DOP-C02 Practice Test 32 — 15 Questions

Question 1

A development team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They notice that a pipeline execution failed due to a code review rejection in the 'Approve' stage. The pipeline is configured with a manual approval action. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An authorized user logged in to the CodePipeline console and rejected the approval request.. A manual approval action in CodePipeline explicitly requires a human reviewer to approve or reject the pipeline execution. If the pipeline failed due to a 'code review rejection,' the most direct cause is that an authorized user logged into the CodePipeline console and clicked the 'Reject' button on the approval request. This is the only mechanism by which a manual approval action can result in a rejection.

Answer

The IAM role for the pipeline does not have permission to invoke the approval action.

Answer

The CodeCommit repository has a branch policy that prevents direct commits.

Answer

The pipeline is not configured with a CloudWatch Events rule to trigger the approval.

Question 2

A company runs a critical application on EC2 instances in an Auto Scaling group behind an ALB. They want to ensure that if an instance fails, the application remains available with minimal disruption. Which combination of services provides the best resilience?

Accepted Answer

Auto Scaling group with ELB health checks and multiple AZs.. Deploying an Auto Scaling group across multiple Availability Zones (AZs) with Elastic Load Balancer (ALB) health checks ensures that if an EC2 instance fails in one AZ, the ALB automatically routes traffic to healthy instances in other AZs, and Auto Scaling replaces the failed instance. This combination provides both fault isolation and automated recovery, minimizing disruption to the application.

Answer

Auto Scaling group with minimum 2 in a single AZ.

Answer

EC2 instance recovery with CloudWatch alarms.

Answer

Auto Scaling group with desired capacity of 2 and a lifecycle hook.

Question 3

A company's DevOps team notices that their Amazon RDS for PostgreSQL instance's CPU utilization spikes to 90% every day at 10:00 AM, causing application latency. They want to be notified when the CPU utilization exceeds 80% for more than 5 minutes to investigate the cause. Which solution should they implement?

Accepted Answer

Create an Amazon CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and a threshold of 80, and set the alarm action to send a notification to an Amazon SNS topic.. Amazon CloudWatch natively collects the CPUUtilization metric for RDS, and an alarm with a 5-minute period and an 80% threshold directly matches the requirement to alert when CPU exceeds 80% for more than 5 minutes. Configuring the alarm action to publish to an Amazon SNS topic delivers the notification to the DevOps team, which is the standard, lowest-effort solution.

Answer

Use Amazon CloudWatch Logs Insights to query the RDS logs and trigger an SNS notification when CPU utilization is high.

Answer

Enable AWS Trusted Advisor to automatically create a CloudWatch alarm on the CPU utilization metric.

Answer

Create an AWS CloudTrail trail to monitor CPU utilization and trigger an AWS Lambda function to send an email notification.

Question 4

A DevOps engineer is creating a CloudFormation template that includes an AWS Lambda function. The function code is stored in an S3 bucket. The engineer wants to ensure that the Lambda function is updated whenever the code in S3 changes. What should the engineer do?

Accepted Answer

Reference the S3 object version in the Lambda function's Code property to force an update when the version changes. Referencing the S3 object version in the Lambda function's Code property (e.g., `S3ObjectVersion`) creates a dependency on that specific version. When the S3 object is updated, its version changes, which triggers CloudFormation to detect a change in the template and update the Lambda function during the next stack update. This ensures the function code is refreshed without manual intervention.

Answer

Use AWS CodeDeploy to deploy the Lambda function

Answer

Add a DependsOn clause to the Lambda function resource

Answer

Use AWS CodePipeline to automatically update the stack when the S3 object changes

Question 5

A company uses Amazon ECS with Fargate for containerized applications. They need to ensure that if a task fails, it is automatically restarted and the application remains available. Which THREE actions should they take? (Choose THREE.)

Accepted Answer

Configure the ECS service to automatically restart failed tasks.. Amazon ECS services can be configured with a desired task count and a task placement strategy that automatically replaces any failed or stopped tasks. When a task exits unexpectedly, the ECS service scheduler detects the discrepancy between the desired and running count and launches a new task to maintain availability. This is the native mechanism for self-healing in ECS, without requiring external triggers.

Answer

Set up a CloudWatch alarm to trigger AWS Lambda to restart tasks.

Answer

Configure an EC2 Auto Scaling group for the ECS cluster.

Question 6

A DevOps engineer is designing a deployment pipeline for a microservices application on Amazon ECS. The team wants to use blue/green deployments with automatic rollback if CloudWatch alarms are triggered during the deployment. Which combination of services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with a blue/green deployment configuration on the ECS service, and configure automatic rollback when CloudWatch alarms are breached.. AWS CodeDeploy natively supports blue/green deployments on Amazon ECS services, and you can configure automatic rollback when CloudWatch alarms are triggered, meeting the team's requirements. Option B is incorrect because CloudFormation ChangeSets do not provide native blue/green deployment with automatic rollback based on alarms; custom Lambda functions add complexity. Option C is incorrect because CodeBuild is used for building artifacts, not deploying; manually updating the ECS service and using a Lambda for rollback is not a streamlined solution. Option D is incorrect because ECS service auto scaling handles scaling based on demand, not deployment strategies like blue/green.

Answer

Use AWS CloudFormation with a ChangeSet and a custom rollback Lambda function triggered by CloudWatch alarms.

Answer

Use AWS CodeBuild to run a build that creates a new task definition, then update the ECS service manually, and use CloudWatch alarms to trigger a rollback via a Lambda function.

Answer

Use Amazon ECS service auto scaling with step scaling policies based on CloudWatch alarms.

Question 7

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The team wants to automatically test the deployed application before promoting it to production. Which THREE steps should be included in the pipeline?

Accepted Answer

Add a stage that runs a performance or load test.. Adding a performance or load test stage after deployment validates that the serverless application can handle expected traffic volumes under AWS SAM's provisioned concurrency and scaling limits. This ensures the application meets non-functional requirements before promotion, catching issues like cold start latency or throttling that unit tests miss.

Answer

Add a stage that automatically rolls back the deployment if tests fail.

Answer

Add a stage that deploys the application to a separate production environment.

Question 8

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team needs to deploy a stack that includes a Lambda function and an S3 bucket. The Lambda function's code is stored in the S3 bucket. How can the team ensure that the Lambda function is created after the S3 bucket and the code is uploaded?

Accepted Answer

Use the DependsOn attribute on the Lambda function to depend on the S3 bucket.. The DependsOn attribute explicitly instructs CloudFormation to create the S3 bucket before the Lambda function. Even though CloudFormation automatically determines resource dependencies for certain intrinsic functions, it does not infer dependencies based on code uploads. Using DependsOn ensures the bucket exists and the code is uploaded before the Lambda function is created, preventing a deployment failure when the Lambda references code that is not yet available.

Answer

Upload the code to the S3 bucket before creating the stack.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the bucket name.

Answer

Define the S3 bucket resource before the Lambda function resource in the template.

Question 9

A DevOps engineer needs to monitor the number of messages in an Amazon SQS queue and trigger an auto scaling action when the queue depth exceeds a threshold. Which combination of services should be used?

Accepted Answer

Amazon CloudWatch and Amazon EC2 Auto Scaling. Amazon SQS automatically publishes queue metrics (such as ApproximateNumberOfMessagesVisible) to Amazon CloudWatch. CloudWatch alarms can monitor these metrics and trigger scaling policies on an EC2 Auto Scaling group when the threshold is breached. This is the standard, native integration for queue-depth-based auto scaling.

Answer

Amazon CloudWatch Logs and Amazon EC2 Auto Scaling

Answer

Amazon EventBridge and Amazon EC2 Auto Scaling

Answer

Amazon SQS and AWS Lambda

Question 10

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with timeout errors. The DevOps team needs to troubleshoot the root cause. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Increase the canary timeout configuration to allow more time for the endpoint to respond.. Option B is correct because CloudWatch Synthetics canaries have a configurable timeout setting, and if the endpoint legitimately needs more time to respond, raising the timeout prevents intermittent timeout failures. Option D is correct because canaries can run inside a VPC, and VPC Flow Logs capture ACCEPT/REJECT records for traffic to and from the canary's ENIs, revealing whether security groups, NACLs, or routing are dropping the requests. Option E is correct because each canary writes execution logs, screenshots, and HAR files to CloudWatch Logs under /aws/lambda/cwsyn-* log groups, and these logs contain the exact error messages and timing data needed to diagnose the timeout. Option A is not appropriate because CloudTrail records control-plane API calls (e.g., CreateCanary, UpdateCanary), not the canary's runtime HTTP request behavior. Option C is not appropriate because canaries run as Lambda functions managed by the Synthetics service, not on customer EC2 instances, so EC2 CPU utilization in the VPC is irrelevant to canary timeouts.

Answer

Use AWS CloudTrail to review Canary API calls.

Answer

Check the EC2 instance CPU utilization in the VPC where the canaries run.

Question 11

A DevOps engineer is troubleshooting a slow-running Lambda function. The function processes messages from an SQS queue. Which CloudWatch metric should be examined first to determine if the function is experiencing throttling?

Accepted Answer

Throttles. The Throttles metric directly indicates when Lambda is rejecting invocation requests due to concurrency limits being reached. Since the question asks specifically about throttling, this is the first metric to examine to confirm whether the function is being rate-limited by AWS.

Answer

Invocations

Answer

ConcurrentExecutions

Answer

Duration

Question 12

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack update. The stack contains an AWS::Lambda::Function resource. The update failed with the error 'Resource creation cancelled' after a timeout. The engineer wants to view the logs from the Lambda function during the stack update to diagnose the issue. What should the engineer do?

Accepted Answer

Access the CloudWatch Logs log group for the Lambda function. AWS Lambda automatically sends function execution logs to Amazon CloudWatch Logs. When a Lambda function is invoked during a CloudFormation stack update (e.g., via a custom resource or a function that runs as part of the update), all stdout, stderr, and logging statements are captured in a log group named /aws/lambda/<function-name>. Accessing this log group allows the engineer to view detailed error messages, stack traces, or timeout-related output that caused the 'Resource creation cancelled' failure.

Answer

Use AWS CodeBuild to build and test the function locally

Answer

Enable detailed CloudFormation logging in the stack template

Answer

Review the CloudFormation stack events in the AWS Management Console

Question 13

A DevOps engineer is designing an AWS Lambda function that needs to read secrets from AWS Secrets Manager. What is the most secure way to provide the Lambda function access to the secret?

Accepted Answer

Assign an IAM execution role to the Lambda function with a policy that allows secretsmanager:GetSecretValue on the specific secret.. The most secure approach is to give the Lambda function an IAM execution role whose policy grants secretsmanager:GetSecretValue scoped to the specific secret's ARN. Lambda assumes this role at runtime, so no credentials are stored in code or configuration, and the secret value is retrieved dynamically, allowing rotation without redeployment. This follows least privilege and avoids hardcoding secrets.

Answer

Store the secret in AWS Systems Manager Parameter Store and grant the Lambda function access to the parameter.

Answer

Encrypt the secret using AWS KMS and pass the encrypted value as an environment variable.

Answer

Store the secret in an environment variable in the Lambda function.

Question 14

A company wants to receive real-time notifications when their Auto Scaling group launches or terminates EC2 instances. Which AWS service should they use?

Accepted Answer

Amazon SNS notifications from the Auto Scaling group.. Auto Scaling groups natively support lifecycle hooks and notification configurations that publish events (EC2 Instance-launch, EC2 Instance-terminate, EC2 Instance-launch-lifecycle-action, etc.) directly to an Amazon SNS topic. This is the built-in, real-time mechanism designed specifically for launch/terminate notifications, requiring no polling or metric evaluation.

Answer

Amazon CloudWatch alarm on the GroupTotalInstances metric.

Answer

AWS Config rules to detect changes in Auto Scaling groups.

Answer

AWS CloudTrail to monitor Auto Scaling API calls.

Question 15

A company uses AWS CloudTrail to log all API calls. During an incident investigation, a security engineer needs to identify who deleted an S3 bucket named 'critical-data' two days ago. Which approach will provide the necessary information?

Accepted Answer

Use AWS CloudTrail LookupEvents API to search for DeleteBucket events.. CloudTrail records management events such as DeleteBucket, and the LookupEvents API allows programmatic search of the last 90 days of event history by event name, so it can identify who deleted the bucket two days ago. This is the intended mechanism for API-level auditing. The other options either lack the event detail, cover only data-plane access, or require prior configuration that is not guaranteed.

Answer

Check the AWS Management Console activity history.

Answer

Review the S3 access logs for the bucket.

Answer

Search CloudWatch Logs for 'DeleteBucket' events.