DOP-C02 Practice Test 35 — 15 Questions

Question 1

A company uses AWS CodeCommit for source control and wants to enforce that all commits to the main branch are signed. The DevOps team has configured Git commit signing using GPG keys. However, some developers are able to push unsigned commits to main. What should the engineer do to enforce signed commits?

Accepted Answer

Use an AWS CodeCommit trigger with an AWS Lambda function that validates commit signatures and rejects unsigned commits.. Option C is correct because CodeCommit repository policies can require commit signing. Option A does not enforce signing. Option B is not a repository setting. Option D is a CodeCommit feature for notifications, not enforcement.

Answer

Set the 'requireSignedCommits' parameter in the repository configuration to 'true'.

Answer

Configure branch protection rules in IAM to deny push access to main unless the commit is signed.

Answer

Create a repository policy that denies git push actions unless the condition 'codecommit:References' and 'codecommit:SourceIp' match.

Question 2

A company uses AWS CloudFormation to deploy a web application across multiple AWS accounts using StackSets. The DevOps team notices that stack instance updates are failing in some accounts with the error: 'Insufficient IAM permissions to perform the action'. The team has already verified that the StackSet IAM role has the necessary permissions. What is the most likely cause of this issue?

Accepted Answer

The target accounts do not have the necessary trust policy to allow the StackSet IAM role to assume the execution role.. Option B is correct because StackSets require that the target accounts have a trust policy allowing the StackSet IAM role to assume a role in those accounts. Option A is wrong because the error is about permissions, not limit. Option C is wrong because the stack set name is not relevant. Option D is wrong because SCPs can block permissions even if the IAM role has them.

Answer

The target accounts have reached the limit of 200 stacks per region.

Answer

AWS Organizations has a service control policy (SCP) that denies the required action, but the StackSet IAM role has full admin permissions.

Answer

The StackSet name contains invalid characters that are not allowed in some accounts.

Question 3

A team uses AWS CodeBuild to build Docker images and push them to Amazon ECR. The buildspec.yml includes a post_build step that runs a security scan. The team wants to ensure that only images that pass the security scan are tagged as 'latest'. Which approach should be used?

Accepted Answer

In the post_build phase, run the security scan, and if it passes, tag the image with 'latest' and push.. Option A is correct because it tags the image only after successful scan. Option B tags before scan. Option D tags all images, not just passing. Option C uses ECR lifecycle, not relevant.

Answer

Build the image with the 'latest' tag first, then run the security scan. If it fails, delete the 'latest' tag.

Answer

Use ECR lifecycle policies to remove images that do not pass the security scan.

Answer

Tag the image with 'latest' only after the build phase, regardless of scan results.

Question 4

A DevOps engineer is building a CI/CD pipeline for a PHP application that uses Amazon RDS for MySQL. The pipeline must run database migrations as part of the deployment. The team wants to ensure that if a migration fails, the deployment is rolled back and the database is restored to its previous state. Which THREE steps should the engineer implement?

Accepted Answer

Take a snapshot of the RDS database before the migration.. Option A is correct because a snapshot provides a restore point. Option B is correct because CodeDeploy can run scripts, including migration scripts. Option D is correct because rollback can be configured in CodeDeploy. Option C is not typically used for database migrations. Option E is not a standard practice for rollback.

Answer

Use CloudFormation with a custom resource to run the migration.

Answer

Use AWS Database Migration Service (DMS) to replicate the database continuously.

Question 5

A DevOps team is designing an incident response plan for a critical microservices architecture. They need to automatically collect and analyze logs from all services during an incident. Which solution should they use?

Accepted Answer

Centralize logs in Amazon CloudWatch Logs and use CloudWatch Logs Insights for real-time querying.. Option B is correct because CloudWatch Logs Insights allows querying across log groups. Option A is wrong because S3 is storage, not real-time analysis. Option C is wrong because Kinesis Data Firehose is for streaming to destinations, not analysis. Option D is wrong because Systems Manager Run Command is for ad-hoc commands.

Answer

Stream logs to Amazon Kinesis Data Firehose and analyze with Amazon OpenSearch Service.

Answer

Store logs in Amazon S3 and use Amazon Athena to query them.

Answer

Use AWS Systems Manager Run Command to execute log collection scripts on each instance.

Question 6

Refer to the exhibit. An IAM policy is attached to a CodePipeline service role. When the pipeline tries to start a CodeBuild project, it fails with an 'AccessDenied' error. The CodeBuild project uses a different service role (arn:aws:iam::123456789012:role/CodeBuildServiceRole2). What is the MOST likely cause?

Accepted Answer

The policy only allows iam:PassRole for a specific role ARN, but the CodeBuild project uses a different role.. Option B is correct because the policy explicitly allows iam:PassRole only for one specific role ARN. Since the CodeBuild project uses a different role, the pass role fails. Option A is incorrect because codebuild:StartBuild is allowed. Option C is incorrect because the policy allows s3:GetObject. Option D is incorrect because the policy does not have a condition on s3 actions.

Answer

The policy has a condition on the s3 actions that is not satisfied.

Answer

The policy does not allow codebuild:StartBuild for the specific project.

Answer

The policy does not allow s3:GetObject on the artifact bucket.

Question 7

A DevOps engineer is designing a deployment pipeline for a microservices application on Amazon ECS. The team wants to use blue/green deployments with automatic rollback if CloudWatch alarms are triggered during the deployment. Which combination of services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with a blue/green deployment configuration on the ECS service, and configure automatic rollback when CloudWatch alarms are breached.. Option D is correct because CodeDeploy supports blue/green deployments on ECS with automatic rollback based on CloudWatch alarms. Option A is wrong because ECS service auto scaling is for scaling, not deployment. Option B is wrong because CloudFormation does not natively support blue/green with automatic rollback based on alarms. Option C is wrong because CodeBuild is for building, not deploying.

Answer

Use AWS CloudFormation with a ChangeSet and a custom rollback Lambda function triggered by CloudWatch alarms.

Answer

Use AWS CodeBuild to run a build that creates a new task definition, then update the ECS service manually, and use CloudWatch alarms to trigger a rollback via a Lambda function.

Answer

Use Amazon ECS service auto scaling with step scaling policies based on CloudWatch alarms.

Question 8

During an incident, an engineer needs to quickly revoke access to a compromised IAM user. Which action should be taken FIRST?

Accepted Answer

Attach an AWS managed policy that explicitly denies all actions (e.g., AWSDenyAll).. Option B is correct because attaching a deny-all policy immediately blocks all actions. Option A is wrong because deleting the user may fail if there are dependencies. Option C is wrong because signing certificates are only for programmatic access, not console. Option D is wrong because rotating keys does not revoke existing sessions.

Answer

Delete the IAM user immediately.

Answer

Disable the user's signing certificates.

Answer

Rotate the user's access keys.

Question 9

Refer to the exhibit. A CodeBuild project uses this buildspec.yml to build and push a Docker image to Amazon ECR. The build fails at the pre_build phase with the error 'Error: Cannot perform an interactive login from a non TTY device'. What is the MOST likely issue?

Accepted Answer

The CodeBuild project's IAM role does not have permission to call ecr:GetAuthorizationToken.. Option C is correct because aws ecr get-login-password outputs the password to stdout, and docker login reads from stdin. The pipe (|) should work. However, the error indicates that docker login is trying interactive mode, which suggests that the command is not receiving the password correctly. But the real issue is that the ECR login command requires AWS credentials, and if the CodeBuild project does not have proper permissions to call ecr:GetAuthorizationToken, it will fail. Option A is not relevant because the error is about interactive login. Option B is not the cause. Option D is incorrect because the region is specified via environment variable.

Answer

The AWS_DEFAULT_REGION environment variable is not set in CodeBuild.

Answer

The buildspec.yml is missing the 'docker login' command.

Answer

The Docker daemon is not running on the CodeBuild instance.

Question 10

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a Source stage from CodeCommit and a Deploy stage that syncs the contents to an S3 bucket. The deployment fails intermittently with a 'BucketNotEmpty' error. What is the most likely cause?

Accepted Answer

The S3 bucket has versioning enabled, and the deploy action is trying to delete the bucket before syncing.. Option B is correct because the error 'BucketNotEmpty' indicates the bucket has versioning enabled and the sync command does not delete previous versions. Option A is wrong because S3 bucket policies do not cause this error. Option C is wrong because CodePipeline does not enforce bucket deletion. Option D is wrong because the source stage is unrelated to the bucket's state.

Answer

The source artifact from CodeCommit contains a 'delete' manifest that instructs S3 to remove all files.

Answer

The CodePipeline service role does not have permission to list the bucket contents.

Answer

The S3 bucket has a bucket policy that denies DeleteObject permissions.

Question 11

Refer to the exhibit. A CloudTrail log shows a failed GitPush event to a CodeCommit repository by the IAM user 'jenkins'. The DevOps engineer has attached the following IAM policy to the user: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "codecommit:*",
      "Resource": "*"
    }
  ]
}
What is the MOST likely reason for the failure?

Accepted Answer

The user has not generated a Git credential for CodeCommit in the IAM console.. Option C is correct because CodeCommit requires an inline policy or managed policy to allow Git operations, but the user may be trying to push using HTTPS with a Git credential that is not associated with the IAM user, or the SSH key is not configured. However, the error says the user is not authorized, which suggests that the IAM policy is not effective because CodeCommit requires a specific Git credentials or SSH key to authenticate, not just an IAM policy. Actually, the IAM policy should allow the action. The most common issue is that the user has not created a Git credential in IAM for CodeCommit. Option A is about permissions boundary. Option B is about IP restriction. Option D is about HTTPS vs SSH.

Answer

The user is trying to push via HTTPS but the repository only allows SSH.

Answer

The user's IAM policy includes a condition that restricts access based on source IP, and the push originates from a different IP.

Answer

The policy is attached but the user has a permissions boundary that denies codecommit:GitPush.

Question 12

A team uses AWS CloudFormation to manage infrastructure. They want to automatically update the stack when a new version of a Docker image is pushed to Amazon ECR. Which approach should they use?

Accepted Answer

Configure an Amazon EventBridge rule to detect ECR image pushes and invoke an AWS Lambda function that calls 'UpdateStack' with the new image URI.. Option C is correct because Amazon ECR events can trigger a Lambda function that updates the CloudFormation stack. Option A is wrong because CodeBuild does not directly update CloudFormation stacks. Option B is wrong because CodeDeploy does not update CloudFormation stacks. Option D is wrong because Amazon SNS cannot directly update CloudFormation stacks.

Answer

Create a CodeBuild project that triggers on ECR push, and have the build execute an 'aws cloudformation update-stack' command.

Answer

Use AWS CodeDeploy with a trigger on ECR push to deploy the new image to a target group, and have the target group update the stack.

Answer

Set up an Amazon SNS topic subscribed to ECR image push events, and have the SNS topic send a notification to an AWS CloudFormation stack update endpoint.

Question 13

A DevOps team is designing a configuration management solution for a microservices architecture running on Amazon ECS. The team wants to ensure that container configurations are automatically updated when a new version of a parameter is stored in AWS Systems Manager Parameter Store. Which approach best meets this requirement with minimal operational overhead?

Accepted Answer

Use AWS AppConfig to create a configuration profile that references the parameter. Configure a Lambda function as a validator and deploy strategy. When the parameter changes, AppConfig triggers a deployment that updates the ECS service.. Option A is correct because using AWS AppConfig with a Lambda function to trigger an ECS service update is a native, managed solution. Option B is wrong because it does not automatically update running containers. Option C is wrong because it requires manual steps. Option D is wrong because CloudWatch Events cannot directly update ECS services.

Answer

Use an AWS CloudFormation custom resource that updates the ECS service when the parameter changes.

Answer

Use a CI/CD pipeline that monitors the parameter store and triggers a new build and deploy of the container image with the updated parameter.

Answer

Use Amazon EventBridge to detect changes to the parameter and invoke a Lambda function that updates the ECS task definition and forces a new deployment.

Question 14

A development team is using AWS CodeCommit as the source for a CI/CD pipeline. They want to automatically run unit tests when a pull request is created, but only for changes to the 'src' directory. Which approach should they use?

Accepted Answer

Create an AWS CodeBuild project with a source provider of CodeCommit and configure 'WEBHOOK' events with a filter for pull requests and path filter for 'src/**'.. Option B is correct because AWS CodeBuild can be triggered by a pull request event with a path filter. Option A is wrong because CodePipeline does not natively trigger on pull requests. Option C is wrong because Lambda alone cannot trigger on CodeCommit events without an additional trigger. Option D is wrong because EventBridge can trigger on pull request events, but the path filtering should be done in the CodeBuild project configuration for efficiency.

Answer

Use an AWS Lambda function that polls CodeCommit for new pull requests and invokes CodeBuild when changes in 'src' directory are detected.

Answer

Set up an Amazon EventBridge rule that matches CodeCommit pull request events and invoke CodeBuild. Add a condition in the CodeBuild buildspec to check if changes are in 'src' directory.

Answer

Configure an AWS CodePipeline with a Source stage for CodeCommit and a Test stage for CodeBuild. Use a manual approval step to trigger on pull requests.

Question 15

A company has a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build stage runs unit tests and produces a JUnit report. The pipeline includes a test action that publishes results to an S3 bucket. Recently, the pipeline started failing with the error: 'The action could not be started because the artifact bucket policy is misconfigured.' What is the most likely cause?

Accepted Answer

The artifact bucket's bucket policy does not grant the necessary permissions to the CodePipeline service role.. Option A is correct because CodePipeline requires a bucket policy that allows cross-account access if the pipeline uses an artifact bucket in a different account. Option B is wrong because S3 transfer acceleration is not related. Option C is wrong because the bucket is already in use. Option D is wrong because KMS keys are not mentioned in the error.

Answer

The S3 bucket has Amazon S3 Transfer Acceleration enabled, which is not supported by CodePipeline.

Answer

The KMS key used to encrypt the bucket objects has been rotated, causing the pipeline to lose access.

Answer

The artifact bucket is in a different AWS Region than the pipeline, and cross-region replication is not enabled.