DOP-C02 Practice Test 36 — 15 Questions

Question 1

A company uses AWS CodeCommit and wants to enforce that all commits to the 'main' branch are signed with a GPG key. Which steps should the DevOps engineer take to enforce this?

Accepted Answer

Create an IAM policy that denies git push actions unless the commit is signed.. AWS CodeCommit integrates with IAM to evaluate policies at the time of a `git push`. By creating an IAM policy that uses the `codecommit:GitPush` action with a `ForAnyValue:StringLike` condition key `codecommit:References` set to `refs/heads/main` and a `Bool` condition on `codecommit:IsSigned` set to `true`, you can deny pushes that are not signed. This enforces GPG signature verification at the IAM authorization layer, blocking unsigned commits before they reach the repository.

Answer

Use the AWS CLI to verify commit signatures and reject pushes.

Answer

Enable CloudWatch Logs to monitor commits and trigger a Lambda to rollback.

Answer

Configure a pre-receive hook in CodeCommit to reject unsigned commits.

Question 2

A development team uses AWS CodeBuild to compile a Java application. The build fails during the 'Install' phase with an error: 'Error: JAVA_HOME is not set'. How should the team fix this?

Accepted Answer

Set the environment variable 'JAVA_HOME' in the buildspec file's 'env' section.. The error 'JAVA_HOME is not set' indicates that the build environment lacks the required environment variable pointing to the Java installation. In AWS CodeBuild, the buildspec file's 'env' section allows you to define environment variables, including 'JAVA_HOME', which can be set to the path of the Java runtime (e.g., '/usr/lib/jvm/java-11-openjdk-amd64'). This ensures the variable is available during the Install phase, resolving the error without altering the build image or adding installation steps.

Answer

Use the managed image 'aws/codebuild/standard:5.0' which has Java pre-installed.

Answer

Install Java in the pre_build phase using a command.

Answer

Use a custom Docker image that has Java pre-installed.

Question 3

Refer to the exhibit. A team uses this buildspec.yml file in AWS CodeBuild. After the build, they expect the artifacts to be placed in a folder structure, but all files are in the root of the output artifact. What is the reason?

Accepted Answer

The 'discard-paths' option is set to 'yes', which flattens the directory structure.. The `discard-paths` option in the `artifacts` section of a buildspec.yml file, when set to `yes`, explicitly flattens the directory structure. This means that even if the `files` glob pattern `**/*` matches files in subdirectories, they are all placed at the root of the output artifact, discarding their original relative paths. Without this setting (or when set to `no`), the directory hierarchy would be preserved.

Answer

The 'files' section only includes '**/*' which does not preserve paths.

Answer

The 'base-directory' is not specified, so CodeBuild uses the root of the build output.

Answer

The 'name' property is missing, causing artifacts to be stored without structure.

Question 4

A company uses CloudFormation to manage infrastructure. They have a nested stack that creates an Amazon RDS instance. When updating the parent stack, the RDS instance is unexpectedly replaced even though no changes were made to its properties. The engineer suspects a 'Drift' detection issue. What is the most likely reason for the replacement?

Accepted Answer

The logical ID of the RDS resource was changed in the nested stack template.. CloudFormation identifies resources by their logical ID within the template. When the logical ID of the RDS resource in the nested stack template is changed, CloudFormation treats it as a brand-new resource — it creates the new RDS instance and deletes the old one, resulting in an unexpected replacement even though the resource properties themselves are unchanged.

Answer

The RDS instance has drifted from the template definition.

Answer

The deletion policy is set to 'Retain'.

Answer

The stack policy prevents updates to the RDS instance.

Question 5

A company uses AWS Organizations with multiple accounts. The security team needs a centralized solution to detect and respond to EC2 instances that are publicly accessible with SSH open to 0.0.0.0/0. Which combination of services provides the most automated detection and remediation?

Accepted Answer

AWS Config and AWS Systems Manager Automation. AWS Config and AWS Systems Manager Automation together provide automated detection and remediation. AWS Config rules can detect EC2 instances with security groups that allow SSH from 0.0.0.0/0, and the rule can trigger an SSM Automation document to remediate the issue, such as by modifying the security group or stopping the instance. This combination is centralized and works across multiple accounts in AWS Organizations when Config and SSM are configured with a delegated administrator.

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS Config and Amazon Simple Notification Service (SNS)

Question 6

A company has a VPC with public and private subnets. They launch an EC2 instance in a private subnet that needs to download patches from the internet. Which solution is MOST secure and scalable?

Accepted Answer

Create a NAT Gateway in a public subnet and update the private route table.. A NAT Gateway resides in a public subnet, has an Elastic IP, and performs source NAT for outbound-only traffic from private subnets. Updating the private subnet's route table with 0.0.0.0/0 → NAT Gateway gives the EC2 instance internet egress for patch downloads without exposing it to inbound connections. It is managed, highly available within the AZ, and scales automatically, satisfying both the security and scalability requirements.

Answer

Launch a proxy server in a public subnet and route traffic through it.

Answer

Assign an Elastic IP to the instance in the private subnet.

Answer

Use a VPC endpoint to the Amazon Linux repository.

Question 7

A company wants to ensure its Amazon RDS DB instance is highly available with automatic failover in case of an AZ failure. Which configuration should they use?

Accepted Answer

Multi-AZ deployment. Amazon RDS Multi-AZ deployments maintain a synchronous standby replica in a different Availability Zone and automatically fail over to it if the primary fails, providing high availability with minimal downtime. The DNS endpoint remains the same, so applications reconnect without configuration changes. This is the standard AWS-recommended configuration for HA with automatic failover.

Answer

Amazon RDS Proxy

Answer

Single-AZ with automated backups

Answer

Read replicas in multiple AZs

Question 8

An organization uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests in CodeBuild. Recently, the pipeline failed because the Test stage took longer than expected, causing a pipeline execution timeout. The pipeline has a default timeout of 7 days. What is the MOST efficient way to set a maximum execution time for the Test stage without affecting other stages?

Accepted Answer

Modify the CodeBuild project's build timeout (e.g., 1 hour) in the buildspec or project configuration.. The CodeBuild project's build timeout setting directly controls the maximum duration a build can run before it is stopped. By setting this timeout to 1 hour in the CodeBuild project configuration or buildspec, the Test stage will automatically fail if it exceeds that limit, without affecting the pipeline's overall timeout or other stages. This is the most efficient and targeted approach, as it leverages a native CodeBuild feature rather than adding external monitoring or changing pipeline-wide settings.

Answer

Create an AWS Lambda function that stops the pipeline if the Test stage exceeds 1 hour.

Answer

Set the pipeline execution timeout to 1 hour in the pipeline settings.

Answer

Use Amazon CloudWatch Events to detect when the Test stage runs for more than 1 hour and then stop the pipeline.

Question 9

An organization uses AWS CodePipeline to deploy a serverless application using AWS Lambda and Amazon API Gateway. The pipeline includes a manual approval action. The team wants to ensure that the approval email is sent to multiple approvers and that any one of them can approve or reject. How should the approval action be configured?

Accepted Answer

Create an Amazon SNS topic with multiple subscribers, and configure the approval action to use that SNS topic ARN.. AWS CodePipeline's manual approval action can be configured to send notifications through an Amazon SNS topic. By creating an SNS topic with multiple subscribers (e.g., email addresses), any one of the subscribers can receive the approval request and take action (approve or reject). This satisfies the requirement for multiple approvers where any single approver can act.

Answer

Specify multiple email addresses in the 'ApproverEmail' field of the approval action.

Answer

Set the 'Approvers' field in the approval action to a comma-separated list of IAM user ARNs.

Answer

Add multiple IAM users to the pipeline's service role.

Question 10

A company uses AWS Systems Manager to manage hybrid servers. They want to automate the patching of Windows servers using Patch Manager. However, some servers are not showing up in the compliance reporting. What should the DevOps engineer check first?

Accepted Answer

Ensure the SSM Agent is installed and running on the servers. The SSM Agent is the core component that enables a server to communicate with AWS Systems Manager. Without the agent installed and running, the server cannot register with the service, receive patch commands, or report its compliance status. Therefore, this is the most fundamental prerequisite to check first when servers are missing from compliance reporting.

Answer

Verify that the servers have the correct patch baseline tags

Answer

Check that the Patch Baseline is configured to include the missing servers

Answer

Confirm that the servers have an IAM service role for Systems Manager

Question 11

A DevOps engineer receives an alarm that an EC2 instance's StatusCheckFailed metric has been in ALARM state for 10 minutes. Which action should the engineer take first to investigate?

Accepted Answer

Review the instance's system log and application logs in CloudWatch Logs. When StatusCheckFailed is in ALARM, the first investigative step is to examine the instance's system log and application logs in CloudWatch Logs, because these reveal whether the failure is an OS-level crash, kernel panic, or application error causing the instance to fail its status checks. Reviewing logs is non-destructive and provides the diagnostic evidence needed before taking any remediation action.

Answer

Use AWS Config to check the instance's configuration compliance

Answer

Check AWS CloudTrail for any API calls that modified the instance

Answer

Restart the EC2 instance to clear the alarm

Question 12

A DevOps engineer receives a CloudWatch alarm for high CPU utilization on an EC2 instance. The engineer needs to investigate the cause. Which AWS service can provide a detailed analysis of the running processes and their resource consumption?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command lets you remotely execute commands on EC2 instances (via the SSM agent) without SSH or RDP, so you can run tools like top, ps, htop, or perf to inspect running processes and CPU/memory consumption in real time. This is the correct service for interactive, instance-level process investigation triggered by a CloudWatch CPU alarm.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 13

After deploying a new application version using AWS CodeDeploy, an EC2 instance fails the deployment. The deployment group is configured with an in-place deployment. The engineer sees the error 'ScriptMissing' in the CodeDeploy logs. What should the engineer check?

Accepted Answer

The file path defined in the appspec.yml for the lifecycle hook. The 'ScriptMissing' error in CodeDeploy indicates that a lifecycle hook script referenced in appspec.yml cannot be found at the specified path on the instance. The engineer should verify the file path defined for that hook in appspec.yml.

Answer

The deployment group's deployment configuration

Answer

The security group attached to the instance

Answer

The AMI used for the EC2 instance

Question 14

The AWS Config rule 's3-bucket-ssl-requests-only' returns NON_COMPLIANT for the bucket 'my-bucket'. What does this mean?

Accepted Answer

The bucket's policy does not deny requests that are not using SSL.. The AWS Config rule 's3-bucket-ssl-requests-only' checks whether the bucket policy denies requests that are not using SSL (i.e., HTTP). If it returns NON_COMPLIANT, it means the bucket policy does not have a statement that denies non-SSL requests, so the bucket is not enforcing SSL-only access.

Answer

The bucket is publicly accessible.

Answer

The bucket does not have server access logging enabled.

Answer

The bucket does not have default encryption enabled.

Question 15

A company wants to centralize logging of all API calls made within their AWS account for auditing. Which service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service designed to log all API calls made within an AWS account, providing a detailed audit trail of actions taken by users, roles, and services. It records API activity across the AWS Management Console, SDKs, CLI, and other services. CloudTrail logs can be delivered to S3 and CloudWatch Logs for analysis.

Answer

Amazon S3 access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs