DOP-C02 Practice Test 40 — 15 Questions

Question 1

An application running on Amazon ECS experiences intermittent failures. The DevOps engineer wants to capture the application's standard output and error logs and send them to CloudWatch Logs. What is the simplest way to achieve this?

Accepted Answer

Use the awslogs log driver in the task definition.. Option B is correct because the awslogs log driver is built into ECS and automatically sends container logs to CloudWatch Logs. Option A is wrong because CloudWatch Agent inside container adds complexity. Option C is wrong because CloudTrail is for API calls. Option D is wrong because S3 is not real-time and requires additional setup.

Answer

Install the CloudWatch Agent in each container.

Answer

Configure AWS CloudTrail to capture logs.

Answer

Write logs to a file and use an S3 bucket with event notifications.

Question 2

A DevOps engineer is using AWS OpsWorks for configuration management. They need to ensure that custom recipes are applied to all instances in a layer in a specific order. What should the engineer do?

Accepted Answer

Assign the recipes to the appropriate lifecycle events in the layer configuration.. AWS OpsWorks uses lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) to control when custom recipes run on instances within a layer. By assigning recipes to the appropriate lifecycle events in the layer configuration, the engineer ensures they execute in the defined order for that event across all instances in the layer, which is the native mechanism for ordering in OpsWorks.

Answer

Use AWS CloudFormation Init with cfn-init to order the scripts.

Answer

Include all recipes in a single wrapper recipe and use include_recipe with the desired order.

Answer

Add the recipes to the instance's user data script.

Question 3

A team uses AWS CodePipeline to orchestrate deployments. They want to integrate a manual approval step before deploying to production. Which action should they take?

Accepted Answer

Add a manual approval action to the pipeline before the production deployment stage.. Option B is correct because AWS CodePipeline natively supports a manual approval action that can be added as a stage before the production deployment. This action pauses the pipeline and sends a notification (via Amazon SNS) to specified approvers, who can then approve or reject the deployment through the AWS Management Console, CLI, or API. No custom code or external services are required.

Answer

Use an AWS Lambda function to send an approval request email and wait for HTTP response.

Answer

Add an Amazon CloudWatch Events rule to pause the pipeline before the production stage.

Answer

Add an Amazon SNS topic to the pipeline and require subscription confirmation.

Question 4

A company uses AWS Elastic Beanstalk to deploy a web application. The operations team wants to ensure that the environment's configuration (e.g., instance type, scaling limits) is version-controlled and reproducible. Which practice should they adopt?

Accepted Answer

Use the Elastic Beanstalk saved configuration feature to download a configuration file and store it in version control.. Option B is correct because Elastic Beanstalk's saved configuration feature allows you to download the environment's configuration as a YAML or JSON file, which can be stored in version control and used to recreate identical environments. This directly addresses the need for version-controlled, reproducible environment configuration without requiring additional infrastructure-as-code tools.

Answer

Manually recreate the environment from the Elastic Beanstalk console when needed.

Answer

Use AWS CloudFormation to define the environment and store the template in a Git repository.

Answer

Document the configuration in a wiki and apply it manually through the AWS Management Console.

Question 5

A company uses AWS CloudFormation to manage infrastructure. They have a production stack that creates an Auto Scaling group. They want to update the launch configuration to use a new Amazon Machine Image (AMI) ID without causing downtime. Which update policy should they set on the Auto Scaling group?

Accepted Answer

AutoScalingRollingUpdate. Option C is correct because the AutoScalingRollingUpdate policy allows CloudFormation to update the Auto Scaling group's launch configuration by gradually replacing instances in batches, ensuring that a minimum number of instances remain in service throughout the update. This prevents downtime by terminating old instances and launching new ones with the updated AMI in a controlled, rolling fashion.

Answer

AutoScalingScheduledAction

Answer

AutoScalingReplacingUpdate

Answer

AutoScalingBatchUpdate

Question 6

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the new instances fail the health check and are terminated. The deployment fails. The team wants to automatically roll back to the previous working version. What should they do?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails.. Option B is correct because AWS CodeDeploy provides a built-in rollback configuration that can be triggered automatically when a deployment fails. By enabling automatic rollback in the deployment group settings, CodeDeploy will redeploy the last successful revision when the current deployment fails health checks, without requiring manual intervention or additional infrastructure.

Answer

Set up an Auto Scaling lifecycle hook to terminate instances and trigger a rollback.

Answer

Manually redeploy the last successful deployment revision after investigating the failure.

Answer

Configure the deployment group to automatically redeploy the same revision on failure.

Question 7

A DevOps engineer needs to manage configuration files across a fleet of Amazon EC2 instances running Amazon Linux. The configuration files must be updated whenever they change in an S3 bucket. Which AWS service is most suitable for this task?

Accepted Answer

AWS Systems Manager State Manager. AWS Systems Manager State Manager is the most suitable service because it provides a configuration management solution that can automatically apply and maintain the desired state of EC2 instances. It can be configured to run associations on a schedule or in response to events, such as changes to an S3 bucket, using an AWS Lambda trigger or EventBridge rule to invoke the association. This ensures that configuration files are updated whenever they change in the S3 bucket, without requiring manual intervention or a full configuration management platform.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS CloudFormation

Answer

AWS Config

Question 8

A company uses AWS CloudFormation with a template that creates an Amazon RDS DB instance. The password for the master user is stored in AWS Secrets Manager. The CloudFormation stack creation fails with the error: 'Value of property MasterUserPassword must be of type String'. How should the DevOps engineer resolve this issue?

Accepted Answer

Use the dynamic reference '{{resolve:secretsmanager:MySecret:SecretString:password}}' in the CloudFormation template.. Option C is correct because CloudFormation supports dynamic references, which allow you to retrieve secret values from AWS Secrets Manager at stack creation time using the syntax `{{resolve:secretsmanager:secret-id:secret-string:json-key}}`. This resolves the password as a plaintext string directly in the template, satisfying the `MasterUserPassword` property's requirement for a String type. Other intrinsic functions like `Ref` or `Fn::GetAtt` return ARNs or metadata, not the secret value itself, and cannot be used directly for this purpose.

Answer

Use the Fn::ImportValue intrinsic function to import the secret value.

Answer

Use the Ref intrinsic function to reference the secret.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the secret value from Secrets Manager.

Question 9

Refer to the exhibit. The IAM policy above is attached to a Lambda function's execution role. The Lambda function is supposed to publish custom metrics to CloudWatch using PutMetricData. However, the metrics are not appearing. What is the most likely reason?

Accepted Answer

The function needs to specify a metric name and value when calling PutMetricData.. Option B is correct because the policy allows cloudwatch:PutMetricData on resource "*", which is sufficient to publish custom metrics. However, the issue could be that the Lambda function does not have the necessary permissions to create the metric namespace or that the function is not calling the API correctly. But among the options, the most plausible is that the function might be using a different action or missing permissions, but the policy shown seems correct. Actually, the correct answer is that the policy is missing the 'cloudwatch:PutMetricData' action? No, it has it. Let's analyze: The policy allows PutMetricData, so that is not the issue. Option A is wrong because it does have the action. Option C is wrong because wildcard resource is allowed for PutMetricData. Option D is wrong because the function can call PutMetricData without specifying a metric. So perhaps the issue is that the function is not running or the code is incorrect. However, the question asks the most likely reason given the exhibit. The exhibit shows a permissive policy, so the function should be able to publish metrics. Therefore, the problem is likely outside the scope of the policy, such as the function not executing or an error in the code. But among the options, Option B is the only one that points to a missing permission? Actually, the policy includes PutMetricData, so Option B is incorrect. Let me re-read: Option B says 'The policy does not include the 'cloudwatch:PutMetricData' action.' But it does! So that is false. Option A says 'The policy includes unnecessary actions.' That would not prevent metrics from appearing. Option C says 'The policy uses a wildcard resource.' That is not a problem. Option D says 'The function needs to specify a metric name and value.' That is true but not a policy issue. Since the question is about the IAM policy, the most likely reason is that the policy is missing a required action? But it has PutMetricData. So maybe the correct answer is that the function is not calling the API correctly. But the options are limited. Perhaps I misread: The exhibit shows the policy, and the answer might be that the resource should not be '*' but specific. However, PutMetricData does not support resource-level permissions; it must be '*'. So Option C is actually correct in that the wildcard is required. So the policy is correct. Then the issue is likely that the function is not invoking the API. But the question asks for the most likely reason based on the exhibit. Given the exhibit, the policy is correct, so the issue must be elsewhere. Option D says 'The function needs to specify a metric name and value.' That is a requirement of the API call, not the policy. So the most likely reason from the options could be that the function is missing the metric specification. But that is not a policy issue. I think the intended answer might be that the policy does not include the necessary permissions, but it does. Let me check the options again: A) The policy includes unnecessary actions. B) The policy does not include the 'cloudwatch:PutMetricData' action. (But it does) C) The policy uses a wildcard resource, which is not allowed for PutMetricData. (Actually, PutMetricData requires resource '*', so this is false) D) The function needs to specify a metric name and value. This is true but not a policy issue. Since the question is about why metrics are not appearing, and the policy seems correct, the most likely reason is that the function code is incorrect. However, the exam expects that PutMetricData requires a resource of '*', so the policy is correct. So the answer might be that the policy is fine, and the function is misconfigured. But none of the options say that. Option D is the closest to a functional issue. Given the constraints, I'll go with D. But to align with typical DOP-C02 questions, the correct answer is often that the policy needs specific actions. Since the policy has PutMetricData, maybe the issue is that the function is not using the correct namespace or metric name, but that is not listed. I'll choose D.

Answer

The policy does not include the 'cloudwatch:PutMetricData' action.

Answer

The policy includes unnecessary actions that conflict with each other.

Answer

The policy uses a wildcard resource, which is not allowed for the PutMetricData action.

Question 10

A company is using AWS CloudFormation to manage its infrastructure. The DevOps team wants to implement drift detection to identify resources that have been modified outside of CloudFormation. Which TWO of the following are correct statements about CloudFormation drift detection?

Accepted Answer

Drift detection can detect changes to resources such as security groups.. Drift detection can detect changes to resources such as security groups because CloudFormation supports drift detection for a wide range of AWS resources, including EC2 security groups. When drift detection is performed, CloudFormation compares the current configuration of each supported resource in the stack with the expected configuration defined in the stack template. If a security group rule is added or removed outside of CloudFormation (e.g., via the AWS Console or CLI), drift detection will report that resource as drifted.

Answer

Drift detection is automatically performed every time the stack is updated.

Answer

Drift detection can be performed on nested stacks independently.

Answer

Drift detection automatically reverts any changes to the original template.

Question 11

A company uses AWS CloudFormation to manage its infrastructure. The Operations team needs to update a stack that contains an EC2 instance. They want to change the instance type from t2.micro to t2.small without recreating the instance. Which CloudFormation stack update policy should they use?

Accepted Answer

Use an UpdatePolicy with AutoScalingRollingUpdate. Option D is correct because the 'UpdatePolicy: AutoScalingRollingUpdate' attribute can be used to update instance types without interruption when associated with an Auto Scaling group or EC2 instances with a creation policy. Option A is wrong because Replacement policy dictates whether to replace or update a resource. Option B is wrong because CreationPolicy is used to wait for signals before considering the resource created. Option C is wrong because DeletionPolicy only defines what happens when a resource is deleted.

Answer

Use a ChangeSet with Replacement set to False

Answer

Use a CreationPolicy with a Timeout

Answer

Use a DeletionPolicy with Retain

Question 12

A DevOps team is using AWS CodeDeploy to deploy a web application. The deployment group consists of an Auto Scaling group with a minimum of 2 instances. They want to ensure high availability during the deployment. Which THREE of the following deployment configurations support zero-downtime deployments?

Accepted Answer

Deployment type: Rolling, with a batch size of 1 and a wait time between batches.. Option A is correct because a rolling deployment with a batch size of 1 and a wait time between batches updates one instance at a time, keeping the remaining instances in service. This ensures that the Auto Scaling group never drops below its minimum capacity, maintaining full availability throughout the deployment process.

Answer

Deployment type: Canary, with 10% traffic shift initially.

Answer

Deployment type: In-place, with a batch size of 50%.

Question 13

A company is adopting Infrastructure as Code (IaC) using AWS CloudFormation. They want to ensure that stack updates are safe and minimize the risk of resource replacement. Which TWO of the following strategies should they use?

Accepted Answer

Always create a change set before executing a stack update.. Creating a change set before executing a stack update allows you to review the proposed changes, including whether any resources will be replaced or interrupted. This provides a safety net by letting you validate the impact of the update before committing, reducing the risk of unintended resource replacement.

Answer

Perform updates directly from the AWS Management Console to see immediate results.

Answer

Delete the stack and create a new one with the updated template.

Answer

Use the --disable-rollback flag to avoid unnecessary rollbacks.

Question 14

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that fails during the 'BeforeInstall' lifecycle event. The deployment group uses an in-place deployment to an Auto Scaling group. The engineer reviews the logs on the instance and sees that the 'BeforeInstall' script exits with code 1. The script is a shell script that compiles application code. What is the most likely cause of the failure?

Accepted Answer

The script exited with a non-zero exit code. Option B is correct because CodeDeploy expects scripts to exit with 0 for success; any non-zero exit code is treated as a failure and the deployment stops. Option A is wrong because missing dependencies would typically cause compilation errors, but the script still exits with non-zero. Option C is wrong because CodeDeploy does not require scripts to be owned by root; any user with execute permission can run them. Option D is wrong because the script should be in the appspec.yml's 'files' section.

Answer

The script is not included in the 'files' section of the appspec.yml

Answer

The script requires dependencies that are not installed on the instance

Answer

The script is not owned by the root user

Question 15

A company uses AWS Systems Manager to manage its EC2 instances at scale. The DevOps team wants to ensure that all instances are patched with the latest security updates. Which Systems Manager capability should they use to automate patching?

Accepted Answer

Patch Manager. Option C is correct because Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates. Option A is wrong because State Manager is used to define and maintain consistent configuration, not specifically patching. Option B is wrong because Automation is used for common maintenance and deployment tasks but not specifically for patching. Option D is wrong because Run Command is used to execute scripts or commands remotely, not for automated patching.

Answer

Run Command

Answer

Automation

Answer

State Manager