DOP-C02 Practice Test 45 — 15 Questions

Question 1

A company uses AWS CodePipeline with a multi-branch strategy. The pipeline deploys a Lambda function using CloudFormation. The DevOps engineer notices that when a new branch is created, the pipeline executes but the CloudFormation stack fails because the stack name already exists. What is the MOST efficient way to resolve this issue?

Accepted Answer

Modify the pipeline to use a dynamic stack name parameter, such as the branch name.. Option B is correct because using a dynamic stack name based on the branch name or a unique identifier ensures each pipeline execution creates a separate stack, avoiding name conflicts. Option A is wrong because deleting the stack before creation may cause downtime. Option C is wrong because CloudFormation does not support stack name overrides; a new name must be used. Option D is wrong because hardcoding a different stack name per branch is not scalable.

Answer

Hardcode a different stack name for each branch in the pipeline.

Answer

Delete the existing stack before each deployment.

Answer

Use the CloudFormation 'Override' parameter to reuse the same stack.

Question 2

An organization uses AWS OpsWorks for configuration management. They want to migrate to AWS Systems Manager to reduce costs and improve flexibility. Their current stack includes custom Chef recipes that manage package installations and service configurations. What is the MOST effective migration strategy?

Accepted Answer

Translate Chef recipes into Systems Manager State Manager associations and use Run Command for ad-hoc tasks.. Option C is correct because Systems Manager State Manager can manage configurations using association documents that are equivalent to Chef recipes, and Run Command can execute ad-hoc commands. Option A is wrong because it does not address existing recipes. Option B is wrong because CodeDeploy is for application deployments, not configuration management. Option D is wrong because it adds complexity and cost.

Answer

Use AWS CloudFormation to recreate the entire infrastructure and manage configurations.

Answer

Use AWS CodeDeploy to replace OpsWorks and manage configurations.

Answer

Keep OpsWorks but integrate it with Systems Manager for hybrid management.

Question 3

A DevOps team is using AWS CloudFormation to manage a multi-tier application. They want to ensure that when an update to the stack causes a resource replacement, the replacement occurs only after the new resource is fully created and tested. Which CloudFormation feature should they use?

Accepted Answer

CreationPolicy attribute with CreateBeforeDestroy. Option D is correct because CloudFormation 'CreateBeforeDestroy' ensures that a new resource is created before the old one is deleted, reducing downtime. Option A is wrong because 'UpdatePolicy' is for auto-scaling groups. Option B is wrong because 'DeletionPolicy' controls what happens when a resource is deleted. Option C is wrong because 'DependsOn' only defines resource creation order.

Answer

UpdatePolicy attribute with AutoScalingRollingUpdate

Answer

DeletionPolicy attribute set to Retain

Answer

DependsOn attribute to specify creation order

Question 4

A company uses AWS CloudFormation to manage its infrastructure. The security team requires that all S3 buckets have versioning enabled. A DevOps engineer needs to enforce this policy across all accounts in an AWS Organization. Which solution is MOST operationally efficient?

Accepted Answer

Create an SCP in AWS Organizations that denies s3:PutBucketVersioning with a condition that versioning is not enabled.. Option D is correct because using SCPs at the organizational level allows you to centrally deny actions that disable versioning, which is more efficient than per-account Lambda functions or IAM policies. Option A is wrong because a custom resource in each stack would require modification of every template. Option B is wrong because AWS Config rules require remediations that are not as immediate as SCPs. Option C is wrong because Service Catalog only helps with new stacks, not existing ones.

Answer

Add a CloudFormation custom resource to each template that enables versioning and attaches a Lambda function to re-enable it if disabled.

Answer

Create a Service Catalog portfolio with a product that enforces versioning and require all users to launch stacks from it.

Answer

Use AWS Config with a managed rule 's3-bucket-versioning-enabled' and an automatic remediation action that enables versioning.

Question 5

A company is using AWS Elastic Beanstalk with a custom platform. The DevOps team wants to automate the creation of a new platform version whenever changes are pushed to a Git repository. The pipeline should run tests, build the platform, and then update the Elastic Beanstalk environment to use the new platform version. Which services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. Options A, C, and D are correct. A: CodePipeline orchestrates the pipeline. C: CodeBuild can run tests and build the platform AMI. D: Packer (through CodeBuild) can create a custom AMI for the platform. Option B is wrong because CodeDeploy is for deploying applications, not for creating platform versions. Option E is wrong because CloudFormation is not directly used to create a custom platform; Packer and CodeBuild handle that.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 6

A company uses Terraform with an S3 backend to manage infrastructure. The DevOps engineer notices that after a colleague runs 'terraform apply' locally, the state file in S3 becomes corrupted and subsequent runs fail. What is the BEST way to prevent this issue?

Accepted Answer

Use DynamoDB for state locking and enable consistency checks.. Option B is correct because enabling DynamoDB state locking prevents concurrent modifications that can corrupt the state file. Option A is wrong because versioning only allows recovery, not prevention. Option C is wrong because encryption does not prevent corruption. Option D is wrong because it is not a best practice for state management.

Answer

Store the state file locally and commit it to version control.

Answer

Use S3 server-side encryption to protect the state file.

Answer

Enable S3 versioning on the state bucket to recover previous versions.

Question 7

A company uses AWS OpsWorks for configuration management with Chef. They are migrating to AWS Systems Manager to reduce complexity. The operations team needs to run custom scripts on a fleet of EC2 instances on a schedule, with the ability to target instances based on tags. Which Systems Manager capability should the engineer use?

Accepted Answer

State Manager. Option B is correct because State Manager allows you to define associations that run documents on a schedule with tag-based targeting. Option A is wrong because Run Command is for ad-hoc execution, not scheduled. Option C is wrong because Patch Manager is for patching only. Option D is wrong because Automation is for multi-step workflows, not simple script execution.

Answer

Patch Manager

Answer

Automation

Answer

Run Command

Question 8

A company uses AWS OpsWorks for Chef to manage its configuration. The company is planning to migrate to AWS Systems Manager. Which AWS Systems Manager capabilities can replace OpsWorks Chef functionalities? (Choose THREE.)

Accepted Answer

Patch Manager. Options A, B, and D are correct. A: State Manager can enforce configuration state. B: Patch Manager can manage patching. D: Inventory can collect software inventory. Option C is wrong because Run Command is for ad-hoc commands, not state enforcement. Option E is wrong because Session Manager is for interactive access, not configuration management.

Answer

Session Manager

Answer

Run Command

Question 9

A large enterprise uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set that contains a custom resource backed by a Lambda function. The update changes the Lambda function code. What is the CORRECT approach to ensure the Lambda function is updated without manual intervention?

Accepted Answer

Update the stack set with a new template version that references the updated Lambda code, and let CloudFormation handle the update.. Option A is correct because updating the stack set with new template and parameters triggers CloudFormation to update the Lambda function automatically. Option B is wrong because manually updating the Lambda function is not scalable. Option C is wrong because CloudFormation does not support Lambda function aliases for custom resources. Option D is wrong because StackSets automatically handle updates across accounts.

Answer

Use a Lambda function alias and point the custom resource to the alias.

Answer

Create a new stack set for the updated Lambda and delete the old one.

Answer

Manually update the Lambda function in each account, then update the stack set.

Question 10

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to ensure that infrastructure changes are reviewed and approved before deployment. The code is stored in AWS CodeCommit, and the pipeline uses AWS CodePipeline and AWS CloudFormation. What is the BEST way to implement an approval process for infrastructure changes?

Accepted Answer

Add a manual approval step in CodePipeline between the build and deploy stages.. Option C is correct because CodePipeline supports manual approval actions that can be inserted between stages. Option A is wrong because CodeCommit approval rules only apply to code merges, not pipeline execution. Option B is wrong because IAM policies cannot create approval gates in the pipeline. Option D is wrong because CodeBuild does not have native approval capabilities.

Answer

Use CodeCommit approval rules to require a pull request before any change is merged.

Answer

Configure IAM policies to require MFA before any CloudFormation stack update.

Answer

Use CodeBuild to run a script that sends an approval request via Amazon SNS and waits for a response.

Question 11

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the Ansible control node can connect to managed nodes securely without storing SSH keys in plaintext. Which AWS service should they integrate with Ansible to securely manage SSH keys?

Accepted Answer

AWS Secrets Manager to store the SSH private keys and retrieve them dynamically.. Option B is correct because AWS Secrets Manager can store SSH private keys securely and Ansible can retrieve them via API. Option A is wrong because AWS KMS is for encryption keys, not for storing secrets directly. Option C is wrong because IAM roles are for permissions, not storing keys. Option D is wrong because Systems Manager Parameter Store can store secrets but is less feature-rich for secret rotation.

Answer

AWS KMS to encrypt the SSH keys at rest.

Answer

AWS IAM roles to grant Ansible access to the instances.

Answer

AWS Systems Manager Parameter Store to store the keys.

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is running behind an Application Load Balancer. The DevOps team notices that during deployments, the new application version fails health checks and the deployment rolls back. The team wants to reduce deployment time while maintaining safety. Which configuration change should the engineer recommend?

Accepted Answer

Change the deployment policy to immutable.. Option A is correct because immutable deployments create a new Auto Scaling group and only shift traffic after health checks pass, which is safe and faster than rolling with batch size 1. Option B is wrong because rolling with a large batch size risks capacity. Option C is wrong because all-at-once is fastest but unsafe. Option D is wrong because adding more instances to the existing group does not improve deployment strategy.

Answer

Increase the number of EC2 instances in the environment.

Answer

Use the all-at-once deployment policy.

Answer

Increase the rolling update batch size to 100%.

Question 13

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences periodic slowdowns. The team wants to monitor the number of active connections and the query execution time. Which approach is most cost-effective?

Accepted Answer

Enable Enhanced Monitoring and publish metrics to CloudWatch, then create alarms on relevant metrics.. Option C is correct because Enhanced Monitoring provides metrics like active connections and query execution time at no additional cost beyond CloudWatch. Option A is wrong because Performance Insights incurs additional cost. Option B is wrong because the RDS console shows basic metrics but not query-level detail. Option D is wrong because using a custom solution is more complex and may incur extra costs.

Answer

Install the CloudWatch agent on the RDS instance to collect custom metrics.

Answer

Use the RDS console to view the 'DatabaseConnections' and 'QueryExecutionTime' metrics.

Answer

Enable Performance Insights and set up CloudWatch alarms on the 'DBLoad' metric.

Question 14

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires a custom Amazon Machine Image (AMI) for its EC2 instances. The DevOps team updates the AMI monthly. What is the most efficient way to update the Elastic Beanstalk environment to use the new AMI?

Accepted Answer

Update the CloudFormation template that manages the environment to reference the new AMI ID, and perform a stack update. Option D is correct because Elastic Beanstalk environments are built on AWS CloudFormation stacks. Updating the CloudFormation template that manages the environment to reference the new AMI ID and performing a stack update triggers a rolling or immutable update that replaces EC2 instances with the new AMI while preserving the environment configuration, DNS name, and other resources. This is the most efficient and supported method for updating the AMI in an existing environment without creating a new one.

Answer

Use the Elastic Beanstalk console to modify the launch configuration's AMI ID

Answer

Create a new Elastic Beanstalk environment with the new AMI and swap the environment URL

Answer

Use the AWS CLI command aws elasticbeanstalk update-environment with the new AMI ID

Question 15

A company uses AWS CodeCommit and CodePipeline. The pipeline triggers on commits to the main branch. The DevOps engineer wants to add a stage that runs unit tests in a build environment. After the tests pass, the pipeline should deploy to a staging environment. If the tests fail, the pipeline should stop and notify the team. Which AWS service should be used to implement this workflow?

Accepted Answer

AWS CodeBuild. Option D is correct because AWS CodeBuild integrates with CodePipeline to run tests and can be configured to fail the pipeline if tests fail. Option A is wrong because CodeDeploy is for deployments, not testing. Option B is wrong because Lambda can run tests but CodeBuild is more appropriate for build and test. Option C is wrong because CodeStar is a project management tool.

Answer

AWS CodeStar

Answer

AWS Lambda

Answer

AWS CodeDeploy