DOP-C02 Practice Test 38 — 15 Questions

Question 1

A company uses AWS CodePipeline with a multi-branch strategy. Developers push to feature branches, which should trigger a pipeline that runs unit tests and then deploys to a staging environment. However, the pipeline only triggers on the main branch. What should be done to enable pipeline execution for feature branches?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the source stage to use 'Webhook' as the change detection method and specify a branch pattern.. AWS CodePipeline can use a webhook (e.g., from GitHub or CodeCommit) to detect changes on any branch. By configuring the source stage with 'Webhook' as the change detection method and specifying a branch pattern (e.g., 'feature/*'), the pipeline will automatically trigger on pushes to matching feature branches, not just the main branch.

Answer

Change the source provider from Amazon S3 to AWS CodeCommit.

Answer

Increase the polling frequency in the source stage to detect new branches.

Answer

Create a separate pipeline for each feature branch.

Question 2

A company runs a production web application on Amazon EC2 instances that are part of an Auto Scaling group. The instances are behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics and set up a CloudWatch dashboard to monitor the application. Recently, the team noticed that the CPU Utilization metric for the Auto Scaling group shows a spike every day at 2:00 PM, but the application performance remains normal. The team wants to investigate the cause of the CPU spike. What should the team do FIRST to identify the root cause?

Accepted Answer

Use CloudWatch Logs Insights to query the application logs on the instances to identify any scheduled tasks or jobs running at 2:00 PM.. The FIRST step in root-cause analysis is to gather evidence, not to change the environment. CloudWatch Logs Insights allows the team to query application and system logs on the EC2 instances to identify scheduled tasks (e.g., cron jobs, batch scripts, log rotation) that run at 2:00 PM and cause the CPU spike. This is non-disruptive and directly targets the symptom's timing, providing data to confirm or rule out hypotheses before making changes.

Answer

Enable AWS CloudTrail to log all API calls to the instances.

Answer

Disable any scheduled tasks on the instances to see if the spike stops.

Answer

Increase the instance size to provide more CPU capacity to handle the spike.

Question 3

A company uses AWS OpsWorks for configuration management. They have a stack with a layer that includes several EC2 instances. The DevOps engineer needs to deploy a custom configuration file to all instances in the layer. What is the recommended approach?

Accepted Answer

Create a custom Chef recipe and assign it to the layer's lifecycle events. AWS OpsWorks is a configuration management service that uses Chef. The recommended approach to deploy custom configuration files to all instances in a layer is to create a custom Chef recipe and assign it to the layer's lifecycle events (e.g., Setup, Configure, Deploy, or Shutdown). This ensures the recipe runs automatically on every instance in the layer at the appropriate stage of the instance lifecycle, providing a consistent and idempotent deployment method.

Answer

Use custom JSON in the stack settings to specify the file content

Answer

Use AWS Systems Manager Run Command to copy the file

Answer

Add the file to the instance's user data script

Question 4

A DevOps engineer needs to grant cross-account access to an S3 bucket in Account A for a user in Account B. Which combination of policies is required?

Accepted Answer

An S3 bucket policy in Account A and an IAM policy in Account B.. Cross-account access to an S3 bucket requires both a resource-based policy (the S3 bucket policy in Account A) that grants the necessary permissions to the principal from Account B, and an identity-based policy (an IAM policy in Account B) attached to the user that allows the S3 actions. The bucket policy explicitly authorizes the external user (by ARN), while the IAM policy ensures the user has the required permissions to initiate the request. Without both, the request will fail due to the lack of either resource-side authorization or identity-side authorization.

Answer

An IAM role in Account A and an IAM policy in Account B.

Answer

Only an IAM policy in Account B.

Answer

Only an S3 bucket policy in Account A.

Question 5

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to ensure that stack updates are reviewed and approved by a senior engineer before being executed. Which feature should they implement?

Accepted Answer

Change sets. Change sets allow you to preview the proposed changes to a CloudFormation stack before executing them. This enables a senior engineer to review and approve the changes, ensuring that only validated updates are applied. Without change sets, updates would be applied immediately without a review step.

Answer

Stack policies

Answer

Drift detection

Answer

Stack sets

Question 6

A company uses AWS CloudFormation to manage infrastructure. They have a production stack that creates an Auto Scaling group. They want to update the launch configuration to use a new Amazon Machine Image (AMI) ID without causing downtime. Which update policy should they set on the Auto Scaling group?

Accepted Answer

AutoScalingRollingUpdate. The AutoScalingRollingUpdate policy allows CloudFormation to update the Auto Scaling group's launch configuration by gradually replacing instances in batches, ensuring that a minimum number of instances remain in service throughout the update. This prevents downtime by terminating old instances and launching new ones with the updated AMI in a controlled, rolling fashion.

Answer

AutoScalingScheduledAction

Answer

AutoScalingReplacingUpdate

Answer

AutoScalingBatchUpdate

Question 7

A company runs a critical web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application experiences periodic traffic spikes. To handle these spikes, the company wants to use a combination of proactive scaling based on a predictable schedule and reactive scaling based on CPU utilization. What is the MOST resilient scaling strategy?

Accepted Answer

Use a scheduled scaling policy for the predictable spikes and a step scaling policy for CPU utilization.. It combines scheduled scaling for predictable traffic spikes with step scaling for reactive adjustments based on CPU utilization, providing both proactive and reactive resilience. Scheduled scaling adjusts capacity in advance of known events, while step scaling allows for larger, more aggressive adjustments when CPU utilization exceeds thresholds, avoiding the slower, linear response of target tracking. This dual approach ensures the application can handle spikes without over-provisioning or under-provisioning.

Answer

Use predictive scaling based on historical traffic patterns.

Answer

Use manual scaling by increasing the desired capacity before expected spikes.

Answer

Use a target tracking scaling policy based on average CPU utilization.

Question 8

A company runs a microservices architecture on Amazon ECS with Fargate launch type. Each microservice is deployed using AWS CodePipeline with a source stage from CodeCommit, a build stage in CodeBuild, and a deploy stage that updates the ECS service. The team wants to implement a blue/green deployment strategy to reduce downtime and enable quick rollbacks. Which combination of AWS services and configurations should be used?

Accepted Answer

Use AWS CodeDeploy with a deployment group configured for blue/green deployment, and an Application Load Balancer (ALB) to shift traffic between the blue and green target groups.. AWS CodeDeploy natively supports blue/green deployments for Amazon ECS (Fargate) by orchestrating traffic shifting between two target groups behind an Application Load Balancer (ALB). This allows the new task set (green) to be validated before production traffic is fully shifted, and enables instant rollback by reverting traffic to the original (blue) target group. CodePipeline can integrate CodeDeploy as a deploy action to automate this workflow.

Answer

Use AWS CloudFormation with a 'DeploymentPreference' set to 'BlueGreen' for the ECS service.

Answer

Use the ECS service's built-in rolling update with a 'minimumHealthyPercent' of 100 and 'maximumPercent' of 200.

Answer

Configure the ECS service with an 'AutoScaling' policy that replaces instances gradually.

Question 9

A company uses Amazon RDS for MySQL. The database performance has degraded, and the engineer suspects that slow queries are the cause. Which service should be used to identify and analyze the slow queries?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct service because it provides a database-specific performance schema that visualizes database load and identifies the exact SQL queries causing performance degradation. It integrates directly with RDS for MySQL, offering a dashboard that breaks down wait events, SQL text, and host-level metrics, making it the ideal tool for analyzing slow queries.

Answer

Amazon CloudWatch Metrics

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Question 10

A team uses AWS CodeBuild to run integration tests that require access to an Amazon RDS database. The database is in a private subnet. The CodeBuild project is configured to use a VPC. However, the builds are failing with a timeout connecting to the database. What could be the issue?

Accepted Answer

The security group for the RDS database does not allow inbound traffic from the security group assigned to the CodeBuild project.. The RDS database is in a private subnet and its security group must explicitly allow inbound traffic from the CodeBuild project's security group. Even though CodeBuild is configured with a VPC, the default security group rules deny all inbound traffic; without an inbound rule for the database port (e.g., 3306 for MySQL) from the CodeBuild security group, the connection is blocked, causing a timeout.

Answer

The CodeBuild project's VPC configuration does not include the subnet IDs where the database resides.

Answer

The security group for the CodeBuild project does not allow outbound traffic to the RDS database.

Answer

The CodeBuild project does not have a route to the internet via an internet gateway, so it cannot reach the RDS endpoint.

Question 11

A company is designing a disaster recovery strategy for a critical application. They need a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. Which AWS database service configuration meets these requirements?

Accepted Answer

Aurora Global Database. Aurora Global Database provides a fully managed cross-region disaster recovery solution with typical RPO of 1 second and RTO of 1 minute for regional failover, which meets the required RTO of 15 minutes and RPO of 1 minute. It uses storage-level replication that is asynchronous but very low-latency, and failover can be promoted to the secondary region in under a minute.

Answer

RDS MySQL with Multi-AZ and cross-region read replica

Answer

DynamoDB global tables

Answer

RDS PostgreSQL with cross-region read replica

Question 12

A company has a CI/CD pipeline that deploys to Amazon ECS using AWS CodePipeline. The pipeline includes a manual approval step before deployment to production. The security team requires that all approvals be logged in AWS CloudTrail and that the approver's identity be verified. Which action should the DevOps engineer take to meet these requirements?

Accepted Answer

Ensure that the manual approval action is configured as a CodePipeline approval action; CloudTrail will log the 'Approval' event with the IAM user ARN.. CodePipeline's manual approval action inherently generates an 'Approval' event in CloudTrail when an approver approves or rejects the action. This event includes the IAM user ARN of the approver, satisfying both the logging and identity verification requirements without additional configuration.

Answer

Create a custom CloudTrail trail specifically for CodePipeline API calls.

Answer

Enable CloudTrail Insights to detect unusual approval activity.

Answer

Configure the approval action to send a notification to an Amazon SNS topic, and log the SNS delivery to CloudWatch Logs.

Question 13

A DevOps engineer needs to securely store database credentials for an application running on Amazon ECS. Which AWS service should be used to manage the credentials and provide them to the ECS tasks?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials, and it integrates natively with ECS so tasks can inject secrets as environment variables or in log configuration. It supports automatic rotation via Lambda, which is ideal for database credentials. ECS task definitions reference Secrets Manager secrets using the secrets block with valueFrom.

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager

Answer

AWS Systems Manager Parameter Store

Question 14

An organization uses AWS Elastic Beanstalk for application deployments. They want to implement immutable updates to minimize downtime and ensure that if the new environment fails health checks, the old environment remains intact. Which deployment policy should they choose?

Accepted Answer

Immutable update.. Immutable updates in AWS Elastic Beanstalk launch a completely new environment with the new application version. If the new environment fails health checks, Elastic Beanstalk automatically terminates it, leaving the original environment untouched. This ensures zero downtime and a safe rollback, which matches the requirement to keep the old environment intact if health checks fail.

Answer

Traffic splitting.

Answer

All at once.

Answer

Rolling update based on health.

Question 15

A company manages its infrastructure using AWS CloudFormation. They have a production stack that includes an Amazon RDS Multi-AZ DB instance. The stack was created using the 'aws cloudformation create-stack' command with default settings. The DB instance uses a custom DB parameter group. A DevOps engineer needs to modify a parameter in the DB parameter group and update the stack. The engineer updates the template to change the parameter value and runs 'aws cloudformation update-stack'. The update fails with a 'ROLLBACK_IN_PROGRESS' status. The engineer checks the CloudFormation console and sees that the DB instance was successfully modified, but the stack is rolling back. The rollback fails because the DB instance cannot be reverted to the original parameter value. The stack is now in 'UPDATE_ROLLBACK_FAILED' state. What should the engineer do to resolve this situation and apply the desired parameter change?

Accepted Answer

Use the 'aws cloudformation continue-update-rollback' command with the '--resources-to-skip' parameter to skip the DB instance, allowing the stack to reach 'UPDATE_ROLLBACK_COMPLETE'. Then apply a change set with the desired parameter change.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the `continue-update-rollback` command with `--resources-to-skip` allows you to skip the resource that cannot be rolled back (the RDS DB instance with the custom parameter group). This moves the stack to UPDATE_ROLLBACK_COMPLETE, after which you can apply a change set with the desired parameter change. This approach avoids manual intervention or stack deletion while preserving the modified DB instance.

Answer

Run 'aws cloudformation update-stack' again with the original template to revert the changes.

Answer

Revert the parameter value manually in the RDS console and then resume the rollback.

Answer

Delete the stack and recreate it with the updated template.