DOP-C02 Practice Test 34 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a failed CodeBuild project. The build fails with an error: 'Access Denied: Unable to put object to S3.' The build project has an S3 bucket as the artifact store. What should the engineer do to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add s3:PutObject permission to the CodeBuild service role for the artifact bucket.. The error 'Access Denied: Unable to put object to S3' indicates the CodeBuild service role lacks s3:PutObject permission on the artifact bucket. CodeBuild assumes this role to upload build artifacts, so the fix is to attach an IAM policy granting s3:PutObject (and typically s3:GetBucketLocation, s3:ListBucket) for the artifact bucket to the CodeBuild service role.

Answer

Enable server-side encryption on the artifact bucket.

Answer

Enable CloudWatch Logs for the build project.

Answer

Add s3:GetObject permission to the CodeBuild service role for the source bucket.

Question 2

A company uses AWS Elastic Beanstalk to deploy a web application. They have set up a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from GitHub (using the GitHub source action) and a deploy stage that deploys to Elastic Beanstalk. The deployment is configured to use the 'Immutable' deployment policy. Recently, the deployment started failing with the error: 'The environment is in an unhealthy state. The deployment failed.' The developer checks the Elastic Beanstalk environment and sees that the new instances are not passing health checks. The application logs show that the new instances cannot connect to the existing Amazon RDS database. What is the most likely cause?

Accepted Answer

The security group attached to the Elastic Beanstalk environment does not allow the new instances to connect to the RDS database.. With the Immutable deployment policy, Elastic Beanstalk launches a fresh set of instances in a new Auto Scaling group; if those new instances cannot reach the RDS database, the most likely cause is that the environment's security group (or the RDS security group's inbound rules) does not permit the new instances to connect. Since the old instances worked, a security group rule scoped to the old instances or a missing rule for the new group is the classic culprit.

Answer

The RDS database is not available because it is being updated during the deployment.

Answer

The deployment policy should be changed to 'Rolling' to ensure instances are updated in place.

Answer

The application code has a bug that causes the health check to fail.

Question 3

A company uses AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yml includes a 'post_build' phase command to tag the image. The build fails with 'unauthorized: authentication required'. What must be done to resolve this?

Accepted Answer

Add 'ecr:InitiateLayerUpload' and 'ecr:CompleteLayerUpload' permissions to the CodeBuild service role.. The error 'unauthorized: authentication required' indicates that CodeBuild's IAM role lacks the necessary permissions to push the Docker image to Amazon ECR. The correct resolution is to add the specific ECR permissions 'ecr:InitiateLayerUpload' and 'ecr:CompleteLayerUpload' to the CodeBuild service role, as these are required for the Docker push operation to upload image layers. Without these permissions, the ECR API rejects the push even if other permissions like 'ecr:GetAuthorizationToken' are present.

Answer

Use the 'docker login' command with AWS CLI in the build phase.

Answer

Install the AWS CLI in the CodeBuild build environment.

Answer

Create a new IAM user with ECR permissions and store the keys in CodeBuild environment variables.

Question 4

Which THREE steps are required to set up a continuous deployment pipeline using AWS CodePipeline that deploys a Docker-based application to Amazon ECS? (Choose three.)

Accepted Answer

Create a source stage that uses AWS CodeCommit as the source provider. AWS CodePipeline requires a source stage to detect changes in the source code repository. AWS CodeCommit is a fully managed source control service that integrates natively with CodePipeline, allowing automatic pipeline execution when new commits are pushed to the specified branch. This is a fundamental step in establishing a continuous delivery workflow.

Answer

Create a deploy stage that uses AWS CodeDeploy to deploy to Amazon ECS

Answer

Create an invoke stage that uses AWS Lambda to update the ECS service

Question 5

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the 'ValidateService' lifecycle event. The CloudWatch Agent reports that the target process is running but the health check endpoint returns HTTP 503. The CodeDeploy agent logs show no errors. What is the most likely cause of the failure?

Accepted Answer

The application is not fully functional due to missing configuration files. The 'ValidateService' lifecycle event in CodeDeploy runs a health check against the application endpoint. A 503 HTTP status indicates the web server is running (the target process is up) but the application itself is not fully functional, often due to missing configuration files, environment variables, or dependencies. The CloudWatch Agent confirming the process is running and the CodeDeploy agent logs showing no errors further isolate the issue to the application layer, not the deployment infrastructure.

Answer

The Auto Scaling group is not healthy

Answer

The CodeDeploy agent is not installed on the instances

Answer

The target process is not listening on the expected port

Question 6

A company uses AWS CloudFormation StackSets to deploy a VPC across multiple AWS accounts in AWS Organizations. The StackSet is created with self-managed permissions. The deployment fails in some accounts with the error: 'Insufficient IAM permissions to create resources'. What is the most likely cause of this failure?

Accepted Answer

The execution IAM role is not created in the target accounts. With self-managed permissions in AWS CloudFormation StackSets, the administrator account does not automatically create the necessary IAM roles in target accounts. The execution IAM role must be manually created in each target account to grant StackSets the permissions required to create resources. The error 'Insufficient IAM permissions to create resources' directly indicates that this execution role is missing or lacks the required policies.

Answer

The StackSet does not support deploying to more than one account

Answer

The administrator account does not have a service-linked role for StackSets

Answer

The target accounts have reached their resource service quotas

Question 7

A developer wants to automatically deploy a new version of an AWS Lambda function whenever code is pushed to a specific branch in AWS CodeCommit. Which combination of services should be used?

Accepted Answer

AWS CodeCommit, Amazon EventBridge, AWS CodePipeline. AWS CodePipeline can be configured with a source stage that uses AWS CodeCommit as the source provider, and an Amazon EventBridge rule can detect push events to a specific branch in CodeCommit. When a push occurs, EventBridge triggers the pipeline execution, which then deploys the new Lambda function version automatically. This combination provides a fully managed, event-driven CI/CD pipeline for Lambda deployments.

Answer

AWS CodeCommit, Amazon S3, AWS Lambda

Answer

AWS CodeCommit, AWS CodeBuild

Answer

AWS CodeCommit, Amazon CloudWatch Logs

Question 8

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all new member accounts automatically receive a specific AWS Config rule to require encryption on Amazon EBS volumes. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a stack with the Config rule to all existing and new accounts.. AWS CloudFormation StackSets can deploy a stack containing the AWS Config rule across all accounts in the organization, and with automatic deployment enabled, new accounts automatically receive the stack. This centrally manages the rule with minimal operational overhead. Option B is incorrect because SCPs only deny API actions and cannot deploy a Config rule; they would need a separate mechanism to deploy the rule initially.

Answer

Use an SCP to deny the creation of unencrypted EBS volumes and use AWS Config to detect noncompliant volumes.

Answer

Use a service control policy (SCP) to deny the ability to disable the AWS Config rule and use a custom AWS Config rule that evaluates EBS encryption.

Answer

Use an AWS Config aggregator in the management account to monitor compliance across accounts.

Question 9

A company uses AWS CloudFormation to deploy infrastructure. A recent stack update failed, and the engineer needs to roll back to the previous stable state. Which CloudFormation feature should the engineer use?

Accepted Answer

Use the 'Rollback' action in the CloudFormation console.. CloudFormation provides a built-in 'Rollback' action that automatically reverts a stack to its last known stable state when a stack update fails. This rollback occurs by default on failure, but if the engineer needs to manually trigger it after a failed update, they can use the 'Rollback' action in the CloudFormation console or API (e.g., `aws cloudformation rollback-stack`). This ensures the infrastructure returns to the previous working configuration without manual intervention.

Answer

Use AWS CloudFormation Drift Detection.

Answer

Use AWS CloudFormation StackSets.

Answer

Create a Change Set and execute it.

Question 10

Which TWO actions are best practices when designing a CI/CD pipeline for a containerized application on Amazon ECS? (Choose two.)

Accepted Answer

Separate the build stage from the deploy stage in the pipeline.. Separating the build stage from the deploy stage in a CI/CD pipeline for Amazon ECS ensures that the Docker image is built, tested, and validated independently before being promoted to production. This decoupling allows you to reuse the same immutable artifact across multiple environments (e.g., dev, staging, prod), reducing the risk of environment-specific build inconsistencies and enabling rollback to a known good image.

Answer

Run a full integration test suite on every commit to the repository.

Answer

Build the Docker image in the deploy stage to ensure consistency.

Answer

Use a rolling update with a fixed number of tasks for deployment.

Question 11

A company uses AWS CloudFormation to manage its infrastructure. The operations team needs to update a stack that includes an RDS database. The update requires changing the DB instance class, which will cause a replacement of the database. The team wants to minimize downtime and ensure that data is not lost. Which CloudFormation stack update policy should they use?

Accepted Answer

Set the UpdatePolicy to AutoScalingReplacingUpdate with WillReplace set to true.. The UpdatePolicy attribute with AutoScalingReplacingUpdate is only supported for AWS::AutoScaling::AutoScalingGroup resources, not for AWS::RDS::DBInstance. Therefore, option D is incorrect. Options A and C are also invalid (CreationPolicy is for signal-based creation, and AutoScalingRollingUpdate is for rolling updates on Auto Scaling groups). Option B, Stack Policy, can protect resources from being updated but does not control how a replacement occurs to minimize downtime or prevent data loss. Thus, none of the provided options are correct for ensuring minimal downtime and data safety during an RDS instance class change that requires replacement.

Answer

Set the CreationPolicy attribute on the database resource.

Answer

Configure a Stack Policy to protect the database resource.

Answer

Set the UpdatePolicy to AutoScalingRollingUpdate.

Question 12

A company uses AWS CloudTrail to monitor API activity. The security team notices that an IAM user 'dev-user' deleted an S3 bucket. They need to quickly identify the source IP address of the delete request. Which CloudTrail feature should they use to find this information?

Accepted Answer

Search the CloudTrail event history for the delete event and review the sourceIPAddress field.. CloudTrail Event History retains 90 days of management events and each event record includes a sourceIPAddress field that captures the IP address from which the API call was made. Searching Event History for the DeleteBucket event and inspecting sourceIPAddress is the fastest way to identify the source IP without additional setup.

Answer

Use CloudTrail Lake to query the event and extract the IP address from the userIdentity field.

Answer

Check S3 server access logs for the bucket deletion event.

Answer

Enable CloudTrail Insights to analyze unusual activity.

Question 13

A company hosts a static website on Amazon S3 with a CloudFront distribution. The website is critical for business operations and must be available even if the primary AWS Region fails. Currently, the S3 bucket is in us-east-1, and CloudFront uses that bucket as the origin. The company has a secondary bucket in us-west-2 with a replica of the data. The company wants to use CloudFront to automatically fail over to the secondary bucket if the primary becomes unavailable. The DevOps engineer needs to implement a solution that requires minimal operational overhead. What should the engineer do?

Accepted Answer

Configure CloudFront Origin Failover by adding both buckets as origins, with the primary in us-east-1 and secondary in us-west-2.. CloudFront Origin Failover is a native feature that allows you to designate a primary and secondary origin within a single distribution; CloudFront automatically routes requests to the secondary origin when the primary returns specific error codes (e.g., 500, 502, 503, 504) or fails health checks. This requires no additional infrastructure, no DNS changes, and no custom code, making it the lowest-operational-overhead solution. It directly meets the requirement of automatic failover to the us-west-2 bucket.

Answer

Use an Application Load Balancer in front of both S3 buckets and point CloudFront to the ALB.

Answer

Create a second CloudFront distribution pointing to the secondary bucket and use Route 53 failover routing between the two distributions.

Answer

Modify the application to switch the CloudFront origin URL using Lambda@Edge when health checks fail.

Question 14

A DevOps team is troubleshooting a performance issue where an Amazon RDS for PostgreSQL instance's CPU utilization spikes every hour. The team suspects a specific query from an application. Which combination of tools can identify the problematic query?

Accepted Answer

Amazon RDS Performance Insights and Enhanced Monitoring.. Amazon RDS Performance Insights is purpose-built to visualize database load (DBLoad) broken down by SQL statement, wait event, and user, so it can pinpoint the exact query causing hourly CPU spikes. Enhanced Monitoring provides OS-level metrics (per-process CPU, memory, disk I/O) at up to 1-second granularity, letting the team correlate the spike with the specific PostgreSQL backend process. Together they identify both the offending SQL and the resource it consumes.

Answer

CloudWatch Logs Insights and CloudWatch metrics.

Answer

VPC Flow Logs and Lambda.

Answer

CloudTrail and CloudWatch alarms.

Question 15

Refer to the exhibit. An IAM policy is attached to a user. A developer tries to upload an object to s3://my-bucket/confidential/report.pdf without specifying server-side encryption. What will happen?

Accepted Answer

The upload fails because the Deny statement requires SSE-KMS.. The upload fails because the Deny statement in the IAM policy explicitly denies the s3:PutObject action unless the request includes the s3:x-amz-server-side-encryption header with a value of 'aws:kms'. When the developer does not specify server-side encryption, the condition is not met, so the Deny applies, causing the upload to fail. Option A is incorrect because the Allow statement does not override an explicit Deny. Option B is incorrect because the condition key is correct; the failure is due to the missing encryption header. Option D is incorrect because the Deny is not based on the object name prefix; it applies to all objects in the bucket.

Answer

The upload succeeds because the Allow statement grants PutObject.

Answer

The upload succeeds because the Deny condition uses a wrong condition key.

Answer

The upload fails only if the object name matches the prefix.