DOP-C02 Practice Test 34 — 15 Questions

Question 1

A development team uses AWS CodeBuild to compile a Java application. The build takes 15 minutes on average, but recently it started taking over 30 minutes. The buildspec.yml file is unchanged. What is the most likely cause?

Accepted Answer

The cache for the build project was cleared, forcing a full dependency download.. Option B is correct because CodeBuild caches dependencies and layers; clearing the cache may cause a full rebuild, increasing time. Option A is wrong because buildspec changes would affect time, but it's unchanged. Option C is wrong because environment type change would require a new build project, not just time increase. Option D is wrong because a smaller instance type would be slower, but that would be a known change.

Answer

The build environment was changed from a Linux to a Windows environment.

Answer

The build project's compute type was downgraded to a smaller instance.

Answer

The buildspec.yml file was updated to include more build commands.

Question 2

Which TWO actions can be used to improve the security of a CI/CD pipeline that uses AWS CodePipeline? (Choose two.)

Accepted Answer

Enable encryption for artifacts stored in the pipeline's S3 bucket.. Options A and D are correct. Enabling artifact encryption and using cross-account actions enhance security. Option B is wrong because using a single IAM role reduces security. Option C is wrong because polling is less secure than event-based triggers. Option E is wrong because storing secrets in plain text is insecure.

Answer

Configure the source action to poll for changes instead of using webhooks.

Answer

Store secrets in the pipeline environment variables in plain text.

Answer

Use a single IAM role for all pipeline actions to simplify permissions.

Question 3

An application running on Amazon ECS Fargate is experiencing intermittent HTTP 503 errors from the Application Load Balancer (ALB). The target group health checks are passing. Which configuration is MOST likely causing this issue?

Accepted Answer

The deregistration delay is set too short, causing connections to be closed before requests complete.. Option D is correct because a deregistration delay too short can cause the ALB to route traffic to a draining target, resulting in 503. Option A is wrong because health check interval being too short would cause flapping, not 503. Option B is wrong because slow start only affects new targets. Option C is wrong because circuit breaker doesn't cause 503s directly.

Answer

The ALB's slow start duration is too long, causing requests to be dropped.

Answer

The health check interval is set too low, causing targets to be marked unhealthy prematurely.

Answer

The ALB's circuit breaker is tripping due to high error rates.

Question 4

A development team is using AWS CodeCommit to store source code and AWS CodePipeline to automate builds and deployments. The team wants to ensure that builds and tests are triggered only when code is pushed to specific branches, and that manual approval is required before deploying to production. Which CodePipeline configuration should the team implement?

Accepted Answer

Configure the source action with a branch filter for main, and add a manual approval step before the production deployment stage.. Option D is correct because it uses a branch filter in the source action to trigger only on pushes to main, and a manual approval step before the production deployment stage. Options A and B trigger on all branches, and C filters on both source and build instead of just source.

Answer

Configure the source action to trigger on all branches and add a manual approval step before the build stage.

Answer

Configure the source action with a branch filter for main, and add a manual approval step before the build stage.

Answer

Use a branch filter on the build action to run only for the main branch, and add a manual approval step before the deploy stage.

Question 5

A company is implementing a CI/CD pipeline for a microservices architecture on Amazon ECS. The pipeline must deploy to multiple environments (dev, test, prod) in sequence with manual approval gates between environments. Which two AWS services should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS CodePipeline. Option A (CodePipeline) is correct because it orchestrates the pipeline stages. Option D (CodeDeploy) is correct because it handles the deployment to ECS with blue/green or rolling updates. Option B (CodeBuild) is for building, not deployment. Option C (CloudFormation) is for infrastructure, not deployment of microservices. Option E (Elastic Beanstalk) is a PaaS service, not suited for ECS microservices.

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Question 6

A development team uses AWS CodeCommit to store source code and AWS CodePipeline to automate builds and deployments. The team wants to ensure that every commit to the main branch triggers a build and deployment to a test environment. Which action should be taken?

Accepted Answer

Configure the source stage of the CodePipeline to use the CodeCommit repository and specify the main branch.. Option A is correct because CodePipeline can be configured with a source stage that uses CodeCommit to detect changes on a specific branch and automatically start the pipeline. Option B is wrong because CodeBuild does not monitor branches. Option C is wrong because CloudWatch Events can also trigger pipelines, but the simplest and direct method is configuring the source stage in CodePipeline. Option D is wrong because the pipeline itself needs to be triggered.

Answer

Create a CodeBuild project that watches the main branch and starts a pipeline.

Answer

Use AWS Lambda to poll the repository and start the pipeline on new commits.

Answer

Set up an Amazon CloudWatch Events rule that matches commits to the main branch and targets the CodePipeline.

Question 7

A company uses AWS CodeBuild to compile a Java application. The buildspec.yml includes a pre_build phase that runs unit tests and a build phase that packages the application. Recently, builds have been failing intermittently with 'OutOfMemoryError' during the test phase. The build environment is set to 'BUILD_GENERAL1_SMALL'. What is the MOST cost-effective solution?

Accepted Answer

Change the build environment to 'BUILD_GENERAL1_MEDIUM' which has more memory.. Option C is correct because it directly addresses the memory issue by increasing compute resources. Option A may not solve the problem if the test runner doesn't use the environment variable. Option B doesn't increase memory. Option D might not help if memory limit is per instance.

Answer

Split the tests into smaller batches using CodeBuild test splitting.

Answer

Configure the buildspec to set MAVEN_OPTS='-Xmx512m' to reduce JVM heap usage.

Answer

Use multiple CodeBuild jobs to run tests in parallel.

Question 8

A DevOps team is using AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer, an Auto Scaling group, and an RDS database. They want to update the stack to change the instance type of the Auto Scaling group without downtime. Which three steps should they take? (Choose THREE.)

Accepted Answer

Create a new Auto Scaling group with the new instance type and attach it to the load balancer, then delete the old group.. Option A is correct because using a rolling update with a pause before replacing instances minimizes downtime. Option C is correct because updating the launch template with the new instance type is necessary. Option D is correct because creating a new Auto Scaling group first allows a blue/green approach. Option B is wrong because terminating all instances at once causes downtime. Option E is wrong because modifying the RDS instance type is not part of the change.

Answer

Modify the RDS instance type to match the new EC2 instance type for consistency.

Answer

Terminate all instances in the Auto Scaling group before updating the launch configuration.

Question 9

An organization uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The deployment is failing consistently with the error 'ScriptMissing' for the AppSpec lifecycle hook 'ApplicationStop'. The scripts are located in the /opt/scripts directory on the instances. What is the most likely cause of this error?

Accepted Answer

The AppSpec file specifies a path to the script that does not exist on the instance.. Option B is correct because the AppSpec file must reference the exact location of scripts; if the path is incorrect, CodeDeploy will report ScriptMissing. Option A is wrong because permissions would cause a different error. Option C is wrong because the CodeDeploy agent version is unlikely to cause this specific error. Option D is wrong because hooks not defined would not cause ScriptMissing.

Answer

The ApplicationStop hook is not defined in the AppSpec file.

Answer

The CodeDeploy agent is not the latest version.

Answer

The scripts have incorrect file permissions.

Question 10

A DevOps engineer is setting up a CI/CD pipeline for a microservices architecture. The team uses AWS CodeCommit, CodeBuild, and CodeDeploy. The engineer needs to ensure that the pipeline can automatically roll back the deployment if the health checks fail after deployment. Which action should the engineer take?

Accepted Answer

Configure the deployment group to roll back when a CloudWatch alarm is triggered.. Option D is correct because CodeDeploy supports automatic rollback based on CloudWatch alarm triggers. Options A and B are manual steps. Option C only stops traffic, not rollback.

Answer

Use AWS Lambda to monitor health checks and trigger a rollback via the CodeDeploy API.

Answer

Set up the deployment group to use blue/green deployment with traffic shifting.

Answer

Configure the pipeline to have a manual approval step after deployment.

Question 11

A company uses AWS CodePipeline to automate their software release process. They want to add a stage that runs security scanning on the code before deployment. Which two AWS services can be integrated into the pipeline for this purpose? (Choose TWO.)

Accepted Answer

Amazon Inspector. Option A (CodeBuild) is correct because it can run custom security scanning tools. Option D (Amazon Inspector) is correct because it can be integrated as a test action to scan for vulnerabilities. Option B (CodeDeploy) is for deployment, not scanning. Option C (GuardDuty) is for threat detection in the AWS environment, not code scanning. Option E (Detective) is for analyzing security findings, not scanning code.

Answer

Amazon GuardDuty

Answer

Amazon Detective

Answer

AWS CodeDeploy

Question 12

A company uses AWS CloudFormation to manage infrastructure. The DevOps engineer wants to implement a CI/CD pipeline that builds and tests a CloudFormation template and then deploys it across multiple AWS accounts. Which combination of services should the engineer use?

Accepted Answer

Use CodePipeline with separate CodeBuild projects for validation and CloudFormation deployment actions assuming IAM roles in target accounts.. Option C is correct because CodePipeline can orchestrate cross-account deployments using CloudFormation deployment actions with cross-account roles. Option A lacks cross-account capability. Option B uses CodeDeploy for apps, not infrastructure. Option D uses Lambda, which is less suitable than CloudFormation for infrastructure.

Answer

Use CodeBuild to run cfn-lint and then use AWS Lambda to deploy stacks across accounts.

Answer

Use CodePipeline with CodeDeploy to deploy CloudFormation stacks across accounts.

Answer

Use CodePipeline with a single CodeBuild project to run cfn-lint and deploy to all accounts.

Question 13

A company uses AWS CodePipeline to orchestrate builds and deployments. The build stage uses CodeBuild to run unit tests and generate a report. The team wants to fail the pipeline if the test coverage drops below 80%. How should the engineer configure this?

Accepted Answer

Configure CodeBuild to fail the build if the test report indicates coverage below 80% using the buildspec's reports section.. Option B is correct because CodeBuild can be configured to fail based on test report criteria. Option A requires custom scripting. Option C uses CodePipeline condition, which is not for test reports. Option D is not a CodeBuild feature.

Answer

Add a post-build action in the buildspec that checks coverage and exits with non-zero if below threshold.

Answer

Enable CodeBuild's 'Test Reporting' feature and set a threshold in the CodeBuild project configuration.

Answer

Use a CodePipeline condition to check the test report artifact and fail the pipeline if coverage is low.

Question 14

A company uses AWS Systems Manager Patch Manager to patch EC2 instances. During a patching window, some instances fail to apply patches. The engineer checks the SSM Agent logs and sees 'ERROR: Failed to download patch files from the source.' What is the most likely cause?

Accepted Answer

The security group or NACL is blocking outbound HTTPS traffic (port 443).. The error 'Failed to download patch files from the source' indicates that the SSM Agent on the instance cannot reach the patch source repositories (e.g., Windows Update, Amazon Linux repos, or custom patch sources). Systems Manager Patch Manager requires outbound HTTPS (port 443) connectivity to download patch metadata and binaries. If a security group or NACL blocks this traffic, the download fails, producing this exact error in the agent logs.

Answer

The IAM instance profile does not grant ssm:UpdateInstanceInformation.

Answer

The SSM Agent is outdated.

Answer

The patch baseline is configured incorrectly.

Question 15

A company is implementing a blue/green deployment strategy for a microservice hosted on AWS Elastic Beanstalk. They want to minimize downtime and be able to quickly roll back in case of issues. The deployment must support traffic shifting gradually. Which configuration should they use?

Accepted Answer

Use a blue/green deployment with a Classic Load Balancer and swap environment URLs.. Option B is correct because Elastic Beanstalk blue/green deployments with a Classic Load Balancer allow traffic shifting by swapping environment URLs or adjusting DNS weights. Option A is wrong because rolling updates are not blue/green. Option C is wrong because immutable updates replace all instances at once, not gradual. Option D is wrong because canary deployments are not natively supported by Elastic Beanstalk without additional tools.

Answer

Use immutable updates with a fixed percentage of instances.

Answer

Use rolling updates with a batch size of 100%.

Answer

Use canary deployments by configuring the Elastic Load Balancer listener rules.