DOP-C02 Practice Test 41 — 15 Questions

Question 1

A company uses AWS OpsWorks for configuration management. They have a stack with a layer that includes several EC2 instances. The DevOps engineer needs to deploy a custom configuration file to all instances in the layer. What is the recommended approach?

Accepted Answer

Create a custom Chef recipe and assign it to the layer's lifecycle events. Option A is correct because OpsWorks allows custom recipes to be associated with lifecycle events, which can deploy configuration files. Option B is wrong because custom JSON is for overriding stack settings, not for deploying files. Option C is wrong because user data only runs at launch. Option D is wrong because Run Command is for ad-hoc commands, not for ongoing configuration management.

Answer

Use custom JSON in the stack settings to specify the file content

Answer

Use AWS Systems Manager Run Command to copy the file

Answer

Add the file to the instance's user data script

Question 2

A DevOps engineer runs the above command and sees that one target is unhealthy with a 503 error. The application is a web server running on port 80. The health check is configured to hit the root path '/'. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the application on the unhealthy instance is configured to respond to '/' with a 200 status code. A 503 error indicates the web server is running but cannot handle the request, likely because the application is not responding correctly to the health check path. Option A is wrong because a 503 means the server is reachable. Option C is wrong because the health check is already on port 80. Option D is wrong because a 503 is not a connection timeout.

Answer

Change the health check port to 443 and use HTTPS

Answer

Increase the health check interval and timeout settings

Answer

Check the security group rules for the target group to ensure port 80 is open

Question 3

A company uses Terraform to manage AWS infrastructure. They have a state file stored in an S3 bucket with DynamoDB locking. After a failed 'terraform apply', the state file is locked. The DevOps engineer tries to run 'terraform plan' but gets an error: 'Error acquiring the state lock'. What should the engineer do to resolve this issue?

Accepted Answer

Run 'terraform force-unlock' with the lock ID. Option D is correct because the lock is stored in DynamoDB and can be forcefully removed using 'terraform force-unlock' after verifying no other process is using it. Option A is wrong because deleting the S3 bucket would lose the state. Option B is wrong because modifying the DynamoDB table directly is not recommended. Option C is wrong because waiting indefinitely is not a solution.

Answer

Manually delete the lock item from the DynamoDB table

Answer

Wait for the lock to expire automatically

Answer

Delete the state file from S3 and re-run terraform init

Question 4

A company uses AWS CloudFormation to deploy a multi-tier application. The stack includes an Application Load Balancer (ALB), an Auto Scaling group, and an RDS database. The DevOps engineer needs to update the stack to change the DB instance type. The engineer wants to minimize downtime. Which strategy should they use?

Accepted Answer

Create a new DB instance with the new type, update the application stack to point to the new DB, then remove the old DB. Option D is correct because using a 'Replacement' update policy for the DB instance will create a new DB instance and then delete the old one. However, to minimize downtime, the engineer can create a new DB instance first (by updating the logical ID) and then update the application to point to the new one before removing the old one. Option A is wrong because updating in place causes downtime. Option B is wrong because creating a new stack and migrating traffic is possible but not the best practice for a single stack. Option C is wrong because Multi-AZ is for high availability, not for updates.

Answer

Create a new CloudFormation stack with the new DB instance type and update DNS to point to the new DB

Answer

Modify the DB instance to use Multi-AZ deployment before the update

Answer

Update the stack directly by changing the DBInstanceType property

Question 5

A company uses AWS Elastic Beanstalk to deploy a Java web application. The DevOps team wants to ensure that configuration changes are tracked and can be rolled back if needed. Which Elastic Beanstalk feature should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations to capture environment settings and restore them if needed.. Option B is correct because Elastic Beanstalk saved configurations allow you to capture and restore environment settings. Option A is wrong because CloudFormation change sets are for CloudFormation stacks, not Elastic Beanstalk. Option C is wrong because Jenkins is a CI/CD tool, not a configuration management feature. Option D is wrong because CodeCommit is a source control service.

Answer

Use AWS CodeCommit to store configuration files and version them.

Answer

Use AWS CodePipeline with a manual approval stage to track changes.

Answer

Use AWS CloudFormation change sets to review changes before deployment.

Question 6

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The DevOps engineer notices that the pipeline fails intermittently during the deploy stage with the error: 'The deployment failed because the deployment group does not exist'. What is the most likely cause?

Accepted Answer

The deployment group was deleted or renamed after the pipeline was configured. Option B is correct because the deployment group is configured in CodeDeploy, and if the pipeline's deploy stage references a deployment group that does not exist, it will fail. Option A is wrong because IAM roles would cause a different error. Option C is wrong because insufficient capacity would cause a deployment error, not a missing group. Option D is wrong because the application name would also cause a different error.

Answer

The Auto Scaling group associated with the deployment group has insufficient capacity

Answer

The CodePipeline service role does not have permission to call CodeDeploy

Answer

The CodeDeploy application name in the pipeline is misspelled

Question 7

A company uses AWS CodeBuild to compile and test code. The buildspec.yml file includes commands that require access to a private S3 bucket. The DevOps engineer wants to securely provide AWS credentials to the build project. What is the recommended approach?

Accepted Answer

Use a service role for CodeBuild with appropriate permissions. Option C is correct because the recommended approach is to use a CodeBuild service role that grants access to the S3 bucket. Option A is wrong because access keys should not be hardcoded. Option B is wrong because instance profiles are for EC2, not CodeBuild. Option D is wrong because environment variables are not secure.

Answer

Store the AWS access key ID and secret access key in the buildspec.yml file

Answer

Use an EC2 instance profile attached to the build environment

Answer

Pass the credentials as environment variables in the build project configuration

Question 8

A company uses AWS CloudFormation to manage infrastructure. They have a nested stack that creates an ECS cluster. The parent stack fails with the error: 'The following resource(s) failed to create: [ECSCluster]'. Which TWO are possible causes? (Choose TWO.)

Accepted Answer

The parent stack's IAM role does not have permission to create the nested stack's resources. Options A and B are correct. A: The parent stack might not have permission to create the nested stack's resources because of insufficient IAM permissions. B: The nested stack template might contain syntax errors. Option C is wrong because nested stacks can be in a different region if using cross-region references. Option D is wrong because the nested stack's name does not need to be unique globally. Option E is wrong because outputs from nested stacks can be used by the parent.

Answer

The parent stack is referencing an output from the nested stack that does not exist

Answer

The nested stack is in a different AWS region from the parent stack

Answer

The nested stack's name is not unique among all stacks in the account

Question 9

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the latest security patches are applied to all instances. Which THREE steps should they include in their Ansible playbook? (Choose THREE.)

Accepted Answer

Use the 'command' module to run 'yum update -y'. Options A, B, and D are correct. A: Using the 'yum' module to update packages. B: Using the 'command' module to run 'yum update -y'. D: Using the 'package' module to update all packages. Option C is wrong because the 'service' module is for managing services, not patching. Option E is wrong because 'copy' is for files, not package updates.

Answer

Use the 'service' module to restart services after patching

Answer

Use the 'copy' module to download patch files

Question 10

A company uses AWS Config to evaluate resource compliance. They have a custom AWS Config rule that checks whether EC2 instances have a specific tag. The rule is triggered by configuration changes. The DevOps engineer notices that the rule evaluation results show 'NON_COMPLIANT' for some instances that actually have the tag. Which TWO could be causes? (Choose TWO.)

Accepted Answer

The Lambda function that evaluates the rule has a logic error. Options A and D are correct. A: The custom lambda function might have a bug. D: The AWS Config rule might not be using the correct resource type. Option B is wrong because AWS Config does not use CloudTrail for triggering. Option C is wrong because the rule's maximum execution frequency is not relevant for change-triggered rules. Option E is wrong because the IAM role for AWS Config might not have permission to invoke the Lambda function, but that would cause a different error.

Answer

The rule's maximum execution frequency is set to 24 hours

Answer

The rule is not being triggered by CloudTrail events

Answer

The AWS Config service role does not have permission to invoke the Lambda function

Question 11

A company is using AWS CloudFormation to deploy a multi-tier application. The DevOps team wants to ensure that the database password is not exposed in the template or the console. Which two methods should they use to securely manage the password? (Choose TWO.)

Accepted Answer

Use a CloudFormation parameter with the NoEcho property set to true.. Option A and D are correct. Using AWS Secrets Manager dynamically references the secret value without exposing it. Using a NoEcho parameter prevents the password from being displayed in the console. Option B is wrong because hardcoding is insecure. Option C is wrong because Systems Manager Parameter Store does not have a NoEcho property. Option E is wrong because user data is not secure.

Answer

Hardcode the password in the template and use a condition to only apply it in production.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it with {{resolve:ssm:...}}

Answer

Pass the password as user data to the EC2 instance and encrypt the user data.

Question 12

A DevOps team is designing a CI/CD pipeline for a microservices application using AWS CodePipeline. They want to incorporate infrastructure as code (IaC) using AWS CloudFormation. Which three practices should they follow to ensure reliable and repeatable deployments? (Choose THREE.)

Accepted Answer

Use the same CloudFormation template across all environments, with parameterization for environment-specific values.. Options A, C, and E are correct. Option A ensures consistency across environments. Option C prevents configuration drift. Option E ensures stack updates are safe. Option B is wrong because creating a single large template is not a best practice; modular templates are recommended. Option D is wrong because skipping change sets can lead to unintended changes.

Answer

Create a single monolithic template for all microservices to simplify management.

Answer

Skip change sets during stack updates to speed up the pipeline.

Question 13

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an AWS::EC2::Instance with a UserData script. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]. The requested configuration is currently not supported. Please check the documentation for supported configurations.' The engineer suspects the instance type is not supported in the selected Availability Zone. Which action should the engineer take to resolve this issue and ensure successful stack creation?

Accepted Answer

Add an Availability Zone parameter and map it to an AZ that supports the instance type, or use the AWS::EC2::Instance AvailabilityZone property to specify an AZ that supports the instance type.. Option C is correct because specifying AllowedPattern in the template for the instance type parameter is not relevant; the solution is to use the AWS::EC2::Instance property AvailabilityZone to explicitly set an AZ that supports the instance type, or use a parameter to select an AZ. Option A is wrong because OpsWorks is not needed. Option B is wrong because it only changes the region, not the availability zone within the region. Option D is wrong because changing the instance type to a previous generation might not be desired and does not address the AZ constraint.

Answer

Use AWS OpsWorks to deploy the instance instead of CloudFormation.

Answer

Change the instance type to a previous generation that is supported in all AZs.

Answer

Modify the template to specify a different region that supports the instance type.

Question 14

A company deploys the above CloudFormation stack. They want to enforce HTTPS for all requests to the S3 bucket. After deployment, users are still able to make HTTP requests. What is the problem?

Accepted Answer

The Deny statement's Resource specifies only the objects, not the bucket itself. The Deny policy only applies to objects in the bucket (Resource: arn:aws:s3:::bucket/*), but not to the bucket itself. Actions like listing objects (s3:ListBucket) are denied only if the resource is the bucket itself. Option A is wrong because the bucket is versioned, but that doesn't affect encryption. Option B is wrong because the Condition is correct. Option D is wrong because the policy uses Deny, which overrides Allow.

Answer

The condition key 'aws:SecureTransport' is misspelled; it should be 'aws:SecureTransport' with a capital 'T'

Answer

The bucket is not versioned, so the policy does not apply to object versions

Answer

The policy uses Deny, but an Allow policy from another statement overrides it

Question 15

Drag and drop the steps to set up an AWS CloudFormation stack with a nested stack.