DOP-C02 Practice Test 45 — 15 Questions

Question 1

A DevOps engineer is building a CI/CD pipeline for a PHP application that uses Amazon RDS for MySQL. The pipeline must run database migrations as part of the deployment. The team wants to ensure that if a migration fails, the deployment is rolled back and the database is restored to its previous state. Which THREE steps should the engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Take a snapshot of the RDS database before the migration.. Taking a manual snapshot of the RDS database before the migration provides a reliable restore point. If the migration fails, you can restore the database from this snapshot to its previous state, ensuring data integrity and enabling a clean rollback.

Answer

Use CloudFormation with a custom resource to run the migration.

Answer

Use AWS Database Migration Service (DMS) to replicate the database continuously.

Question 2

A DevOps team is implementing a CI/CD pipeline for a microservices application deployed on Amazon ECS. They want to automatically build, test, and deploy container images to Amazon ECR and then update the ECS service. Which TWO steps are essential to achieve this goal?

Accepted Answer

Use AWS CodeDeploy to update the ECS service with a new task definition.. AWS CodeDeploy is the native AWS service for managing ECS rolling or blue/green deployments. It orchestrates the creation of a new ECS task definition, registers it, and updates the ECS service to use the new task definition, ensuring zero-downtime deployments. Option C is correct because AWS CodeBuild can execute build commands from a buildspec.yml file to build a Docker image and push it to Amazon ECR using the built-in AWS CLI or Docker commands, which is a fundamental step in a CI/CD pipeline for containerized applications.

Answer

Use AWS Secrets Manager to store Docker credentials.

Answer

Use AWS X-Ray for tracing.

Answer

Use Amazon CodeGuru for code review.

Question 3

A company uses AWS CodeBuild to build and test their application. They want to integrate Infrastructure as Code (IaC) scanning into their build pipeline to detect security misconfigurations in CloudFormation templates before deployment. Which TWO tools or services can be used for this purpose? (Choose TWO.)

Accepted Answer

AWS CloudFormation Guard. AWS CloudFormation Guard (cfn-guard) is a policy-as-code tool that allows you to define rules to enforce compliance and security best practices on CloudFormation templates. It can be integrated into a CodeBuild pipeline to scan templates for misconfigurations before deployment, making it a correct choice for IaC security scanning.

Answer

AWS Security Hub

Answer

AWS Config

Answer

HashiCorp Terraform

Question 4

A DevOps engineer receives a CloudWatch alarm that an Auto Scaling group has been in an 'Insufficient data' state for 20 minutes. What does this indicate?

Accepted Answer

The alarm has not received enough metric data to evaluate. The 'Insufficient data' state in CloudWatch alarms indicates that the alarm has not received enough metric data points to determine whether the threshold has been breached. This can occur when the metric is not being published, the data collection period is too short, or the metric namespace is misconfigured. It does not directly indicate instance health, scaling needs, or agent installation status.

Answer

All instances in the Auto Scaling group are unhealthy

Answer

The Auto Scaling group needs to scale up

Answer

The CloudWatch agent is not installed on the instances

Question 5

A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes orders and stores them in an RDS PostgreSQL database. The company wants to ensure that the order service is resilient to AZ failures and can handle a sudden increase in order volume. Which TWO actions should the DevOps engineer take? (Choose TWO.)

Accepted Answer

Deploy the RDS instance in a Multi-AZ configuration.. Deploying the RDS instance in a Multi-AZ configuration provides automatic failover to a standby replica in a different Availability Zone, ensuring database resilience to AZ failures. Option D is correct because configuring the ECS service to run tasks in multiple Availability Zones distributes the order processing workload across AZs, improving both fault tolerance and scalability during sudden traffic spikes.

Answer

Increase the CPU and memory limits for the ECS task definition.

Answer

Place an Amazon CloudFront distribution in front of the order service.

Answer

Use RDS Proxy to manage database connections.

Question 6

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodePipeline and Amazon ECS. The pipeline should build a Docker image, push it to Amazon ECR, and deploy it to an ECS service. Which deployment action should they use in the pipeline?

Accepted Answer

Amazon ECS (Blue/Green) deployment provider with CodeDeploy.. Amazon ECS (Blue/Green) deployment provider with CodeDeploy is the native, fully managed deployment action in AWS CodePipeline for ECS services. It orchestrates traffic shifting, task set management, and rollback automatically using CodeDeploy's ECS blue/green deployment type, which is the recommended approach for containerized applications on ECS.

Answer

AWS Elastic Beanstalk deployment action.

Answer

AWS CodeBuild with a buildspec that runs aws ecs update-service.

Answer

AWS CloudFormation deployment action to update the ECS service.

Question 7

An organization wants to enforce that all Amazon S3 buckets are encrypted with SSE-S3. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config rules with auto-remediation. AWS Config rules can evaluate whether S3 buckets have SSE-S3 encryption enabled and trigger automatic remediation actions via SSM Automation documents. This provides continuous compliance monitoring and enforcement without manual intervention, directly addressing the requirement to automatically remediate non-compliant buckets.

Answer

AWS CloudTrail

Answer

IAM policies

Answer

AWS Service Catalog

Question 8

A company uses AWS OpsWorks for configuration management. The DevOps team wants to run a custom recipe on all instances in a layer during stack updates. Which OpsWorks lifecycle event should they hook the recipe into?

Accepted Answer

Setup. The Setup lifecycle event runs on every instance in a layer when it first boots or during a stack update, making it the correct hook for running a custom recipe that must execute on all instances during updates. This event occurs after the instance is fully configured and before it enters service, ensuring the recipe runs consistently across the layer.

Answer

Deploy

Answer

Shutdown

Answer

Configure

Question 9

An organization uses AWS OpsWorks for configuration management. They have a stack with multiple layers, including a PHP application layer and a MySQL database layer. The operations team needs to deploy a custom configuration file to all PHP application instances. How should this be accomplished using OpsWorks?

Accepted Answer

Create a custom cookbook with a recipe that deploys the configuration file, and assign it to the Deploy lifecycle event of the PHP layer.. OpsWorks uses Chef cookbooks to manage configuration. By creating a custom cookbook with a recipe that deploys the configuration file and assigning it to the Deploy lifecycle event of the PHP layer, the recipe runs on all PHP application instances during deployment, ensuring the file is placed correctly. This approach leverages OpsWorks' built-in lifecycle events and Chef's idempotent execution model.

Answer

Use the OpsWorks agent to directly copy the file to each instance via SSH.

Answer

Add the configuration file as a stack-level custom cookbook and assign it to all layers.

Answer

Use a custom JSON attribute in the stack settings to define the file content, and then use a built-in recipe to apply it.

Question 10

A company is implementing a CI/CD pipeline for a containerized application using AWS CodePipeline, CodeBuild, and Amazon ECS. The pipeline should automatically deploy to a staging environment and then, after manual approval, to production. The production environment uses an ECS service with rolling update deployment. Which TWO actions are necessary to achieve this?

Accepted Answer

Add a manual approval stage in CodePipeline between staging and production.. A manual approval stage in CodePipeline allows a human to review and approve the deployment before it proceeds to production, which is a common requirement for controlled rollouts. Option D is correct because the ECS-to-CodePipeline deploy action (using the ECS deploy provider) natively supports rolling update deployments by updating the ECS service with the new task definition, which aligns with the requirement for a rolling update strategy.

Answer

Use CloudFormation to deploy the ECS service with a rolling update policy.

Answer

Set up an ECS task definition with a sidecar container for health checks.

Answer

Configure CodeBuild to push the Docker image to Amazon ECR.

Question 11

Which AWS service is a fully managed source control service?

Accepted Answer

AWS CodeCommit. AWS CodeCommit is a fully managed source control service that hosts private Git repositories, providing version control without managing servers. It integrates with IAM for access control and other AWS developer tools. The other services in the list serve different CI/CD pipeline stages.

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodePipeline

Answer

AWS CloudFormation

Answer

Amazon EventBridge

Question 12

A company uses AWS CodeCommit as a source repository and wants to enforce that all commits are signed using GPG keys. The DevOps team configures a pre-receive hook in CodeCommit to validate commit signatures. However, the hook rejects all commits even when valid GPG signatures are present. What is the most likely cause?

Accepted Answer

CodeCommit does not support pre-receive hooks.. AWS CodeCommit does not support pre-receive hooks. Pre-receive hooks are a feature of self-managed Git repositories (e.g., GitHub Enterprise, GitLab, or on-premises Git servers) that run on the server before accepting a push. CodeCommit uses IAM policies and repository-level settings (such as requiring signed commits via the 'git push --signed' flag) to enforce commit signing, not server-side hooks. Therefore, any attempt to configure a pre-receive hook in CodeCommit will fail, causing all commits to be rejected.

Answer

The GPG key is not registered with the IAM user's profile.

Answer

The hook script has a syntax error.

Answer

The repository is not configured to require signed commits.

Question 13

A company is migrating a monolithic application to a microservices architecture on AWS. To improve resilience, which THREE design patterns should be implemented? (Select THREE.)

Accepted Answer

Retry with exponential backoff for transient failures. Implementing retry with exponential backoff allows services to handle transient failures (e.g., network timeouts, throttling) by automatically retrying operations after increasing delays, reducing load on recovering systems. This pattern is essential for microservices on AWS, where services like DynamoDB or Lambda may throttle requests, and exponential backoff (e.g., using jitter as per AWS SDK defaults) prevents cascading failures.

Answer

Synchronous communication between services to ensure consistency

Answer

Single shared database to maintain data consistency

Question 14

A company wants to centralize logging from multiple AWS accounts and regions. The logs should be stored in a central S3 bucket for compliance. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Create an S3 bucket in the central account with appropriate bucket policy granting permissions to CloudTrail.. To centralize logs from multiple accounts into a single S3 bucket, the bucket in the central account must have a bucket policy that explicitly grants the necessary permissions (e.g., `s3:PutObject`) to the CloudTrail service principal (`cloudtrail.amazonaws.com`) from each source account. This policy allows CloudTrail in the source accounts to write log files directly into the central bucket, enabling centralized storage for compliance.

Answer

Create a cross-account subscription in Amazon CloudWatch Logs to stream logs to the central account.

Answer

Turn on CloudTrail data events for all S3 and Lambda resources.

Question 15

Which of the following are valid strategies for implementing continuous integration in AWS? (Choose two.)

Accepted Answer

Configure AWS CodeBuild to automatically run tests when a pull request is created in CodeCommit.. AWS CodeBuild can be configured to automatically run tests when a pull request is created in CodeCommit using a webhook or event rule. This enables continuous integration by validating code changes before merging, ensuring that only tested code is integrated into the main branch.

Answer

Set up AWS CodeDeploy to trigger a build every time a commit is pushed to a repository.

Answer

Use AWS CloudFormation to create a stack that runs tests every time a new commit is pushed.