DOP-C02 Practice Test 46 — 15 Questions

Question 1

A company uses a central CloudFormation template to create VPCs with a standard CIDR block of 10.0.0.0/16. The template is used across multiple accounts and regions. The team needs to ensure that the VPC CIDR does not overlap with other VPCs in the same account. Which approach should the engineer take to dynamically assign a unique /16 subnet from a larger pool?

Accepted Answer

Use the Fn::Cidr function with the stack ID as a seed to generate a /16 CIDR from a larger pool.. Option A is correct because AWS CloudFormation's Cidr function can allocate subnets from a larger CIDR pool, and since it uses the stack ID as a seed, it produces a deterministic but unique range per stack. Option B is wrong because the Ref function returns the VPC ID, not a CIDR. Option C is wrong because Fn::GetAtt on a VPC returns attributes like VpcId, not a new CIDR. Option D is wrong because Fn::Select on a list of CIDRs requires manual maintenance and is not dynamic.

Answer

Use Fn::Select on a predefined list of CIDR blocks passed as a parameter.

Answer

Use Fn::GetAtt to retrieve the VPC's CidrBlock from another VPC resource.

Answer

Use the Ref function to assign the VPC ID as the CIDR block.

Question 2

A company uses AWS CodeDeploy for blue/green deployments to an Auto Scaling group. The deployment fails because the new instances do not pass health checks. The DevOps engineer discovers that the health check URL returns a 503 error. What is the MOST likely cause?

Accepted Answer

The target group health check path is '/health' but the application does not serve that endpoint. The health check URL returning a 503 error indicates that the application is not responding to the health check endpoint. Since the target group health check path is configured as '/health' but the application does not serve that endpoint, the ALB considers the instances unhealthy, causing CodeDeploy to fail the deployment. This is the most direct cause because the health check is failing at the application layer, not due to infrastructure issues.

Answer

The CodeDeploy agent on the new instances is not running

Answer

The security group for the ALB does not allow inbound traffic on port 80

Answer

The Auto Scaling group health check type is set to EC2 instead of ELB

Question 3

A financial services company uses Chef for configuration management. They need to enforce security compliance across thousands of EC2 instances. The compliance requirements include specific file permissions, firewall rules, and user account settings. They want to automatically remediate non-compliant instances. Which approach is MOST effective?

Accepted Answer

Use Chef recipes to define desired state and enforce compliance on each client run.. Option A is correct because Chef recipes can define the desired state and automatically enforce compliance on each Chef client run. Option B is wrong because AWS Config rules are for detection only, not remediation. Option C is wrong because Systems Manager Patch Manager is for patching, not compliance. Option D is wrong because CloudWatch Events can trigger remediation but requires custom automation.

Answer

Use AWS Config rules to detect non-compliance and send notifications.

Answer

Use AWS CloudWatch Events to trigger a Lambda function that runs remediation scripts.

Answer

Use AWS Systems Manager Patch Manager to apply patches.

Question 4

A DevOps engineer is implementing AWS Config rules to enforce tagging standards on resources. The rule should trigger a remediation action via AWS Systems Manager Automation to apply the correct tags if a resource is non-compliant. What is the correct way to set up this remediation?

Accepted Answer

Use the AWS Config rule's remediation action to run an AWS Systems Manager Automation document.. Option C is correct because AWS Config rule remediation actions can be configured to run an Automation document when a resource is non-compliant. Option A is wrong because CloudWatch Events alone cannot run remediation; it would need a target like Lambda. Option B is wrong because SNS notifications are just notifications, not remediation. Option D is wrong because AWS Config does not directly trigger CodePipeline.

Answer

Configure the AWS Config rule to send events to AWS CodePipeline to trigger a pipeline that fixes the tags.

Answer

Configure a CloudWatch Events rule to detect non-compliant resources and invoke a Lambda function that applies tags.

Answer

Use an SNS topic to notify administrators when a resource is non-compliant.

Question 5

A company uses AWS Elastic Beanstalk for a web application. The DevOps engineer needs to ensure that environment configuration changes (e.g., instance type, environment variables) are version-controlled and can be rolled back quickly. Which approach should they use?

Accepted Answer

Use Elastic Beanstalk saved configurations stored in source control.. Option C is correct because Elastic Beanstalk supports saved configurations that can be versioned in source control and applied to environments. Option A is wrong because manual changes in the console are not version-controlled. Option B is wrong because CloudFormation is for infrastructure, not Elastic Beanstalk configuration. Option D is wrong because CLI commands are not version-controlled by default.

Answer

Manually update the environment configuration through the Elastic Beanstalk console.

Answer

Use the AWS CLI to apply configuration changes from a script.

Answer

Use AWS CloudFormation to manage the Elastic Beanstalk environment.

Question 6

A company uses AWS CloudFormation to deploy infrastructure. They want to implement a change management process that requires approval before any stack update is executed. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use AWS CodePipeline with a manual approval stage before the CloudFormation deployment action.. Options A and D are correct. Option A uses a manual approval step in CodePipeline before the CloudFormation deployment action. Option D uses a Lambda function to check for approval before executing the update. Option B is wrong because CloudFormation does not have a built-in approval mechanism. Option C is wrong because Change Sets are for review, not for requiring external approval. Option E is wrong because it does not enforce approval.

Answer

Use CloudFormation StackSets with approval tokens.

Answer

Use CloudFormation Change Sets and require a separate user to execute them.

Answer

Use AWS Service Catalog to manage CloudFormation templates and require approval for product launches.

Question 7

A DevOps team manages hundreds of EC2 instances using AWS Systems Manager State Manager. They need to ensure that a specific configuration (e.g., a custom firewall rule) is applied to all instances and remains enforced. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Ensure the instances have an IAM role that allows Systems Manager to perform actions.. Options A, C, and E are correct. Option A creates a State Manager association for the configuration. Option C sets the association to apply the configuration on a schedule, ensuring enforcement. Option E uses an IAM role to allow Systems Manager to apply the configuration. Option B is wrong because Run Command is ad-hoc, not continuous enforcement. Option D is wrong because Config rules only detect, not enforce.

Answer

Use AWS Config rules to detect non-compliance.

Answer

Use Run Command to execute the configuration once.

Question 8

A company uses AWS CodeBuild to run unit tests and package a Java application. The build environment needs to have a specific version of Java installed that is not available in the standard build images. The team wants to minimize build time. How should the engineer configure the build environment?

Accepted Answer

Use a custom build image that already includes the required Java version, stored in Amazon ECR.. Option B is correct because using a custom Docker image with the required Java version avoids installing it during each build, reducing build time. Option A is wrong because installing during build increases time. Option C is wrong because installing at the start of the build phase also increases time. Option D is wrong because Lambda is not suitable for running a build server.

Answer

Use AWS Lambda to run the tests and package the application.

Answer

Use a standard build image and include a pre-build command to install the required Java version.

Answer

Use the pre-build phase to download and install Java from an S3 bucket.

Question 9

A company uses AWS CodeBuild to run tests as part of their CI/CD pipeline. They want to store build artifacts in an S3 bucket and ensure that only the latest successful build artifacts are retained. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure CodeBuild to output artifacts to a specific S3 bucket.. Options B and D are correct. Option B configures CodeBuild to store artifacts in S3. Option D sets a lifecycle policy to expire old artifacts. Option A is wrong because it would retain all artifacts. Option C is wrong because CodeCommit is for source code, not artifacts. Option E is wrong because CloudWatch Logs are for logs, not artifacts.

Answer

Store artifacts in an AWS CodeCommit repository.

Answer

Enable versioning on the S3 bucket to keep all versions.

Answer

Use CloudWatch Logs to store build logs.

Question 10

A company uses AWS CloudFormation to manage a production environment with multiple stacks. The DevOps team needs to implement a change management process that requires approval for any changes to the production stack. Which approaches meet this requirement? (Choose TWO.)

Accepted Answer

Require that all stack updates be performed through a change set that is reviewed and executed by a separate role.. Options B and C are correct. B: Using a change set allows reviewing proposed changes without applying them. C: StackSets with approval workflows are not standard; however, using a separate pipeline with a manual approval step in CodePipeline before executing the change set is a valid approach. Option A is wrong because SCPs cannot control CloudFormation changes specifically. Option D is wrong because IAM policies can restrict who can update, but not provide an approval workflow. Option E is wrong because Config rules are detective, not preventive.

Answer

Create an IAM policy that allows only read-only access to the production stack and a separate role with write access.

Answer

Use AWS Config rules to detect unapproved changes and automatically revert them.

Answer

Use an SCP to deny all CloudFormation actions except from a specific CI/CD role.

Question 11

A company uses AWS CloudFormation StackSets to deploy a common security group across multiple accounts in an AWS Organization. The security group must allow inbound traffic from the organization's central VPN CIDR range. The VPN CIDR range is stored in AWS Systems Manager Parameter Store. How should the engineer reference this parameter in the StackSet template to ensure the value is resolved at deployment time?

Accepted Answer

Use the dynamic reference '{{resolve:ssm:/org/vpn/cidr}}' in the template.. Option B is correct because dynamic references in CloudFormation templates (using the 'resolve:ssm' prefix) fetch the parameter value at stack creation/update time. Option A is wrong because the Ref function on a parameter would require the parameter to be passed as a stack parameter, not directly from Parameter Store. Option C is wrong because Fn::GetAtt is for resource attributes. Option D is wrong because Fn::ImportValue is for cross-stack references, not Parameter Store.

Answer

Use Fn::ImportValue with an export from another stack that reads the parameter.

Answer

Use the Ref function on the parameter name as a CloudFormation parameter.

Answer

Use Fn::GetAtt to retrieve the parameter value from an AWS::SSM::Parameter resource.

Question 12

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create. The error message indicates a 'circular dependency' between two resources: a security group and an EC2 instance. The security group contains an ingress rule that references the instance's private IP address, which is not known until the instance is created. The instance's network interface uses the security group. What change should the engineer make to resolve the circular dependency?

Accepted Answer

Add an AWS::EC2::SecurityGroupIngress rule that references the instance's network interface using Fn::GetAtt on the network interface resource.. Option C is correct because by using a VPC endpoint on the security group rule, you can reference the instance's network interface after creation, breaking the circular dependency. Option A is wrong because hardcoding the IP is not dynamic and may not be the correct IP. Option B is wrong because Ref on the instance returns the instance ID, not the IP. Option D is wrong because depending on the network interface still requires the interface to exist, which depends on the instance.

Answer

Create the EC2 instance first without a security group, then attach the security group after creation.

Answer

Hardcode the instance's private IP address in the security group rule.

Answer

Use the Ref function on the EC2 instance to get its private IP address.

Question 13

A company uses AlB with target groups for a microservices architecture. They need to ensure that if a target group has no healthy targets, the ALB returns a custom error page instead of a 503. How can this be achieved?

Accepted Answer

Enable the ALB's custom error response and specify the error page.. Option C is correct because ALB's custom error response feature allows configuring a custom error page for specific error codes. Option A is wrong because CloudFront can return custom errors but doesn't integrate directly with ALB for this purpose without being in front. Option B is wrong because Lambda@Edge is for CloudFront, not ALB. Option D is wrong because a fixed response action returns a static response but cannot serve a custom error page from an S3 bucket.

Answer

Configure a Lambda@Edge function to replace the 503 response.

Answer

Use Amazon CloudFront to cache a custom error page.

Answer

Use the ALB's fixed response action to return a custom error page.

Question 14

A DevOps engineer creates the IAM policy shown in the exhibit to restrict EC2 instance types. However, users are still able to launch instances of type 't2.large'. What is the reason for this behavior?

Answer

The Deny statement's condition uses StringNotEquals, which does not match the 't2.large' instance type because the condition requires the instance type to be NOT equal to any of the listed types, but 't2.large' is not in the list, so the condition is true, and the Deny should apply. However, the Allow statement without condition allows all, so there is a conflict. Actually, the correct explanation is that the Deny condition is not evaluated correctly because the ec2:InstanceType condition key is not available for the instance resource? I'm not sure. I'll stick with the idea that the Deny condition actually works, so the answer is that the policy is missing a Deny on the image resource to fully block. But since the question says users can launch, I'll choose A.

Answer

The policy does not include a Deny statement for the 'ec2:RunInstances' action on the 'image' resource.

Answer

The policy should use 'Deny' with 'ec2:InstanceType' in a 'ForAllValues:StringNotEquals' condition.

Answer

The Allow statement is evaluated after the Deny statement and overrides it.

Question 15

A company runs a Stateful application on EC2 that requires sticky sessions. They use an ALB with duration-based stickiness. During a deployment, they want to drain existing connections gracefully before terminating instances. Which step is necessary?

Accepted Answer

Enable connection draining on the target group.. Option C is correct because connection draining on the target group ensures existing connections complete before termination. Option A is incorrect because deregistration delay is similar but the term used is connection draining for ALB. Option B is incorrect because stickiness duration does not drain connections. Option D is incorrect because health checks do not manage connection draining.

Answer

Increase the deregistration delay on the target group.

Answer

Reduce the stickiness duration to zero.

Answer

Configure health checks to mark instances unhealthy.