DOP-C02 Practice Test 39 — 15 Questions

Question 1

A DevOps engineer notices that an Amazon RDS for MySQL instance's CPU is consistently high during business hours. The engineer wants to identify the specific queries causing the high CPU. Which combination of services should be used to capture and analyze the queries? (Choose the best answer.)

Accepted Answer

Enable RDS Performance Insights and analyze the top SQL queries. Option C is correct because RDS Performance Insights provides a dashboard to identify top SQL queries consuming CPU. Option A is wrong because CloudWatch Logs alone doesn't capture queries. Option B is wrong because RDS Enhanced Monitoring provides OS-level metrics, not query-level. Option D is wrong because AWS X-Ray traces requests, not database queries.

Answer

Enable RDS Enhanced Monitoring and view metrics in CloudWatch

Answer

Enable AWS X-Ray tracing on the application and database

Answer

Enable RDS audit logs and stream them to Amazon CloudWatch Logs

Question 2

A DevOps team is troubleshooting a CloudFormation stack creation failure. The stack uses a service role with the trust policy shown in the exhibit. The error message states: 'Insufficient permissions to create the resource'. Which action should the team take to resolve this issue?

Accepted Answer

Attach IAM policies to the service role that grant permissions to create the resources.. Option B is correct because the service role's trust policy allows CloudFormation to assume it, but the role itself needs permissions to create resources. Option A is wrong because the trust policy is correct. Option C is wrong because adding a trust policy is for the stack's role. Option D is wrong because CloudFormation does not need to assume the user role.

Answer

Modify the CloudFormation template to use the user's IAM role instead of a service role.

Answer

Create a new stack policy that allows the required actions.

Answer

Add the user's IAM role to the trust policy.

Question 3

A DevOps engineer deploys the CloudFormation snippet shown in the exhibit. After the stack is deleted, the engineer checks for the S3 bucket. Which statement best describes the outcome?

Accepted Answer

The bucket is retained (not deleted) after the stack deletion.. Option C is correct because the DeletionPolicy: Retain ensures the bucket is not deleted when the stack is deleted. Option A is wrong because the bucket is retained. Option B is wrong because the bucket exists. Option D is wrong because the stack deletion succeeds, but the bucket remains.

Answer

The bucket is deleted because the stack deletion overrides the DeletionPolicy.

Answer

The stack deletion fails because the bucket has versioning enabled.

Answer

The bucket is deleted along with the stack because the DeletionPolicy is not supported for S3 buckets.

Question 4

Drag and drop the steps to implement a blue/green deployment using AWS CodeDeploy.

Question 5

A company uses Amazon CloudWatch Logs to store application logs. A DevOps engineer needs to create a real-time dashboard that displays the count of ERROR-level log entries across all instances. Which approach is the MOST efficient and cost-effective?

Accepted Answer

Use CloudWatch Logs Insights to run a query that counts ERROR entries across all log groups and add the query to a CloudWatch dashboard. Option C is correct because CloudWatch Logs Insights allows you to query logs across log groups in real-time and create dashboards. Option A is wrong because subscribing to a Kinesis stream adds complexity and cost. Option B is wrong because creating a custom metric filter for each log group is inefficient. Option D is wrong because exporting logs to S3 and using Athena is near real-time, not real-time.

Answer

Create a CloudWatch Logs metric filter for each log group to count ERROR entries, and then create a CloudWatch dashboard

Answer

Export logs to Amazon S3 and use Amazon Athena to query and visualize in Amazon QuickSight

Answer

Create a Kinesis Data Firehose delivery stream to stream logs to Amazon OpenSearch Service and build a dashboard in OpenSearch Dashboards

Question 6

A company is using AWS Elastic Beanstalk with a custom platform. They need to install a third-party agent on all instances. The agent requires a configuration file that contains sensitive credentials. How should the DevOps engineer provide the configuration file to the agent?

Accepted Answer

Use .ebextensions configuration files to download the configuration from a secure S3 bucket using an IAM instance role.. Option C is correct because .ebextensions configuration files allow you to run custom commands and scripts during instance provisioning, and by combining this with an IAM instance role that grants read access to a secure S3 bucket, you can securely download the sensitive configuration file without embedding credentials in the source code or user data. This approach follows AWS best practices for handling secrets by avoiding hard-coded credentials and leveraging IAM roles for temporary, scoped access.

Answer

Use instance user data to write the configuration file during instance launch.

Answer

Embed the configuration file in the application source code and deploy it with the application.

Answer

Use AWS Systems Manager Run Command to distribute the configuration file after instances are launched.

Question 7

A company uses CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed KMS key. What must be done to enable this?

Accepted Answer

Associate a customer-managed KMS key with the log group and update the key policy to allow CloudWatch Logs to use it.. Option D is correct because CloudWatch Logs supports encryption at rest using a customer-managed KMS key. To enable this, you must associate the KMS key with the log group via the CloudWatch Logs console or API, and you must update the key policy to grant CloudWatch Logs the necessary permissions (kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, and kms:DescribeKey). Without this key policy update, CloudWatch Logs cannot use the key to encrypt the log data at rest.

Answer

Enable encryption on the log group using the default AWS managed key.

Answer

Use a third-party encryption tool before sending logs to CloudWatch.

Answer

Create a new log group in a region where KMS is enabled.

Question 8

A company wants to use AWS Elastic Beanstalk to deploy a web application. They need to ensure that the application can be updated with zero downtime. Which deployment policy should they use?

Accepted Answer

Rolling. The Rolling deployment policy in AWS Elastic Beanstalk updates instances in batches, replacing a subset of the current environment's instances with new ones while keeping the rest serving traffic. This ensures that the application remains available throughout the update process, achieving zero downtime as long as the health check passes for each batch before proceeding.

Answer

Immutable

Answer

All at once

Answer

Traffic splitting

Question 9

A DevOps engineer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment'. The engineer checks the logs and finds that the application installation script exits with a non-zero exit code. What should the engineer do to troubleshoot?

Accepted Answer

SSH into one of the failed instances and run the install script manually to identify the error. Option D is correct because the deployment failure is caused by the application installation script exiting with a non-zero exit code, which indicates a specific error in the script or its environment. SSHing into a failed instance and running the install script manually allows the engineer to see the exact error output, debug the script logic, and identify missing dependencies or configuration issues directly on the target host.

Answer

Configure CloudWatch Logs to capture the script output

Answer

Increase the deployment's MinHealthyHosts percentage

Answer

Re-upload the application revision to S3

Question 10

A company uses AWS Elastic Beanstalk to manage its web application. The DevOps team wants to customize the Amazon EC2 instances launched by Elastic Beanstalk. Which two methods can they use to achieve this? (Choose TWO.)

Accepted Answer

Use .ebextensions configuration files in the application source bundle to install packages and run commands.. Option A is correct because `.ebextensions` configuration files allow you to customize the EC2 instances launched by Elastic Beanstalk by installing packages, running commands, and configuring services during instance provisioning. These YAML or JSON files are placed in the `.ebextensions` folder of your application source bundle and are executed by the Elastic Beanstalk platform as part of the instance initialization process, providing a native and supported customization mechanism.

Answer

Use AWS OpsWorks to manage the instances instead of Elastic Beanstalk.

Answer

Add user data to the Auto Scaling group launch configuration that Elastic Beanstalk creates.

Answer

Modify the CloudFormation template generated by Elastic Beanstalk directly.

Question 11

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that stack updates do not accidentally delete critical resources like a database. Which CloudFormation stack policy should they apply to protect the database resource?

Accepted Answer

Create a stack policy that denies delete actions on the logical resource ID of the database.. Option A is correct because a CloudFormation stack policy allows you to define resource-level permissions that prevent specific resources (identified by their logical resource ID) from being updated or deleted during a stack update. By creating a policy that denies delete actions on the database's logical resource ID, the DevOps team ensures that even if the template or parameters change, the database resource cannot be accidentally removed.

Answer

Apply an IAM policy that denies cloudformation:DeleteStack on the database.

Answer

Use an S3 bucket policy to deny deletion of the database snapshot.

Answer

Enable termination protection on the CloudFormation stack.

Question 12

A DevOps engineer is creating a CloudFormation template that includes an AWS Lambda function. The function code is stored in an S3 bucket. The engineer wants to ensure that the Lambda function is updated whenever the code in S3 changes. What should the engineer do?

Accepted Answer

Reference the S3 object version in the Lambda function's Code property to force an update when the version changes. Option B is correct because referencing the S3 object version in the Lambda function's Code property (e.g., `S3ObjectVersion`) creates a dependency on that specific version. When the S3 object is updated, its version changes, which triggers CloudFormation to detect a change in the template and update the Lambda function during the next stack update. This ensures the function code is refreshed without manual intervention.

Answer

Use AWS CodeDeploy to deploy the Lambda function

Answer

Add a DependsOn clause to the Lambda function resource

Answer

Use AWS CodePipeline to automatically update the stack when the S3 object changes

Question 13

A company uses AWS OpsWorks for configuration management. The DevOps team wants to deploy a new application version to a stack of EC2 instances. What should the team use to perform the deployment?

Accepted Answer

Custom Chef recipes in OpsWorks. AWS OpsWorks is a configuration management service that uses Chef. When you need to deploy a new application version to a stack of EC2 instances managed by OpsWorks, the native and recommended approach is to use custom Chef recipes. These recipes can be executed as a lifecycle event (e.g., Deploy) to update application code, restart services, or perform any deployment tasks directly on the instances, leveraging the existing OpsWorks agent and Chef infrastructure.

Answer

AWS Elastic Beanstalk

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 14

A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?

Accepted Answer

CloudFormation Change Sets. CloudFormation Change Sets allow the DevOps team to preview how proposed changes to a stack will impact running resources before they are executed. This enables a review-and-approval workflow because the change set can be created, reviewed, and then executed only after approval, satisfying the requirement for a change management process.

Answer

CloudFormation StackSets

Answer

CloudFormation Stack Policies

Answer

CloudFormation Drift Detection

Question 15

A DevOps team is deploying a web application on EC2 instances behind an ALB. The application must authenticate users using an external identity provider (IdP) that supports SAML 2.0. Which solution provides the simplest integration with the ALB?

Accepted Answer

Configure the ALB to use an SAML identity provider for authentication. ALB can authenticate users using SAML IdP. Option B is wrong because Cognito is for user pools, not direct SAML integration with ALB. Option C is wrong because CloudFront with Lambda@Edge adds complexity. Option D is wrong because the application itself would need to handle SAML, adding overhead.

Answer

Use Amazon Cognito user pools with SAML federation and integrate with ALB

Answer

Use AWS CloudFront with Lambda@Edge to validate SAML tokens

Answer

Install a SAML service provider library on each EC2 instance