DOP-C02 Practice Test 33 — 15 Questions

Question 1

A company is implementing a CI/CD pipeline for a containerized application using AWS CodePipeline, CodeBuild, and Amazon ECS. The pipeline should automatically deploy to a staging environment and then, after manual approval, to production. The production environment uses an ECS service with rolling update deployment. Which TWO actions are necessary to achieve this?

Accepted Answer

Add a manual approval stage in CodePipeline between staging and production.. Option B is correct because a manual approval stage is needed between staging and production. Option D is correct because the ECS deploy action in CodePipeline can perform rolling updates. Option A is not necessary; CodeBuild can push to ECR directly. Option C is not required for rolling update. Option E is incorrect because CodePipeline does not support CloudFormation for ECS rolling updates directly.

Answer

Use CloudFormation to deploy the ECS service with a rolling update policy.

Answer

Set up an ECS task definition with a sidecar container for health checks.

Answer

Configure CodeBuild to push the Docker image to Amazon ECR.

Question 2

A team wants to automate the deployment of a serverless application using AWS SAM. They have a template.yaml file defining Lambda functions, an API Gateway, and a DynamoDB table. Which command should they use to build and deploy the application?

Accepted Answer

sam build && sam deploy. Option A is correct because 'sam build' compiles the application and 'sam deploy' deploys it. Option B is wrong because 'aws cloudformation deploy' does not build the SAM artifacts. Option C is wrong because 'sam package' only packages code; it does not build or deploy. Option D is wrong because 'sam deploy --guided' is interactive and not suitable for automation.

Answer

aws cloudformation deploy --template-file template.yaml

Answer

sam package --output-template-file packaged.yaml

Answer

sam deploy --guided

Question 3

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a script on all instances that have a specific tag 'Environment:Development'. Which Systems Manager capability should be used?

Accepted Answer

Run Command. Option C is correct. Run Command allows you to remotely and securely run commands on instances. It can target instances by tags. State Manager is for maintaining consistent state, Patch Manager for patching, and Inventory for collecting metadata. Run Command is the appropriate tool for ad-hoc script execution.

Answer

Inventory

Answer

Patch Manager

Answer

State Manager

Question 4

A company uses Chef for configuration management of their EC2 instances. They want to use AWS OpsWorks for Chef Automate to manage the Chef server. What is the primary benefit of using OpsWorks for Chef Automate compared to running a self-managed Chef server?

Accepted Answer

It reduces operational overhead by managing the Chef server's infrastructure.. Option B is correct. OpsWorks for Chef Automate is a managed service that handles the Chef server maintenance, patching, and high availability. It integrates with AWS services like CloudWatch and IAM. Option A is incorrect because OpsWorks does not provide a GUI for cookbooks; Chef has its own tools. Option C is incorrect because OpsWorks manages the server, not the nodes' cookbooks. Option D is incorrect because OpsWorks does not automatically create cookbooks; they must be developed by the user.

Answer

It provides a graphical user interface to author cookbooks.

Answer

It creates cookbooks based on the instance configuration.

Answer

It automatically applies cookbooks to all instances in the account.

Question 5

A company is using AWS CodeDeploy with a blue/green deployment strategy for an Amazon ECS service. After a deployment, the new task set fails health checks, and CodeDeploy automatically rolls back to the original task set. However, the rollback fails because the original task set's desired count is set to 0. What is the most likely cause?

Accepted Answer

The original task set's desired count was set to 0 during the blue/green deployment and the rollback is unable to restore it because the original task definition is no longer available.. Option D is correct because during a blue/green deployment, the original task set's desired count is often scaled down to zero, and rollback tries to restore it but may fail if the original task definition or service configuration is no longer valid. Option A is wrong because CodeDeploy manages ECS service updates, not through CloudFormation. Option B is wrong because the issue is not about deregistering from the target group; it's about scaling. Option C is wrong because health checks are failing on the new task set, not the original.

Answer

The original task set's health checks are failing.

Answer

The original task set's CloudFormation stack was deleted during the deployment.

Answer

The original task set was deregistered from the target group.

Question 6

A DevOps engineer needs to automate the creation of an AWS CodeStar project for a new microservice. The engineer wants to use AWS CloudFormation to define the project and its resources. Which CloudFormation resource should be used?

Accepted Answer

AWS::CodeStar::Project. Option A is correct because AWS::CodeStar::Project is the CloudFormation resource for creating a CodeStar project. Option B is wrong because AWS::ServiceCatalog::CloudFormationProduct is for Service Catalog products. Option C is wrong because AWS::CodePipeline::Pipeline creates a pipeline, not a CodeStar project. Option D is wrong because AWS::CodeBuild::Project creates a build project, not a CodeStar project.

Answer

AWS::ServiceCatalog::CloudFormationProduct

Answer

AWS::CodePipeline::Pipeline

Answer

AWS::CodeBuild::Project

Question 7

Which THREE considerations are important when designing a CI/CD pipeline for a microservices architecture using AWS CodePipeline? (Choose three.)

Accepted Answer

Include automated integration tests that validate service-to-service interactions.. Options A, C, and E are correct. Independent pipelines, automated testing, and blue/green deployments are key. Option B is wrong because a monolith pipeline contradicts microservices. Option D is wrong because manual gates slow down deployment.

Answer

All microservices should be deployed using a single pipeline to ensure consistency.

Answer

Use manual approval gates at every stage to ensure quality.

Question 8

A company uses AWS CloudFormation StackSets to deploy a common security baseline across multiple AWS accounts. They have a new account that needs to be added to the StackSet. The StackSet is configured with self-service permissions and uses a service-managed IAM role. What must be done to include the new account?

Accepted Answer

Add the new account to the AWS Organization.. Option D is correct. With service-managed permissions, StackSets use AWS Organizations to automatically manage accounts. You simply need to add the account to the organization, and StackSets can deploy to it. Option A is incorrect because StackSets can deploy to new accounts without manual stack instance creation if using Organizations. Option B is incorrect because creating a new StackSet is unnecessary. Option C is incorrect because the IAM role is managed by StackSets.

Answer

Create an IAM role in the new account that trusts the StackSet.

Answer

Create a new StackSet that includes the new account.

Answer

Manually create a stack instance for the new account in the StackSet.

Question 9

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack creation. The stack creates an EC2 instance with a user data script that runs a configuration management tool. The instance launches successfully, but the user data script fails. How can the engineer retrieve the user data execution logs to debug the issue?

Accepted Answer

Access the instance via EC2 Instance Connect and check /var/log/cloud-init-output.log.. Option A is correct. User data scripts run as root, and the output is typically logged to /var/log/cloud-init-output.log on Linux instances. Option B is incorrect because CloudTrail does not capture user data execution logs. Option C is incorrect because Systems Manager Run Command is not used to retrieve logs from user data. Option D is incorrect because CloudWatch Logs agent must be configured in the user data to send logs; it is not automatically enabled.

Answer

Use AWS CloudTrail to view the user data execution events.

Answer

Use AWS Systems Manager Run Command to retrieve the logs remotely.

Answer

Check the CloudWatch Logs group for the instance.

Question 10

A team is using AWS CodeCommit as their version control system. They want to ensure that all commits are signed with a GPG key. What is the simplest way to enforce this?

Accepted Answer

Enable the 'Require signed commits' option in the CodeCommit repository settings.. Option C is correct because CodeCommit supports repository-level policies that can require signed commits. Option A is wrong because IAM policies cannot enforce signed commits at the repository level. Option B is wrong because pre-commit hooks are client-side and can be bypassed. Option D is wrong because CloudTrail logs actions but does not enforce signing.

Answer

Use AWS CloudTrail to monitor unsigned commits and automatically revert them.

Answer

Use a pre-commit hook in the local repository to enforce signing.

Answer

Configure an IAM policy that denies PutFile if the commit is not signed.

Question 11

Which TWO AWS services can be used as source actions in AWS CodePipeline to automatically trigger a pipeline when changes are made? (Choose two.)

Accepted Answer

Amazon S3. Options A and C are correct. CodeCommit and S3 can serve as source actions. Option B is wrong because EC2 is not a source action. Option D is wrong because CloudWatch is a monitoring service, not a source. Option E is wrong because CloudFormation is an infrastructure provisioning service.

Answer

Amazon CloudWatch

Answer

Amazon EC2

Answer

AWS CloudFormation

Question 12

An organization uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The engineer reviews the deployment logs and finds that the AppSpec file is correctly formatted and the scripts run successfully on some instances. What is the MOST likely cause?

Accepted Answer

The health check grace period for the Auto Scaling group is too short.. Option B is correct because if health check grace period is too short, instances might be marked unhealthy before the application starts. Option A would affect all instances. Option C would cause consistent failures. Option D might not cause instance failure.

Answer

The CodeDeploy agent is not installed on some instances.

Answer

The target group is not configured to route traffic to the instances.

Answer

The IAM role assigned to the EC2 instances does not have sufficient permissions.

Question 13

A company uses AWS Elastic Beanstalk with a custom platform. They need to update the platform version to include a new security patch. Which approach should be used to create a new custom platform version?

Accepted Answer

Create a new platform version using the aws elasticbeanstalk create-platform-version command with an updated platform definition file.. Option D is correct. Custom platforms are created by packaging a platform definition file (a .zip) and using the aws elasticbeanstalk create-platform-version command. The platform definition includes the AMI ID and other configuration. Option A is incorrect because you cannot update an existing platform; you must create a new version. Option B is incorrect because you cannot directly modify the AMI in the existing platform. Option C is incorrect because Beanstalk does not automatically rebuild platforms; you need to create a new version.

Answer

Use the Elastic Beanstalk CLI to rebuild the platform with the new AMI.

Answer

Launch a new EC2 instance, apply the patch, and create an AMI, then update the platform version.

Answer

Modify the existing platform version's AMI ID using the Elastic Beanstalk console.

Question 14

An organization uses AWS CodePipeline to deploy a web application to Amazon EC2 instances behind an Application Load Balancer. The deployment uses a CodeDeploy action with an in-place deployment configuration. After a recent deployment, some instances are running the old version while others are running the new version. What is the most likely cause?

Accepted Answer

The deployment group was configured with the 'AllAtOnce' deployment configuration, and the deployment failed partway through.. Option A is correct because if the deployment group is set to deploy to all instances at once (AllAtOnce), there is no rolling update, and if the deployment fails partway, some instances may be updated and others not. Option B is wrong because a lifecycle hook would not cause partial deployment; it would pause. Option C is wrong because CodeDeploy does not depend on Auto Scaling for in-place deployments. Option D is wrong because a failed health check would cause the deployment to fail entirely, not partially.

Answer

The deployment group is associated with an Auto Scaling group that launched new instances during the deployment.

Answer

A lifecycle hook is configured to pause the deployment until manual approval.

Answer

The deployment was configured to use a blue/green strategy, but the target group is misconfigured.

Question 15

A CloudFormation template includes the following resource:

MySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: My security group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0abcdef1234567890
      InstanceType: t2.micro
      SecurityGroupIds: !Ref MySecurityGroup

The stack creation fails with the error shown. What is the cause?

Accepted Answer

The SecurityGroupIds property must be a list, but !Ref returns a single value.. Option C is correct. The SecurityGroupIds property expects a list of security group IDs, but the !Ref MySecurityGroup returns a single string (the security group ID). To pass a list, you must use !Sub or a list literal like [!Ref MySecurityGroup]. Option A is incorrect because the security group definition is correct. Option B is incorrect because security groups can be referenced by ID. Option D is incorrect because the error is about format, not missing property.

Answer

The SecurityGroupIds property must be a list of security group names, not IDs.

Answer

The security group ingress rule is invalid because it allows all traffic.

Answer

The ImageId is missing, so the security group validation fails first.