import can avoid replacement. Option B is wrong because using DependsOn can cause circular dependencies. Option E is wrong because disabling rollback hides failures.

Answer

Set the stack update to disable rollback to allow debugging of failures.

Answer

Use DependsOn to ensure nested stacks are updated in a specific order.

Question 2

A development team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They notice that a pipeline execution failed due to a code review rejection in the 'Approve' stage. The pipeline is configured with a manual approval action. What is the most likely cause of the failure?

Accepted Answer

An authorized user logged in to the CodePipeline console and rejected the approval request.. Option D is correct because a manual approval action requires a user to approve before proceeding; if the approval is rejected, the pipeline fails. Option A is wrong because an IAM policy issue would likely cause a different error. Option B is wrong because CodeCommit repository settings do not directly block pipeline approval actions. Option C is wrong because a CloudWatch Events rule is not required for manual approvals.

Answer

The IAM role for the pipeline does not have permission to invoke the approval action.

Answer

The CodeCommit repository has a branch policy that prevents direct commits.

Answer

The pipeline is not configured with a CloudWatch Events rule to trigger the approval.

Question 3

Refer to the exhibit. A developer has the IAM policy shown. The developer can push code to the CodeCommit repository and start the pipeline. However, the pipeline fails at the Source stage with an access denied error. What additional permission is needed?

Accepted Answer

codecommit:GitPull. Option C is correct because CodePipeline needs permission to read from the source repository. The developer's policy allows GitPush but not codecommit:GitPull. Option A is wrong because codecommit:GetBranch is needed but not the main issue. Option B is wrong because codecommit:CreateCommit is not needed. Option D is wrong because codecommit:UploadArchive is not a CodeCommit action.

Answer

codecommit:GetBranch

Answer

codecommit:CreateCommit

Answer

codecommit:UploadArchive

Question 4

A company uses AWS CloudFormation to manage a stack that includes an Amazon SQS queue. The queue name must be unique. The developer wants to define the queue name in the CloudFormation template. Which intrinsic function should be used to generate a unique name?

Accepted Answer

Fn::Sub. Option C is correct because AWS::NoValue is not a function; AWS::StackName can be used to incorporate the stack name, but not generate a unique suffix. Option A is wrong because Fn::Select picks from a list. Option B is wrong because Fn::GetAtt gets attributes. Option D is correct because Fn::Sub can substitute a parameter like ${AWS::StackName} to create a unique name.

Answer

Fn::Select

Answer

AWS::NoValue

Answer

Fn::GetAtt

Question 5

A company uses AWS CodePipeline with multiple stages. The pipeline includes a Beta stage that deploys to a test environment and a Prod stage. The team wants to require manual approval before the Prod stage. Which TWO actions should be taken to implement this? (Choose TWO.)

Accepted Answer

Ensure that the IAM user or role performing the approval has codepipeline:PutApprovalResult permissions.. Options B and E are correct. The approval action must be added to the pipeline structure as a stage with an approval action, and the IAM policy must allow the approver to perform the approval. Option A is wrong because CodeCommit approval rules are for pull requests. Option C is wrong because CloudWatch Events does not provide manual approval. Option D is wrong because the pipeline must be configured to use the manual approval action, not just restrict triggers.

Answer

Use CloudWatch Events to trigger a Lambda function that requires manual sign-off.

Answer

Set the Prod stage to only run on manual invocation.

Answer

Configure a CodeCommit approval rule template to require approval before merging.

Question 6

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda and Amazon API Gateway. The team wants to automate deployment across multiple environments (dev, test, prod) with environment-specific configuration. Which approach should the engineer use?

Accepted Answer

Use the AWS Serverless Application Model (SAM) with CodePipeline, and pass environment parameters as CloudFormation parameter overrides.. Option D is correct because AWS SAM supports environment parameterization and is designed for serverless. Option A is not environment-aware. Option B requires manual variable managing. Option C lacks environment-specific config.

Answer

Use CodeBuild to package the Lambda code and then use CloudFormation with parameters for each environment.

Answer

Use CodeDeploy with a deployment configuration that deploys to all environments sequentially.

Answer

Use CodePipeline with separate CodeBuild projects for each environment.

Question 7

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer, EC2 instances in an Auto Scaling group, and an Amazon RDS Multi-AZ DB instance. The application experiences intermittent failures when the RDS primary instance fails over to the standby. The engineer needs to ensure that the application handles failover gracefully without manual intervention.

Accepted Answer

Use Amazon RDS Proxy to pool and reuse database connections, which reduces connection churn during failover.. Using a proxy like ProxySQL or configuring the application to use the RDS endpoint (which automatically points to the current primary) helps handle failover. Additionally, enabling RDS connection pooling or using Lambda to update the application can help, but the simplest is to use the instance endpoint with a retry mechanism.

Answer

Modify the application to use DNS caching with a TTL of 300 seconds to avoid stale DNS records.

Answer

Configure the Application Load Balancer to perform health checks on the RDS instance.

Answer

Enable Multi-AZ on the Auto Scaling group to ensure EC2 instances are in multiple AZs.

Question 8

A gaming company runs a real-time multiplayer game on AWS using Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer. The game state is stored in Amazon ElastiCache for Redis. The team needs to ensure that the architecture can survive a regional failure with minimal data loss and recovery time. The RTO is 15 minutes and RPO is 5 minutes. The game currently uses a single Redis cluster in us-east-1.

Accepted Answer

Configure Amazon ElastiCache for Redis with Global Datastore to replicate data to a second region.. To survive regional failure, you need cross-region replication for Redis. Global Datastore for Redis provides cross-region replication. Also, you need to be able to promote the replica in the secondary region. Finally, you need to redirect traffic to the secondary region, which can be done with Route 53 failover routing.

Answer

Enable Multi-AZ on the ElastiCache cluster to improve availability within the region.

Answer

Use Amazon ElastiCache for Redis with cluster mode disabled to simplify failover.

Answer

Configure the application to write to the local Redis replica in the secondary region and then sync back.

Question 9

Refer to the exhibit. A DevOps engineer runs the CLI command to view stack events. The output shows that a Lambda function update was cancelled by the stack update. What is the most likely cause?

Accepted Answer

A concurrent stack update was initiated while a previous update was in progress.. Option B is correct because 'Resource update cancelled by stack update' indicates that a previous update to the Lambda function was interrupted by a newer stack update operation. Option A is wrong because a permissions error would show 'AccessDenied'. Option C is wrong because size limits would show a different error. Option D is wrong because drift detection does not cancel updates.

Answer

The stack had a drift detection operation that overrode the update.

Answer

The IAM role for the Lambda function lacked permissions to update the function.

Answer

The Lambda function code exceeded the maximum size limit for inline code.

Question 10

Refer to the exhibit. A developer has a buildspec.yaml for a React application. The build completes successfully, but the artifacts output is empty. What is the most likely cause?

Accepted Answer

The base-directory specified does not exist after the build phase.. Option D is correct because the base-directory is set to 'build' but the build command 'npm run build' likely outputs to a different directory (e.g., 'dist'). Option A is wrong because the install phase runs npm install. Option B is wrong because runtime version is valid. Option C is wrong because '**/*' matches all files.

Answer

The install phase did not run because npm install is not in the correct phase.

Answer

The artifacts files pattern '**/*' is invalid.

Answer

The runtime version nodejs 14 is not supported by CodeBuild.

Question 11

A company uses AWS CodePipeline to deploy a static website to Amazon S3 and CloudFront. The pipeline currently uses CodeBuild to run tests and then deploys to an S3 bucket. The team wants to add a stage that invalidates the CloudFront cache after deployment. Which TWO actions achieve this?

Accepted Answer

Use the AWS CLI command 'aws cloudfront create-invalidation' in a CodeBuild build step.. Option A is correct because CloudFront has an invalidation API. Option C is correct because CodePipeline can have a Lambda invocation as a stage action. Option B is not a native integration. Option D is an alternative but not a CodePipeline action. Option E is not a standard action.

Answer

Configure CodePipeline to directly invalidate CloudFront using a built-in action.

Answer

Create a CodePipeline stage with a deploy action to CloudFront.

Answer

Use CloudFront to automatically invalidate based on S3 events.

Question 12

An organization wants to ensure that all objects stored in the S3 bucket are encrypted at rest using server-side encryption with S3 managed keys (SSE-S3). The bucket policy above is intended to enforce this. However, a user reported that they can still upload unencrypted objects. What is the MOST likely reason?

Accepted Answer

The condition is applied to the GetObject action, not the PutObject action.. Option D is correct. The bucket policy condition checks for the header 'x-amz-server-side-encryption' with value 'AES256'. However, this condition is on the GetObject action, not on PutObject. To enforce encryption on uploads, the condition should be on s3:PutObject. Additionally, the condition should require encryption, not just check it. Option A is incorrect because using bucket policy is a valid way to enforce encryption. Option B is incorrect because the condition syntax is correct for SSE-S3. Option C is incorrect because the policy applies to the bucket, but the condition is on the wrong action.

Answer

The bucket policy is not attached to the bucket because of a circular dependency.

Answer

The bucket policy does not apply to objects uploaded by the root user.

Answer

The condition should use 's3:x-amz-server-side-encryption-aws-kms-key-id' instead.

Question 13

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that when a stack update fails, the stack automatically rolls back to its previous state. However, they also want to preserve any resources that were created outside of CloudFormation (drift). What should they do?

Accepted Answer

Use a CloudFormation resource policy with a 'Retain' rule for resources that might have drifted. Then enable rollback on failure.. Option B is correct because CloudFormation resource policies allow you to specify which resources should be retained on deletion. Option A is wrong because it would delete all resources. Option C is wrong because stack policies protect resources during updates, not for rollback. Option D is wrong because termination protection prevents stack deletion, not resource deletion during rollback.

Answer

Enable termination protection on the stack to prevent deletion during rollback.

Answer

Use a stack policy that denies updates to resources created outside CloudFormation. Then enable rollback on failure.

Answer

Enable rollback on failure in the stack options. CloudFormation will automatically roll back, preserving all resources.

Question 14

A DevOps engineer runs the command shown in the exhibit. The output shows the stack status as ROLLBACK_COMPLETE. Which statement best describes the current state of the stack?

Accepted Answer

The stack creation failed and has been rolled back. No resources remain.. Option B is correct because ROLLBACK_COMPLETE means the stack creation failed and rolled back, leaving no resources. Option A is wrong because that would be CREATE_COMPLETE. Option C is wrong because UPDATE_ROLLBACK_COMPLETE is for updates. Option D is wrong because ROLLBACK_IN_PROGRESS is the intermediate state.

Answer

The stack was created successfully and is in a steady state.

Answer

The stack update failed and has been rolled back to the previous state.

Answer

The stack is currently in the process of rolling back after a failed creation.

Question 15

A company uses AWS CodeBuild to run integration tests as part of a pipeline. The tests require access to an Amazon RDS database. The RDS instance is in a private subnet with no public access. The CodeBuild project is configured with a VPC. Which additional configuration is necessary to ensure the build can connect to the database?

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic from the security group associated with the CodeBuild project.. Option C is correct because CodeBuild needs security group rules that allow outbound traffic to the RDS instance and the RDS security group must allow inbound traffic from CodeBuild. Option A is wrong because NAT gateway is for internet access, not for database connectivity within VPC. Option B is wrong because VPC endpoints are for AWS services, not for RDS connectivity. Option D is wrong because IAM roles do not control network connectivity.

Answer

Add an IAM policy that grants the CodeBuild service role access to the RDS instance.

Answer

Create a VPC endpoint for Amazon RDS.

Answer

Attach a NAT gateway to the private subnet.