DOP-C02 Practice Test 36 — 15 Questions

Question 1

A company uses AWS CodeBuild to compile Java applications. The builds often fail due to insufficient memory. The buildspec currently specifies 'compute-type: BUILD_GENERAL1_SMALL'. What is the most cost-effective solution to resolve the memory issues without changing the build logic?

Accepted Answer

Change the compute-type to 'BUILD_GENERAL1_MEDIUM' or 'BUILD_GENERAL1_LARGE' in the buildspec.. Option C is correct because increasing the compute type to a larger size provides more memory. Option A is wrong because enabling local caching does not increase memory. Option B is wrong because CodeBuild does not support memory overprovisioning. Option D is wrong because using multiple build environments in parallel does not help a single build's memory needs.

Answer

Enable Amazon S3 caching for the build artifacts to reduce memory usage.

Answer

Split the build into multiple parallel CodeBuild actions in the pipeline, each compiling a subset of the code.

Answer

Set the environment variable 'MEMORY_OVERPROVISION=2' in the buildspec.

Question 2

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They want to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Accepted Answer

Change Sets. Option B is correct because Change Sets allow you to preview changes before executing. Option A is wrong because stack policies prevent updates to specific resources, not overall review. Option C is wrong because drift detection identifies differences, not updates. Option D is wrong because stack sets deploy across accounts, not preview changes.

Answer

Drift detection

Answer

Stack policies

Answer

StackSets

Question 3

A company uses AWS OpsWorks for configuration management of its EC2 instances. The DevOps team wants to apply a new security patch to all instances in a specific layer. What is the most efficient way to accomplish this?

Accepted Answer

Update the layer's custom Chef recipe to include the patch and trigger a lifecycle event to execute the recipe on all instances.. Option C is correct because OpsWorks allows running custom Chef recipes as lifecycle events. Option A is wrong because it requires manual login. Option B is wrong because it is not automated across all instances. Option D is wrong because a new stack is unnecessary.

Answer

Create a new OpsWorks stack with the patch and migrate instances to it.

Answer

SSH into each instance and run the patch command manually.

Answer

Use AWS Systems Manager Run Command to run a patch command on each instance individually.

Question 4

A DevOps engineer needs to automate the creation of an Amazon ECS cluster using AWS CloudFormation. The cluster will run a web application that requires a load balancer. Which resource should be used to define the ECS cluster?

Accepted Answer

AWS::ECS::Cluster. Option A is correct because AWS::ECS::Cluster is the CloudFormation resource for an ECS cluster. Option B is wrong because AWS::ECS::Service is for running tasks. Option C is wrong because AWS::ECS::TaskDefinition defines the task. Option D is wrong because AWS::ECS::ContainerInstance is not a resource; instances are managed by Auto Scaling.

Answer

AWS::ECS::Service

Answer

AWS::ECS::TaskDefinition

Answer

AWS::ECS::ContainerInstance

Question 5

A DevOps team uses AWS Elastic Beanstalk to deploy a web application. They want to implement a blue/green deployment strategy to minimize downtime. Which configuration change should they make?

Accepted Answer

Create a new environment and perform a CNAME swap.. Option C is correct because blue/green deployments in Elastic Beanstalk use CNAME swap to route traffic to the new environment. Option A is wrong because immutable updates do not swap URLs. Option B is wrong because rolling updates update in-place. Option D is wrong because all-at-once causes downtime.

Answer

Set the deployment policy to 'All at once'.

Answer

Set the deployment policy to 'Rolling' with a batch size of 50%.

Answer

Set the deployment policy to 'Immutable'.

Question 6

A company uses AWS CodePipeline with a manual approval stage before deploying to production. The approval notification is sent via Amazon SNS. The approvers report that they are not receiving the email notifications. What should the DevOps engineer check first?

Accepted Answer

Confirm that the email subscriptions to the SNS topic have been confirmed by clicking the link in the initial confirmation email.. Option C is correct because SNS requires subscription confirmation; if not confirmed, emails are not delivered. Option A is wrong because SNS topics do not have inbound rules. Option B is wrong because the default mailbox quota is high and unlikely to be the issue. Option D is wrong because SNS does not use roles for email delivery.

Answer

Ensure that the IAM role for CodePipeline has permission to publish to the SNS topic.

Answer

Verify that the SNS topic's subscription has a filter policy that matches the approval event.

Answer

Check the email recipients' mailbox quota to see if it is full.

Question 7

A company is using AWS CodeBuild to compile a Java application. The build takes over 30 minutes, which is too long. The project uses the standard build environment. The source code is stored in an S3 bucket. What is the most effective way to reduce build time?

Accepted Answer

Enable local caching for dependencies in the buildspec.yml.. Option D is correct because caching the Maven dependencies can significantly reduce build time by reusing downloaded artifacts. Option A is wrong because it adds overhead. Option B is wrong because S3 is already the source. Option C is wrong because it does not address the compilation time.

Answer

Use a custom build environment with pre-installed Java.

Answer

Store the source code in AWS CodeCommit instead of S3.

Answer

Increase the compute type to a larger instance.

Question 8

A team uses AWS CodeBuild to run integration tests that require access to an Amazon RDS database. The database is in a private subnet. The CodeBuild project is configured to use a VPC. However, the builds are failing with a timeout connecting to the database. What could be the issue?

Accepted Answer

The security group for the RDS database does not allow inbound traffic from the security group assigned to the CodeBuild project.. Option B is correct because security group rules must allow inbound traffic from the security group associated with the CodeBuild project. Option A is wrong because CodeBuild VPC support requires subnets, not just the VPC ID. Option C is wrong because CodeBuild does not need an internet gateway for VPC-based builds; it can use VPC endpoints for AWS services. Option D is wrong because the security group for CodeBuild should allow outbound to the database, but the database's security group must allow inbound from CodeBuild.

Answer

The CodeBuild project's VPC configuration does not include the subnet IDs where the database resides.

Answer

The security group for the CodeBuild project does not allow outbound traffic to the RDS database.

Answer

The CodeBuild project does not have a route to the internet via an internet gateway, so it cannot reach the RDS endpoint.

Question 9

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon RDS DB instance. The DevOps team wants to update the DB instance class without downtime. What should they do?

Accepted Answer

Modify the DB instance class using an RDS blue/green deployment, then update the CloudFormation stack to match the new class.. Option D is correct because modifying the DB instance class with 'ApplyImmediately: false' and enabling Multi-AZ allows a blue/green deployment via RDS. Option A is wrong because it causes downtime. Option B is wrong because it creates a new DB, not an update. Option C is wrong because 'ReplaceOnDelete' would recreate the resource.

Answer

Use a CloudFormation stack update with a 'ReplaceOnDelete' deletion policy on the DB instance.

Answer

Create a new DB instance with the new class, update the application to point to the new endpoint, and delete the old instance.

Answer

Update the DBInstanceClass property in the CloudFormation template and set 'ApplyImmediately: true'.

Question 10

A company uses AWS Systems Manager to manage configuration compliance. They want to ensure that all EC2 instances have a specific security patch installed. Which Systems Manager capability should they use?

Accepted Answer

Patch Manager. Option B is correct because Patch Manager is designed to patch instances. Option A is wrong because State Manager is for state management, not patching. Option C is wrong because Automation is for workflows. Option D is wrong because Parameter Store is for configuration data.

Answer

Automation

Answer

Parameter Store

Answer

State Manager

Question 11

A DevOps team is troubleshooting a CloudFormation stack creation failure. The error message states: 'CREATE_FAILED: Resource handler returned message: "You have attempted to create more resources than the current AWS account limit"'. Which step should the team take to resolve this issue?

Accepted Answer

Check the current service limits for the resource type and request a limit increase from AWS Support.. Option C is correct because the error indicates a service limit has been reached, and the team should request a limit increase. Option A is wrong because the error is not about permissions. Option B is wrong because retrying will fail again. Option D is wrong because the error is specific to resource limits, not stack names.

Answer

Delete the failed stack and recreate it with the same template.

Answer

Review the IAM permissions for the CloudFormation service role.

Answer

Modify the CloudFormation template to use a different resource type.

Question 12

A company uses AWS CodeDeploy for application deployments. They want to ensure that if a deployment fails, the system automatically rolls back to the previous version. Which configuration should they set?

Accepted Answer

Configure the deployment group to enable automatic rollback when a deployment fails.. Option D is correct because CodeDeploy has a built-in rollback configuration that can automatically trigger when a deployment fails. Option A is wrong because CloudFormation is for infrastructure. Option B is wrong because 'auto-rollback' is not a valid CodeDeploy property. Option C is wrong because the 'Failure' hook is for custom scripts, not automatic rollback.

Answer

Define a 'Failure' lifecycle event hook that calls a Lambda function to revert the deployment.

Answer

Set the 'auto-rollback' property in the CodeDeploy deployment group to 'true'.

Answer

Use a CloudFormation stack with a rollback configuration.

Question 13

A company uses AWS Config to track resource changes. They want to automatically remediate non-compliant security group rules that allow public SSH access. What is the MOST effective approach?

Accepted Answer

Create an AWS Config rule with an automatic remediation action using AWS Systems Manager Automation.. Option A is correct because AWS Config remediation with SSM Automation can automatically modify security group rules. Option B is wrong because AWS Config rules only evaluate, not remediate. Option C is wrong because CloudWatch Events cannot directly modify security groups. Option D is wrong because Service Catalog is for provisioning, not remediation.

Answer

Set up an AWS Config rule that triggers a Lambda function to remove the SSH rule.

Answer

Use Amazon CloudWatch Events to detect the change and invoke a Lambda function.

Answer

Use AWS Service Catalog to enforce security group templates.

Question 14

Which TWO options are valid approaches for managing configuration drift in an AWS environment? (Choose two.)

Accepted Answer

Use AWS Config rules to evaluate resource configurations against desired policies.. Option A is correct because AWS Config can detect drift from desired configuration. Option D is correct because CloudFormation drift detection identifies changes to resources. Option B is wrong because Systems Manager Patch Manager is for patching, not drift detection. Option C is wrong because CloudTrail is for API logging. Option E is wrong because CodePipeline is for CI/CD.

Answer

Use AWS CodePipeline to automatically redeploy infrastructure when changes are detected.

Answer

Use AWS Systems Manager Patch Manager to keep instances patched.

Answer

Use AWS CloudTrail to monitor API calls that modify resources.

Question 15

A development team uses AWS CodePipeline with multiple stages including source, build, and deploy. The pipeline uses an Amazon S3 source action that triggers on changes to a specific bucket. Recently, the pipeline stopped triggering automatically. The IAM role for CodePipeline has the necessary permissions. What is the most likely cause?

Accepted Answer

AWS CloudTrail is not configured to deliver S3 data events to CloudWatch Logs.. Option C is correct because CodePipeline uses Amazon CloudWatch Events to detect S3 events. If CloudTrail is not configured to deliver events to CloudWatch Logs, the pipeline won't trigger. Option A is wrong because S3 event notifications are not used for CodePipeline triggers. Option B is wrong because the pipeline role has permissions. Option D is wrong because the S3 bucket policy is not relevant for triggering.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The S3 bucket policy denies access to CodePipeline.

Answer

The S3 bucket does not have event notifications configured.