DOP-C02 Practice Test 4 — 10 Questions

Question 1

A company runs a critical application on Amazon ECS with the Fargate launch type. The application is deployed across three Availability Zones. Each service has its own Application Load Balancer. The company wants to implement a blue/green deployment strategy to reduce risk. They currently use AWS CodeDeploy for ECS deployments. During a recent deployment, the company noticed that the new version (green) was not receiving any traffic even after passing all health checks. The CodeDeploy configuration uses a 'Linear10PercentEvery3Minutes' traffic shifting configuration. What is the most likely reason that the green tasks are not receiving traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The green target group's health check is misconfigured, causing CodeDeploy to consider the green tasks unhealthy and not route traffic.. The green target group's health check is misconfigured, causing CodeDeploy to consider the green tasks unhealthy. With a 'Linear10PercentEvery3Minutes' traffic shifting configuration, CodeDeploy gradually shifts traffic in 10% increments every 3 minutes, but only if the green target group passes health checks. If the health check fails, CodeDeploy stops traffic shifting, leaving the green tasks with zero traffic despite the tasks themselves being healthy.

Answer

The CodeDeploy deployment group is not associated with the correct ECS service.

Answer

The blue target group is still set as the production target group in the load balancer listener.

Answer

The green tasks are in a different VPC than the load balancer.

Question 2

An organization uses AWS CodePipeline to orchestrate deployments to multiple environments (dev, test, prod). Each environment uses a different AWS account. The pipeline uses cross-account actions with IAM roles. Recently, the pipeline failed at the deploy stage for the prod account with the error 'Access Denied' when assuming the cross-account role. The role ARN is correct and the trust policy allows the pipeline's service role. What is the MOST likely cause?

Accepted Answer

The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.. The pipeline's service role must have an `sts:AssumeRole` permission on the cross-account role to perform the role assumption. Even if the trust policy on the cross-account role allows the pipeline's service role, the pipeline's service role itself needs an IAM policy granting `sts:AssumeRole` for the cross-account role ARN. Without this permission, the `AssumeRole` API call fails with 'Access Denied', which is the exact error described.

Answer

The EC2 instances in the prod account do not have an appropriate instance profile.

Answer

The cross-account role's permissions boundary denies the deploy action.

Answer

The pipeline's service role does not have permission to perform the deploy action in the prod account.

Question 3

A DevOps engineer receives an alarm that an EC2 instance's CPU utilization has exceeded 90% for 5 minutes. The engineer needs to automatically recover the instance. Which AWS service should be used to configure automatic recovery?

Accepted Answer

Amazon CloudWatch Alarms. Amazon CloudWatch Alarms can be configured to trigger an EC2 instance recovery action when a metric like CPU utilization exceeds a threshold (e.g., 90% for 5 minutes). The alarm sends a signal to the EC2 service, which automatically recovers the instance by stopping it and starting it on a new underlying host, preserving the instance ID, private IP, and Elastic IP. This is the native, built-in mechanism for automatic instance recovery without requiring additional compute or orchestration services.

Answer

AWS Lambda

Answer

AWS Systems Manager Automation

Answer

EC2 Auto Scaling

Question 4

A company has a multi-account AWS environment with separate accounts for development, staging, and production. They want to implement a CI/CD pipeline that deploys to each account sequentially after manual approvals. Which setup allows cross-account deployment with CodePipeline?

Accepted Answer

Create an IAM role in the target account with permissions for the pipeline service role to assume, and use that role in the deployment action.. CodePipeline supports cross-account deployments by having the pipeline service role in the source account assume an IAM role in the target account. This role must have a trust policy allowing the pipeline service role to assume it, and the deployment action (e.g., CloudFormation, CodeDeploy) references that target account role. This enables sequential deployment to development, staging, and production accounts with manual approval gates between stages.

Answer

Create separate pipelines in each account and trigger them via SNS from a master pipeline.

Answer

Use CodePipeline with cross-account actions by specifying the target account ID and region.

Answer

Use a single pipeline in the management account with different stages for each account.

Question 5

A development team uses AWS CodeCommit for source control. They want to enforce that all commits include a JIRA issue key in the commit message. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function on every push to validate commit messages.. CodeCommit triggers can invoke an AWS Lambda function on every push event, allowing real-time validation of commit messages against a required pattern (e.g., JIRA issue key). This serverless approach enforces the policy centrally without relying on client-side configurations, making it the most efficient and reliable method for a team using AWS CodeCommit.

Answer

Use Amazon CloudWatch Events to detect new commits and invoke a Lambda function to validate the commit message.

Answer

Implement a pre-commit hook in each developer's local repository.

Answer

Configure a branch policy on the repository that requires commit message format.

Question 6

A company is deploying a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application must be resilient to the failure of an entire Availability Zone. Which design should the company implement?

Accepted Answer

Launch EC2 instances in at least two Availability Zones and place them behind an Application Load Balancer with cross-zone load balancing enabled.. Deploying EC2 instances across at least two Availability Zones (AZs) behind an Application Load Balancer (ALB) with cross-zone load balancing enabled ensures that if an entire AZ fails, the ALB can route traffic to healthy instances in the remaining AZs. Cross-zone load balancing allows the ALB to distribute incoming requests evenly across all registered instances in all enabled AZs, which improves fault tolerance and resource utilization. This design meets the requirement for resilience to an AZ failure by eliminating a single point of failure at the AZ level.

Answer

Use one EC2 instance in a single Availability Zone behind a Network Load Balancer.

Answer

Launch EC2 instances in one Availability Zone and use an Application Load Balancer to distribute traffic.

Answer

Deploy EC2 instances in two Availability Zones but use a single Application Load Balancer in one AZ.

Question 7

A company runs a stateless web application on Amazon ECS with Fargate launch type. The application experiences intermittent traffic spikes. The company wants to ensure that the application can scale automatically and remain resilient to underlying infrastructure failures. Which combination of actions should the DevOps engineer take?

Accepted Answer

Configure an Application Auto Scaling target tracking policy based on memory utilization and enable Amazon ECS service auto-recovery.. It combines Application Auto Scaling target tracking based on memory utilization, which is a relevant metric for a stateless web application to handle traffic spikes, with Amazon ECS service auto-recovery, which automatically replaces unhealthy tasks to ensure resilience against underlying infrastructure failures. This approach provides both automatic scaling and fault tolerance without manual intervention.

Answer

Configure a scheduled scaling policy for the Amazon ECS service to add tasks during known peak hours.

Answer

Launch tasks in a single Availability Zone and use an Application Auto Scaling target tracking policy based on CPU utilization.

Answer

Configure a step scaling policy for the Amazon ECS service and increase the task memory size.

Question 8

A development team is using AWS CodeCommit to store source code and AWS CodePipeline to automate builds and deployments. The team wants to ensure that builds and tests are triggered only when code is pushed to specific branches, and that manual approval is required before deploying to production. Which CodePipeline configuration should the team implement?

Accepted Answer

Configure the source action with a branch filter for main, and add a manual approval step before the production deployment stage.. CodePipeline source actions support branch filters that restrict which Git branches trigger the pipeline. By filtering on 'main', only pushes to that branch initiate the pipeline. Adding a manual approval step before the production deployment stage ensures that no code reaches production without explicit human sign-off, meeting both requirements precisely.

Answer

Configure the source action to trigger on all branches and add a manual approval step before the build stage.

Answer

Configure the source action with a branch filter for main, and add a manual approval step before the build stage.

Answer

Use a branch filter on the build action to run only for the main branch, and add a manual approval step before the deploy stage.

Question 9

A DevOps team uses AWS CodePipeline with a multi-branch strategy. The pipeline should deploy to production only from the 'main' branch, but run unit tests for all branches. How should the team configure the pipeline?

Accepted Answer

Configure the pipeline source stage to trigger on all branches, use branch-specific logic in the test stage, and add a manual approval step for production deployment only when the branch is 'main'.. AWS CodePipeline supports branch filtering in the source stage to trigger on all branches, and you can use a condition in the deploy stage (e.g., via a Lambda function or a manual approval step) to restrict production deployment to the 'main' branch only. This approach avoids duplicating pipelines while ensuring unit tests run for every branch, meeting the multi-branch strategy requirement efficiently.

Answer

Use an AWS Lambda function to check the branch name and invoke different CodePipeline executions for testing and deployment.

Answer

Create one pipeline with two source stages: one for 'main' and one for all other branches, each with its own test and deploy actions.

Answer

Create a separate pipeline for each branch, each with identical test and deploy stages.

Question 10

A company is implementing a disaster recovery strategy for its Amazon Aurora MySQL database. The primary database is in us-west-2. The company requires an RPO of less than 1 minute and an RTO of less than 5 minutes. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with a secondary Region cluster.. Amazon Aurora Global Database is designed for low-latency cross-Region replication with a typical RPO of 1 second and RTO of 1 minute or less, meeting the <1 minute RPO and <5 minute RTO requirements. It uses a dedicated storage-level replication channel that keeps the secondary cluster fully synchronized without impacting primary performance, and failover involves promoting the secondary cluster to primary in under a minute.

Answer

Create a cross-Region read replica in the secondary Region and promote it during failover.

Answer

Use automated backups and restore to a new DB instance in the secondary Region.

Answer

Take manual snapshots of the DB instance and copy them to the secondary Region every hour.