DOP-C02 Practice Test 43 — 15 Questions

Question 1

A development team is using AWS CodeCommit as a source repository and AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a build stage that runs on AWS CodeBuild. The team wants to automatically trigger the pipeline when changes are pushed to the 'develop' branch of the CodeCommit repository. Which configuration change should be made to the pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the source action to use CodeCommit as the source provider and specify the 'develop' branch.. CodePipeline's source action can be configured to use CodeCommit as the source provider, and by specifying the 'develop' branch in the source action configuration, the pipeline will automatically start a new execution whenever a change is pushed to that branch. This is the native and recommended way to trigger a pipeline from a CodeCommit repository branch change, without needing additional webhooks or event notifications.

Answer

Enable S3 event notifications on the repository to invoke the pipeline.

Answer

Add a manual approval action before the build stage.

Answer

Create a CodeBuild webhook on the CodeCommit repository.

Question 2

A company runs a critical application on AWS that uses an Auto Scaling group of EC2 instances. The application must remain available even if an entire Availability Zone fails. Which THREE actions should the company take?

Accepted Answer

Configure an ALB health check to automatically replace unhealthy instances.. Configuring an ALB health check allows the Auto Scaling group to automatically detect and replace unhealthy instances. The ALB health check pings the instances at a specified interval (e.g., every 30 seconds) and marks them as unhealthy if they fail to respond. This triggers the Auto Scaling group to terminate the unhealthy instance and launch a new one, maintaining application availability even if an instance fails within a single AZ.

Answer

Use a single instance in each Availability Zone to minimize cost.

Answer

Use multiple subnets in each Availability Zone for the instances.

Question 3

A DevOps engineer is reviewing the IAM policy attached to a CodeBuild service role. The policy allows starting builds and viewing logs. However, when CodeBuild tries to download artifacts from an S3 bucket in the same account, it fails with an access denied error. What is the missing permission?

Accepted Answer

s3:GetObject. The error occurs because CodeBuild needs to download artifacts from S3, which requires the s3:GetObject permission on the bucket or object. Without this permission, the service role cannot read the artifact files, even though it can start builds and view logs. The s3:GetObject action is the specific permission that grants read access to S3 objects.

Answer

kms:Decrypt

Answer

s3:PutObject

Answer

logs:DescribeLogGroups

Question 4

A DevOps engineer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment'. The engineer checks the logs and finds that the application installation script exits with a non-zero exit code. What should the engineer do to troubleshoot?

Accepted Answer

SSH into one of the failed instances and run the install script manually to identify the error. The deployment failure is caused by the application installation script exiting with a non-zero exit code, which indicates a specific error in the script or its environment. SSHing into a failed instance and running the install script manually allows the engineer to see the exact error output, debug the script logic, and identify missing dependencies or configuration issues directly on the target host.

Answer

Configure CloudWatch Logs to capture the script output

Answer

Increase the deployment's MinHealthyHosts percentage

Answer

Re-upload the application revision to S3

Question 5

A DevOps engineer is tasked with automating the deployment of a microservices architecture. Each service is packaged as a Docker container. The team wants to use AWS CodePipeline and AWS CodeBuild to build Docker images and push them to Amazon ECR, then deploy to Amazon ECS. What should the CodeBuild buildspec file include to push the image to ECR?

Accepted Answer

Docker build and docker push commands with AWS CLI to authenticate to ECR.. To push a Docker image to Amazon ECR, the buildspec must first authenticate Docker to the ECR registry using the AWS CLI's `aws ecr get-login-password` command piped to `docker login`, then build the image with `docker build`, tag it with the ECR repository URI, and finally push it with `docker push`. CodeBuild does not have a built-in 'ecr-push' action; it relies on executing these standard Docker and AWS CLI commands in the build phases.

Answer

A call to the AWS CodeDeploy API to push the image.

Answer

An invocation of the AWS ECS RunTask API.

Answer

A buildspec phase with 'ecr-push' action.

Question 6

A company uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that creates an Amazon RDS DB instance. The database password must be stored securely and rotated automatically. Which approach meets these requirements?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation. Reference the secret in the template using a dynamic reference.. AWS Secrets Manager provides built-in capabilities for automatic password rotation, which is a requirement. By storing the password in Secrets Manager and referencing it in the CloudFormation template using a dynamic reference (e.g., `{{resolve:secretsmanager:secret-id:SecretString:password}}`), the password is never exposed in the template or parameter logs, and rotation can be configured without updating the stack. This approach meets both security and automation requirements.

Answer

Hardcode the password in the CloudFormation template and use a NoEcho parameter.

Answer

Use AWS Key Management Service (KMS) to encrypt the password and pass it as a parameter.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it using a dynamic reference.

Question 7

A DevOps engineer is troubleshooting an application that runs on Amazon EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. CloudWatch metrics for the ALB show an increase in 'HTTPCode_ELB_5XX_Count' but the backend 'HealthyHostCount' remains stable. Which action should the engineer take to identify the root cause?

Accepted Answer

Enable and review the ALB access logs stored in Amazon S3 to analyze the HTTP response codes and request patterns.. ALB access logs capture detailed information about each request, including HTTP status codes, request processing times, and target response times. By analyzing these logs in Amazon S3, the engineer can identify which specific requests are resulting in 503 errors, examine if there are patterns such as high latency or target unavailability, and determine the root cause. Option A is incorrect because increasing instance size does not address the intermittent 503 errors; if the instances are healthy (HealthyHostCount stable), the issue is likely not capacity but something else like configuration or request handling. Option B is incorrect because detailed CloudWatch metrics on instances, while useful for performance, would not directly reveal why the ALB is returning 503 errors; the backend might be healthy but returning errors or timing out. Option D is incorrect because increasing the idle timeout would only help if requests are being dropped due to idle connections, but 503 errors typically indicate that the targets are not responding or are returning errors, not idle timeouts.

Answer

Increase the size of the EC2 instances to handle more requests.

Answer

Enable detailed CloudWatch metrics on the EC2 instances to monitor CPU and memory.

Answer

Increase the idle timeout setting on the ALB.

Question 8

A team uses AWS CodePipeline with a source action from an Amazon S3 bucket. The pipeline triggers on changes to the S3 bucket, but sometimes runs twice for a single commit. What is the most likely cause?

Accepted Answer

S3 event notifications for the same object may be delivered more than once.. Amazon S3 event notifications are designed for at-least-once delivery, meaning the same event (e.g., an object PUT) can be delivered multiple times. When CodePipeline uses S3 as a source, it relies on these notifications to trigger the pipeline. If S3 sends duplicate notifications for the same object version, CodePipeline will start a new execution for each notification, causing the pipeline to run twice for a single commit.

Answer

CodePipeline has a deduplication setting that is disabled.

Answer

The S3 bucket has versioning enabled.

Answer

The pipeline is also triggered by a CloudWatch Events rule.

Question 9

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The DevOps team has enabled detailed CloudWatch metrics for the ALB and is using CloudWatch Logs for the EC2 instances. Recently, users report intermittent 503 errors. The team notices that the ALB's 'RequestCount' metric shows a sudden drop during error periods, while the 'ActiveConnectionCount' remains steady. Which TWO steps should the team take to diagnose the issue? (Choose two.)

Accepted Answer

Enable and analyze the ALB access logs to see the HTTP response codes and target processing time.. ALB access logs contain detailed per-request data, including HTTP response codes (e.g., 503) and target processing time. Analyzing these logs will reveal whether the 503 errors are coming from the ALB itself (e.g., due to request queue overflow) or from the targets, and whether the sudden drop in RequestCount is due to clients aborting or the ALB throttling requests.

Answer

Check the Amazon Route 53 health checks for the ALB DNS name.

Answer

Review the EC2 instances' CloudWatch metrics for CPU utilization and network traffic.

Answer

Inspect AWS CloudTrail logs for the ALB to see if there are any configuration changes.

Question 10

A DevOps engineer is setting up a CI/CD pipeline for a microservices architecture. The team uses AWS CodeCommit, CodeBuild, and CodeDeploy. The engineer needs to ensure that the pipeline can automatically roll back the deployment if the health checks fail after deployment. Which action should the engineer take?

Accepted Answer

Configure the deployment group to roll back when a CloudWatch alarm is triggered.. CodeDeploy natively supports automatic rollbacks triggered by CloudWatch alarms. By configuring the deployment group to monitor a CloudWatch alarm (e.g., based on ELB health check metrics), CodeDeploy will automatically initiate a rollback to the last known good revision if the alarm enters the ALARM state, ensuring health check failures are handled without custom scripting.

Answer

Use AWS Lambda to monitor health checks and trigger a rollback via the CodeDeploy API.

Answer

Set up the deployment group to use blue/green deployment with traffic shifting.

Answer

Configure the pipeline to have a manual approval step after deployment.

Question 11

A developer wants to automatically run unit tests when a pull request is created in AWS CodeCommit. Which AWS service should be used to trigger the tests?

Accepted Answer

Amazon EventBridge rule for CodeCommit pull request state changes targeting AWS Lambda.. Amazon EventBridge can capture CodeCommit pull request state changes (e.g., created, updated, merged) via a rule and route them to a target like AWS Lambda. The Lambda function can then invoke unit tests in response to the pull request creation event. This provides a serverless, event-driven trigger without polling or webhooks.

Answer

AWS CodePipeline with source polling.

Answer

AWS CodeBuild with webhooks from CodeCommit.

Answer

AWS CloudWatch Logs subscription filter for repository logs.

Question 12

A company uses AWS CodePipeline to automate their software release process. They want to add a stage that runs security scanning on the code before deployment. Which two AWS services can be integrated into the pipeline for this purpose? (Choose TWO.)

Accepted Answer

Amazon Inspector. Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It can be integrated into a CodePipeline stage to perform automated security scanning on the code or infrastructure before deployment, helping to identify issues early in the SDLC.

Answer

Amazon GuardDuty

Answer

Amazon Detective

Answer

AWS CodeDeploy

Question 13

Refer to the exhibit. The S3 bucket policy is applied to a bucket. An application attempts to upload an object to the bucket using HTTP (not HTTPS). What will happen?

Accepted Answer

The upload fails because the condition matches HTTP requests. The bucket policy includes an explicit deny for all S3 actions when aws:SecureTransport is false (i.e., HTTP). This deny overrides any allow policies, so the upload fails. Option A is correct because the condition matches HTTP requests. Option B is incorrect because the explicit deny overrides any allow. Option C is incorrect because the deny is explicit, so the condition is evaluated. Option D is incorrect because the policy only denies HTTP, not HTTPS.

Answer

The upload succeeds if the bucket also has an allow policy for the user

Answer

The upload succeeds because there is no explicit allow statement

Answer

The upload fails because the bucket policy does not allow any access

Question 14

A company uses AWS CodeDeploy for application deployments. They want to ensure that if a deployment fails, the system automatically rolls back to the previous version. Which configuration should they set?

Accepted Answer

Configure the deployment group to enable automatic rollback when a deployment fails.. AWS CodeDeploy provides a built-in automatic rollback feature that can be configured at the deployment group level. When enabled, CodeDeploy automatically reverts the deployment to the last known successful version if the deployment fails or reaches a specified alarm threshold, without requiring custom scripting or external orchestration.

Answer

Define a 'Failure' lifecycle event hook that calls a Lambda function to revert the deployment.

Answer

Set the 'auto-rollback' property in the CodeDeploy deployment group to 'true'.

Answer

Use a CloudFormation stack with a rollback configuration.

Question 15

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team notices that stack updates sometimes fail because of resource conflicts. The team wants to prevent concurrent updates to the same stack. What should they do?

Accepted Answer

No action needed; CloudFormation already prevents concurrent stack updates. AWS CloudFormation inherently prevents concurrent updates to the same stack. When an update operation is initiated, CloudFormation places a lock on the stack, rejecting any subsequent update requests until the current operation completes. This behavior is built into the service and requires no additional configuration, making option C correct.

Answer

Use an AWS Organizations service control policy to restrict updates

Answer

Create an IAM policy that denies cloudformation:UpdateStack if a stack update is in progress

Answer

Enable CloudTrail to log all stack update attempts and manually review