DOP-C02 Practice Test 37 — 15 Questions

Question 1

A company's DevOps team uses AWS Config to monitor resource compliance. They have created a custom AWS Config rule that triggers an AWS Lambda function to evaluate whether EC2 instances have the 'Environment' tag with value 'Production' or 'Staging'. The rule is set to evaluate resources on configuration changes. However, the team notices that the rule does not trigger when an EC2 instance is launched. The Lambda function's IAM role has the necessary permissions to describe EC2 instances. The CloudWatch Logs for the Lambda function show that it is not being invoked. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The AWS Config rule is not configured to trigger on AWS::EC2::Instance resources.. For an AWS Config custom rule to fire on resource creation, the rule must specify the resource types it evaluates (e.g., AWS::EC2::Instance) in its scope. If the scope does not include EC2 instances, Config will not invoke the rule's Lambda function when an instance is launched, which matches the symptom that the Lambda is never invoked despite having correct permissions. The trigger type (configuration change) is already stated as correct in the scenario, so the missing piece is the resource scope.

Answer

The Lambda function's IAM role does not have permission to write to CloudWatch Logs.

Answer

The AWS Config rule is set to evaluate resources periodically, not on configuration changes.

Answer

The custom rule must be deployed using AWS CloudFormation to be active.

Question 2

A company runs a stateful application on EC2 instances. They want to distribute traffic evenly and maintain session stickiness. Which AWS service should they use?

Accepted Answer

Application Load Balancer with sticky sessions. An Application Load Balancer with sticky sessions (session affinity) distributes HTTP/HTTPS traffic across targets while binding a client to the same target for the duration of a session via a cookie. This satisfies both even distribution and session persistence for a stateful application.

Answer

Network Load Balancer

Answer

Amazon Route 53 weighted routing policy

Answer

Amazon CloudFront with origin failover

Question 3

An organization uses AWS OpsWorks for configuration management. They want to migrate to AWS Systems Manager to reduce costs and improve flexibility. Their current stack includes custom Chef recipes that manage package installations and service configurations. What is the MOST effective migration strategy?

Accepted Answer

Translate Chef recipes into Systems Manager State Manager associations and use Run Command for ad-hoc tasks.. Systems Manager State Manager associations can enforce desired-state configuration (package installs, service states) on a schedule, directly replacing the convergent behavior of Chef recipes, while Run Command handles ad-hoc or one-off execution. This maps OpsWorks Chef functionality onto native Systems Manager capabilities without introducing new tooling.

Answer

Use AWS CloudFormation to recreate the entire infrastructure and manage configurations.

Answer

Use AWS CodeDeploy to replace OpsWorks and manage configurations.

Answer

Keep OpsWorks but integrate it with Systems Manager for hybrid management.

Question 4

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage to Elastic Beanstalk. Recently, deployments started failing with an error: 'The deployment failed because the Elastic Beanstalk environment is in an UPDATE_ROLLBACK_IN_PROGRESS state.' What is the MOST likely cause?

Accepted Answer

A previous deployment failed and triggered an automatic rollback, leaving the environment in an unstable state. The error indicates the Elastic Beanstalk environment is stuck in an UPDATE_ROLLBACK_IN_PROGRESS state, which occurs when a previous deployment failed and Elastic Beanstalk automatically rolled back the changes. This leaves the environment in an unstable state that prevents new deployments until the rollback completes or is manually resolved. CodePipeline cannot proceed because Elastic Beanstalk rejects any new update operations while in this state.

Answer

The buildspec.yml file contains an invalid command that prevents artifact generation

Answer

A CloudWatch alarm is blocking the deployment due to high error rates

Answer

Insufficient IAM permissions for CodePipeline to pull source code from CodeCommit

Question 5

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with an error 'The overall deployment failed because too many individual instances failed deployment'. The team checks the instance logs and finds that the 'BeforeInstall' lifecycle event script returned a non-zero exit code. What is the BEST approach to resolve this?

Accepted Answer

Fix the script error in the revision and redeploy.. The deployment failed because the BeforeInstall lifecycle event script returned a non-zero exit code, which CodeDeploy interprets as a failure. The root cause is a bug or misconfiguration in the script itself. The best approach is to fix the script in the application revision and redeploy, ensuring the script exits with 0 on success. This addresses the underlying issue rather than bypassing it.

Answer

Set the 'ignoreScriptFailure' option to true in the AppSpec file and redeploy.

Answer

Manually run the script on an instance and then resume the deployment.

Answer

Change the deployment configuration to 'AllAtOnce' to speed up deployment.

Question 6

A DevOps engineer runs the above command and sees that instance i-0abcd1234efgh5678 is unhealthy with reason 'Target.Timeout'. The instance is running and the application on port 80 responds to curl from the instance itself. What is the MOST likely cause?

Accepted Answer

The security group for the instance does not allow inbound traffic from the ALB on port 80.. The 'Target.Timeout' health check reason indicates that the load balancer's health check request timed out, meaning it could not establish a connection or receive a response within the timeout period. Since the instance responds to curl locally, the application is running, but the ALB cannot reach it. The most likely cause is that the instance's security group does not allow inbound traffic from the ALB on port 80, blocking the health check requests.

Answer

The ALB health check interval is set too high.

Answer

The web server process is not running on the instance.

Answer

The health check path returns a 404 status code.

Question 7

A company uses a third-party backup solution to back up its EC2 instances daily. The backups are stored in an S3 bucket with default settings. The company wants to ensure that backups are protected from accidental deletion and are available for at least one year. Which combination of S3 features should the DevOps engineer implement?

Accepted Answer

Enable S3 Object Lock with Governance mode and a retention period of 365 days, and set a lifecycle policy to transition to S3 Glacier Deep Archive after 30 days.. S3 Object Lock with Governance mode prevents objects from being deleted or overwritten by any user (including the root user) for the specified retention period of 365 days, meeting the one-year availability requirement. The lifecycle policy to transition to S3 Glacier Deep Archive after 30 days reduces storage costs while still keeping the data accessible for retrieval within 12 hours, which is acceptable for backup retention. This combination ensures immutability and cost-effective long-term storage.

Answer

Enable MFA Delete and set a lifecycle policy to transition to S3 Glacier after 30 days.

Answer

Enable versioning and set a lifecycle policy to expire noncurrent versions after 365 days.

Answer

Enable cross-Region replication to a bucket with versioning enabled.

Question 8

A company wants to automatically detect and respond to suspicious activity in their AWS account. Which service should be used to generate alerts based on threat intelligence?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts for malicious activity using machine learning, anomaly detection, and integrated threat intelligence feeds. It analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to generate findings and can trigger alerts via CloudWatch Events or Security Hub. This directly matches the requirement to detect and respond to suspicious activity based on threat intelligence.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon CloudWatch

Question 9

An organization uses OpsWorks to manage application stacks. They notice that custom cookbooks are not being executed during the lifecycle events. What is the most likely cause?

Accepted Answer

The custom cookbook repository URL is misconfigured or inaccessible. Custom cookbooks in AWS OpsWorks are fetched from a repository (e.g., Git, S3, HTTP) during lifecycle events. If the repository URL is misconfigured (e.g., wrong branch, invalid path) or inaccessible (e.g., private repo without proper SSH keys or S3 bucket permissions), OpsWorks cannot retrieve the cookbooks, causing them to not execute. This is the most common cause of cookbook execution failures.

Answer

The layer's IAM role does not have permissions to execute the cookbook

Answer

The cookbook is not configured with CodeDeploy

Answer

The cookbook uses a Chef version that is not supported by OpsWorks

Question 10

A company runs a stateful application on EC2 instances. The application stores session data locally. The instances are behind an ALB with sticky sessions enabled. A scaling event terminates an instance, causing loss of session data. How can the company prevent this while maintaining performance?

Accepted Answer

Use Amazon ElastiCache to store session data. Storing session data in Amazon ElastiCache (Redis or Memcached) externalizes the state from the EC2 instances, so when an instance is terminated during scaling, the session data persists and remains accessible to all instances. This maintains performance because ElastiCache provides sub-millisecond latency and high throughput, and it also allows any instance to handle any request, eliminating the need for sticky sessions. The application must be modified to read/write session data to ElastiCache, but this is the standard AWS-recommended approach for stateful web applications.

Answer

Use a dedicated EC2 instance for sessions

Answer

Disable sticky sessions

Answer

Increase the sticky session duration

Question 11

An organization uses AWS Elastic Beanstalk to deploy a web application. They need to ensure that configuration changes (e.g., environment variables, instance types) are version-controlled and can be rolled back. Which approach meets these requirements?

Accepted Answer

Use Elastic Beanstalk saved configurations to capture environment settings and store the configuration files in a version control system.. Elastic Beanstalk saved configurations allow you to capture the complete environment settings (including environment variables, instance types, and other configuration options) as a YAML or JSON file. By storing these configuration files in a version control system (e.g., Git), you achieve version-controlled configuration that can be applied to recreate or roll back an environment to a known state using the `eb config` command or the AWS Management Console.

Answer

Use AWS Systems Manager Parameter Store to store configuration values.

Answer

Create a custom script that uses the Elastic Beanstalk API to apply configuration and store the script in a Git repository.

Answer

Manually record all configuration changes in a spreadsheet.

Question 12

A company uses AWS Elastic Beanstalk for its web application. After a deployment, the environment health changes to 'Severe' and the application becomes unresponsive. The DevOps team needs to quickly revert to the previous working version. What is the FASTEST way to achieve this?

Accepted Answer

Use the Elastic Beanstalk console to deploy the previous application version.. Deploying the previous application version through the Elastic Beanstalk console is the fastest rollback because Beanstalk retains prior application versions and can redeploy one directly to the same environment, restoring the working state without rebuilding infrastructure. This is the standard, quickest recovery path.

Answer

Swap environment URLs with a different environment that runs the previous version.

Answer

Terminate the environment and create a new one with the previous version.

Answer

Redeploy the same application version to the environment.

Question 13

A DevOps engineer runs the above command and sees that one target is unhealthy with a 503 error. The application is a web server running on port 80. The health check is configured to hit the root path '/'. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the application on the unhealthy instance is configured to respond to '/' with a 200 status code. The health check is configured to hit the root path '/' and expects a 200 status code. A 503 error indicates the application on the unhealthy instance is not serving the correct response for that path. Verifying that the application responds with a 200 status code on '/' directly addresses the root cause of the health check failure.

Answer

Change the health check port to 443 and use HTTPS

Answer

Increase the health check interval and timeout settings

Answer

Check the security group rules for the target group to ensure port 80 is open

Question 14

A company uses AWS Elastic Beanstalk for a web application. The DevOps engineer needs to ensure that environment configuration changes (e.g., instance type, environment variables) are version-controlled and can be rolled back quickly. Which approach should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations stored in source control.. Elastic Beanstalk saved configurations allow you to export environment settings (e.g., instance type, environment variables) as a YAML or JSON file that can be stored in a version control system like Git. This enables you to recreate environments with identical settings and roll back to a previous configuration by deploying an older saved configuration file, providing a version-controlled, auditable, and reversible change management process.

Answer

Manually update the environment configuration through the Elastic Beanstalk console.

Answer

Use the AWS CLI to apply configuration changes from a script.

Answer

Use AWS CloudFormation to manage the Elastic Beanstalk environment.

Question 15

A company has a legacy application running on an EC2 instance that is not part of an Auto Scaling group. The instance is experiencing a memory leak. The DevOps engineer needs to collect memory metrics to analyze the issue without modifying the application. What should the engineer do?

Accepted Answer

Install the CloudWatch agent on the instance and configure it to collect memory metrics.. The CloudWatch agent is required to collect custom metrics like memory utilization from an EC2 instance because the standard EC2 monitoring only captures hypervisor-level metrics (CPU, network, disk I/O). By installing and configuring the CloudWatch agent, the engineer can collect memory metrics without modifying the application code, directly addressing the memory leak analysis requirement.

Answer

Use the AWS Management Console to view memory metrics from the EC2 monitoring tab.

Answer

Use EC2Rescue to generate a memory dump and analyze it.

Answer

Enable CloudWatch detailed monitoring on the instance.