DOP-C02 Practice Test 44 — 15 Questions

Question 1

A company uses AWS CodePipeline with multiple stages: Source, Build, Test, Deploy. The Test stage runs integration tests using AWS CodeBuild. If the Test stage fails, what happens to the pipeline execution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pipeline execution stops and the status is set to 'Failed'.. In AWS CodePipeline, by default, if a stage (such as Test) fails, the pipeline execution immediately stops and the overall pipeline status is set to 'Failed'. This is because CodePipeline treats each stage as a sequential gate; a failure in any stage blocks progression to subsequent stages unless explicitly configured otherwise (e.g., with a 'Blocker' or 'Manual Approval' action). Option B correctly describes this default behavior.

Answer

The pipeline continues to the next stage but marks the Test stage as failed.

Answer

The pipeline skips the Test stage and proceeds to Deploy.

Answer

The pipeline automatically retries the Test stage up to three times.

Question 2

Refer to the exhibit. The above IAM policy is attached to an IAM role used by a CI/CD pipeline. Which action is this policy allowing?

Accepted Answer

Start and view builds for the specified CodeBuild project.. The IAM policy grants `codebuild:StartBuild` and `codebuild:BatchGetBuilds` actions, which allow starting a build and viewing build details respectively. The `Resource` element restricts these permissions to the specific CodeBuild project `arn:aws:codebuild:us-east-1:123456789012:project/my-project`. Therefore, the policy allows starting and viewing builds for that single project, not any project in the account.

Answer

Start builds for any CodeBuild project in the account.

Answer

View details of any build in the account.

Answer

Create and manage CodeBuild projects.

Question 3

A DevOps engineer needs to set up an alert for when the CPU utilization of an EC2 instance exceeds 90% for 5 consecutive minutes. Which CloudWatch features should be used?

Accepted Answer

CloudWatch alarm on the CPUUtilization metric with a period of 5 minutes and threshold of 90.. CloudWatch alarms can be configured on the `CPUUtilization` metric (a standard EC2 metric emitted every 5 minutes by default) with a threshold of 90 and an evaluation period of 1 (since the period is set to 5 minutes, one evaluation period covers the 5 consecutive minutes). This directly meets the requirement without additional setup.

Answer

CloudWatch Logs with a metric filter on CPU utilization logs.

Answer

CloudTrail to monitor EC2 instance CPU usage.

Answer

Amazon S3 server access logs to check CPU utilization.

Question 4

An organization uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that minifies assets), and a deploy stage (S3 deployment). The team wants to add a stage for running security vulnerability scans on the code. Which TWO options are viable?

Accepted Answer

Add a custom action in the pipeline that invokes a third-party scanning service via AWS Lambda.. AWS CodePipeline supports custom actions that can invoke external services via AWS Lambda. By creating a custom action, the team can integrate a third-party security scanning service directly into the pipeline, allowing the scan to run as a distinct stage between build and deploy. This approach ensures that the pipeline fails if vulnerabilities are detected, preventing insecure code from reaching the S3 bucket.

Answer

Enable AWS Shield Advanced to scan for vulnerabilities.

Answer

Use Amazon Inspector to scan the source code.

Answer

Add an S3 event notification to trigger a Lambda function that scans the S3 bucket.

Question 5

Refer to the exhibit. A team uses this buildspec.yml in AWS CodeBuild. The build fails because the 'dist' directory does not exist after the build phase. What is the most likely cause?

Accepted Answer

The build command outputs to a 'build' directory, but the artifacts base-directory is set to 'dist'.. The buildspec's build phase runs `python setup.py build`, which by default writes compiled output into a `build` directory at the project root (distutils/setuptools default build_base). However, the `artifacts` section specifies `base-directory: dist`, so CodeBuild looks for output in a `dist` folder that setup.py build never creates (that name is used by `setup.py sdist`/`bdist_wheel`, not the plain `build` subcommand). Because the actual output lives in `build` and `dist` is empty or missing, CodeBuild fails during artifact upload. To fix this, either point base-directory at `build` or change the build command to produce output under `dist`.

Answer

The buildspec version is incorrect.

Answer

The Python runtime version 3.8 is not available in CodeBuild.

Answer

The requirements.txt file is missing from the source code.

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail logs. What is the most effective way to enforce this control?

Accepted Answer

Apply a Service Control Policy that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging.. A Service Control Policy (SCP) applied at the organization or OU level is the most effective way to prevent member accounts from disabling CloudTrail or deleting logs because SCPs are enforced by AWS Organizations and cannot be overridden by account-level IAM policies, including root user actions. Denying cloudtrail:DeleteTrail and cloudtrail:StopLogging at the SCP level creates a hard guardrail across all accounts in scope. This is the canonical AWS Organizations security control pattern.

Answer

Require all accounts to use the same CloudTrail trail.

Answer

Create an IAM policy in each account that denies cloudtrail:DeleteTrail.

Answer

Configure CloudTrail to log to an S3 bucket in a centralized logging account and deny access to the bucket from member accounts.

Question 7

A DevOps team is designing a deployment pipeline for a microservices application on Amazon ECS using AWS CodePipeline. They want to implement a canary deployment strategy where a small percentage of traffic is routed to the new version before fully promoting it. Which AWS service or feature should they use to achieve this?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment. AWS CodeDeploy with ECS blue/green deployment is the correct choice because it natively supports canary traffic shifting for Amazon ECS services. When integrated with AWS CodePipeline, CodeDeploy can route a small percentage of traffic (e.g., 10%) to the new task set, monitor it with CloudWatch alarms, and then automatically shift the remaining traffic after a specified interval. This is the only option that directly provides the canary deployment lifecycle within the ECS and CodePipeline context.

Answer

Amazon ECS Service Auto Scaling

Answer

Amazon Route 53 weighted routing

Answer

AWS App Mesh with traffic shifting

Question 8

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline deploys a static website to an S3 bucket. The deployment must ensure that the website is always available and that rollbacks happen automatically if the deployment fails. Which TWO actions should the company take?

Accepted Answer

Use a blue/green deployment strategy with two S3 buckets. A blue/green deployment strategy with two S3 buckets allows the company to maintain the current (blue) bucket serving the live website while deploying the new version to a separate (green) bucket. This ensures zero-downtime deployments and, if the deployment fails, traffic can simply remain pointed to the blue bucket, providing an automatic rollback without any manual intervention. Option D is correct because AWS CloudFormation can be configured with automatic rollback on failure, which will revert the stack to its last known good state if the deployment fails, ensuring the website remains available.

Answer

Use Amazon Route53 weighted routing to shift traffic

Answer

Use AWS CodeDeploy with an in-place deployment

Answer

Enable S3 bucket versioning to keep multiple versions

Question 9

A company is running a critical application on Amazon ECS with Fargate. The application generates custom metrics that are published to CloudWatch using the PutMetricData API. Recently, the metrics have been delayed by up to 5 minutes. The DevOps team needs to reduce the latency. What should the team do?

Accepted Answer

Set the StorageResolution parameter to 1 when calling PutMetricData.. Setting the StorageResolution parameter to 1 when calling PutMetricData enables high-resolution metrics with a 1-second granularity. This reduces the latency of metric ingestion and retrieval because CloudWatch processes high-resolution metrics more quickly than standard 60-second resolution metrics, addressing the 5-minute delay.

Answer

Install the CloudWatch agent on the Fargate tasks to collect metrics.

Answer

Publish the metrics as structured logs to CloudWatch Logs and use metric filters.

Answer

Increase the frequency of PutMetricData calls to every 5 seconds.

Question 10

Which THREE components are required to set up a fully automated CI/CD pipeline for a static website hosted on Amazon S3 using AWS CodePipeline? (Choose THREE.)

Accepted Answer

An AWS CodeBuild project to run build commands (e.g., minification). AWS CodeBuild is required to execute build commands such as minification, bundling, or transpilation of static website assets before deployment. In a fully automated CI/CD pipeline, CodeBuild processes the source code from the repository and produces the deployable artifacts that are then uploaded to the S3 bucket.

Answer

An Amazon CloudFront distribution for content delivery

Answer

An AWS Lambda function to invalidate CloudFront cache

Question 11

A company uses AWS CloudFormation to manage a stack that includes an Amazon SQS queue. The queue name must be unique. The developer wants to define the queue name in the CloudFormation template. Which intrinsic function should be used to generate a unique name?

Accepted Answer

Fn::Sub. A is correct because `Fn::Sub` can embed a pseudo parameter like `AWS::StackName` or `AWS::AccountId` into a string to generate a unique queue name. By using `Fn::Sub` with a reference to the stack name or a random string, you can create a name that avoids collisions across accounts or regions, satisfying the uniqueness requirement for SQS queue names.

Answer

Fn::Select

Answer

AWS::NoValue

Answer

Fn::GetAtt

Question 12

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across accounts are encrypted with AWS KMS. Which combination of controls should be used to enforce this?

Accepted Answer

Use an SCP to deny s3:PutBucketEncryption with encryption disabled, and AWS Config rules to detect non-compliant buckets.. It combines preventive and detective controls. An SCP can deny the s3:PutBucketEncryption action unless the bucket is configured with KMS encryption, which prevents non-compliant buckets from being created or modified. AWS Config rules then detect any existing non-compliant buckets or changes that bypass the SCP, providing continuous compliance monitoring.

Answer

Attach an IAM policy to all users denying s3:PutObject without KMS.

Answer

Use an SCP to deny s3:CreateBucket without encryption, and rely on CloudTrail to alert.

Answer

Use AWS Config rules only, with automatic remediation via Lambda.

Question 13

A company is using AWS CodePipeline with multiple stages: Source (GitHub), Build (CodeBuild), Test (CodeBuild), and Deploy (CloudFormation). The deployment stage is failing intermittently with a 'Rate exceeded' error. The team needs to reduce deployment failures. Which TWO actions should the team take?

Accepted Answer

Implement a manual approval step before deployment to stagger multiple pipeline executions.. Adding a manual approval step before the deployment stage introduces a gating mechanism that serializes pipeline executions. This prevents multiple concurrent deployments from hitting the CloudFormation API simultaneously, which is the root cause of the 'Rate exceeded' error (typically a 429 HTTP status from the AWS API due to throttling). By requiring human approval, the team can control the flow and reduce the likelihood of exceeding CloudFormation's API rate limits (e.g., 1 request per second per account per region for certain actions).

Answer

Increase the timeout of the deploy action.

Answer

Enable CloudWatch detailed monitoring for the deployed resources.

Answer

Change the deployment to use an in-place deployment type.

Question 14

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. During a deployment, the new instances fail the health check and are terminated. The deployment fails. The team wants to automatically roll back to the previous working version. What should they do?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails.. AWS CodeDeploy provides a built-in rollback configuration that can be triggered automatically when a deployment fails. By enabling automatic rollback in the deployment group settings, CodeDeploy will redeploy the last successful revision when the current deployment fails health checks, without requiring manual intervention or additional infrastructure.

Answer

Set up an Auto Scaling lifecycle hook to terminate instances and trigger a rollback.

Answer

Manually redeploy the last successful deployment revision after investigating the failure.

Answer

Configure the deployment group to automatically redeploy the same revision on failure.

Question 15

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The deployment consistently fails because the Lambda function's IAM role is not created before the function. The team uses a single CloudFormation template. Which action should be taken to resolve this dependency issue?

Accepted Answer

Add a DependsOn attribute in the CloudFormation template to ensure the IAM role is created before the Lambda function.. The CloudFormation template lacks an explicit dependency between the IAM role resource and the Lambda function resource. By adding a `DependsOn` attribute to the Lambda function resource, you ensure CloudFormation creates the IAM role first, resolving the deployment failure. This is the standard way to handle resource creation order within a single CloudFormation template.

Answer

Create the IAM role in a separate CodeBuild action before the deploy stage.

Answer

Add a wait condition in the CloudFormation template.

Answer

Separate the IAM role into a nested stack and reference it.