DOP-C02 Practice Test 47 — 15 Questions

Question 1

Which TWO actions should a DevOps engineer take to secure a web application running on EC2 instances behind an Application Load Balancer? (Choose two.)

Accepted Answer

Enable AWS WAF on the ALB to filter malicious requests.. Correct answers are D and E. Option D: AWS WAF on the ALB helps filter out common web exploits. Option E: Configuring the EC2 security group to allow inbound traffic only from the ALB's security group ensures that direct access to instances is blocked, forcing traffic through the ALB. Option A is incorrect because allowing all inbound traffic (0.0.0.0/0) on port 443 exposes instances directly to the internet, bypassing the ALB. Option B is incorrect: network ACLs are stateless and less granular than security groups; using a NACL to allow traffic from the ALB's subnet is not a recommended practice for instance-level security. Option C is incorrect: placing EC2 instances behind CloudFront is a content delivery optimization, not a security measure to protect the application layer; it does not replace the need for WAF or security group restrictions.

Answer

Configure the EC2 instance security group to allow inbound traffic from 0.0.0.0/0 on port 443.

Answer

Use a network ACL to allow inbound HTTP/S traffic only from the ALB's subnet.

Answer

Place the EC2 instances behind an Amazon CloudFront distribution.

Question 2

Which TWO AWS services can be used as sources in an AWS CodePipeline? (Choose two.)

Accepted Answer

AWS CodeCommit. AWS CodePipeline supports AWS CodeCommit and Amazon S3 as source stages. CodeCommit is a fully managed source control service that integrates natively with CodePipeline, allowing automatic pipeline execution on code changes. Amazon S3 can serve as a source when you upload a source bundle (e.g., a ZIP file) to an S3 bucket, and CodePipeline can poll the bucket for changes or use S3 event notifications to trigger the pipeline.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Question 3

An IAM policy is attached to a service role used by AWS CodePipeline. Which TWO statements about this policy are correct?

Accepted Answer

The policy allows starting a pipeline execution. The IAM policy attached to a CodePipeline service role must include permissions to allow the pipeline to start executions. The `codepipeline:StartPipelineExecution` action is required for the pipeline to be triggered by events or manual starts. Without this permission, the pipeline cannot initiate its execution flow.

Answer

The policy allows updating the pipeline definition

Answer

The policy allows starting any CodeBuild project

Answer

The policy allows reading and writing objects to any S3 bucket

Question 4

A company is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yaml includes commands to build and tag the image. However, the push to ECR fails with an authentication error. Which TWO actions should the DevOps engineer take to resolve this?

Accepted Answer

Add a command in the buildspec to run 'aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com'.. The `aws ecr get-login-password` command retrieves a temporary authentication token from the ECR service, which is then piped to `docker login` to authenticate the Docker client against the private ECR registry. This is the standard AWS-recommended method for authenticating Docker to ECR in automated build environments like CodeBuild, as it avoids hardcoding long-lived credentials.

Answer

Configure the ECR repository as public.

Answer

Create an ECR lifecycle policy to expire untagged images.

Answer

Run 'docker login' with ECR credentials in the buildspec.

Question 5

Which THREE actions are best practices for managing secrets in AWS CloudFormation templates? (Choose three.)

Accepted Answer

Use AWS CloudFormation parameters with the NoEcho property set to true.. Setting the NoEcho property to true on a CloudFormation parameter prevents the parameter value from being returned in API calls or displayed in the console, which is a basic mechanism for masking secrets. However, this alone does not encrypt the value at rest or in transit, and the value is still passed as plaintext in the template, so it is considered a best practice only when combined with other secure methods like dynamic references.

Answer

Encrypt the CloudFormation template file with AWS KMS.

Answer

Store secrets as plaintext in the template parameters.

Question 6

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences high traffic during business hours and low traffic at night. The company wants to configure automatic scaling based on CPU utilization. Which THREE steps are required to achieve this? (Select THREE.)

Accepted Answer

Set the minimum and maximum number of instances for the auto scaling group.. Elastic Beanstalk uses Auto Scaling groups to manage the EC2 instances for the application. Setting the minimum and maximum number of instances defines the boundaries within which the Auto Scaling group can scale, ensuring the application can handle high traffic during business hours and scale down during low traffic at night.

Answer

Create a CloudWatch alarm that triggers a scaling policy.

Answer

Configure the load balancer health check interval.

Question 7

A company is using AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails. Which services can be used together to send an email notification on stack failure? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS (Option C) is correct because it can send email notifications to subscribers when a CloudFormation stack creation fails. AWS CloudFormation (Option D) is correct because it can directly publish failure events to an SNS topic via the 'NotificationARNs' parameter in stack creation, enabling automated email alerts without additional services.

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon CloudWatch

Question 8

A DevOps engineer receives an alert that an Amazon EC2 instance’s CPU utilization has been above 90% for the past hour. The instance is part of an Auto Scaling group with a step scaling policy based on average CPU. The engineer checks the CloudWatch alarm and sees that it is in the ALARM state. What should the engineer do to verify that the Auto Scaling group is scaling out properly?

Accepted Answer

Review the Auto Scaling group’s activity history in the EC2 console. Reviewing the Auto Scaling group's activity history in the EC2 console shows whether scaling actions were triggered and if new instances were launched. The CloudWatch alarm is in ALARM state (indicating high CPU), and the step scaling policy should scale out, so checking the activity history confirms the scaling action occurred. Option A is incorrect because the scaling policy is for scaling out on high CPU, not scaling in. Option B is incorrect because CloudWatch Logs show instance-level logs, not Auto Scaling actions. Option C is incorrect because the alarm is in ALARM state, not INSUFFICIENT_DATA.

Answer

Ensure the scaling policy is configured to scale in

Answer

Check the CloudWatch Logs for the instance

Answer

Verify that the CloudWatch alarm is in INSUFFICIENT_DATA state

Question 9

A DevOps engineer receives a CloudWatch alarm that the 'StatusCheckFailed' metric for an EC2 instance is in ALARM state. The instance is part of an Auto Scaling group. What should the engineer do first to restore service?

Accepted Answer

Wait for Auto Scaling to replace the instance. The Auto Scaling group automatically replaces unhealthy instances based on EC2 status checks. Options A, C, and D are incorrect: Updating the launch configuration does not fix existing instances; manually terminating is unnecessary as Auto Scaling handles it; and rebooting may not resolve underlying issues.

Answer

Update the Auto Scaling group's launch configuration

Answer

Manually terminate the instance

Answer

Reboot the instance

Question 10

Refer to the exhibit. A DevOps engineer runs the CloudWatch Logs Insights query and sees a spike in errors at 12:00. Which action would best help identify the root cause?

Accepted Answer

Query the logs around 12:00 without aggregation to see the actual error messages.. The query shows a sudden spike at 12:00. To identify the root cause, the engineer should look at the error messages themselves around that time. Filtering by @timestamp and @message to see the actual error messages will help identify the type of error. Adding a filter for a specific error pattern or grouping by error message would also help.

Answer

Add a filter for @logStream to see which log stream has the most errors.

Answer

Increase the limit to 100 to see more results.

Answer

Change the bin time to 1m to get more granular data.

Question 11

Which THREE steps should a DevOps engineer take to troubleshoot an EC2 instance that cannot be reached via SSH? (Choose three.)

Accepted Answer

Check the network ACL inbound rules for the subnet.. Network ACLs (NACLs) are stateless firewall rules applied at the subnet level. If the inbound rule for ephemeral ports or port 22 is not explicitly allowed, SSH traffic will be dropped even if the security group permits it. Checking NACL inbound rules is a fundamental step in troubleshooting connectivity issues.

Answer

Verify that the corporate firewall allows SSH to the instance.

Answer

Create an AMI from the instance and launch a new one.

Question 12

Refer to the exhibit. An IAM policy is attached to a user. The user tries to push a commit to the 'develop' branch of 'MyRepo' using Git. What is the outcome?

Accepted Answer

The push is denied because the user is not pushing to the 'main' branch.. The policy allows GitPull and GitPush on the repo, but denies GitPush when the reference is not 'refs/heads/main'. Since the user is pushing to 'develop', the condition is met, and the Deny applies. An explicit Deny overrides any Allow, so the push is denied.

Answer

The push is denied only if the user is pushing to the 'main' branch.

Answer

The push succeeds because the Allow statement grants GitPush.

Answer

The push is denied because the Deny statement blocks all GitPush actions.

Question 13

Which TWO options are valid ways to trigger an AWS CodePipeline execution automatically? (Choose two.)

Accepted Answer

Changes to a CodeCommit repository.. AWS CodePipeline can automatically start a pipeline execution when a change is detected in a CodeCommit repository. This is achieved through CloudWatch Events that monitor the repository for specific events like push to a branch, and then trigger the pipeline. This integration allows for continuous delivery by automatically building and deploying code changes.

Answer

A scheduled CloudWatch Logs metric filter.

Answer

Completion of a CodeDeploy deployment.

Answer

Manual approval action in the pipeline.

Question 14

A DevOps engineer is responsible for monitoring a production environment that uses Amazon EC2 Auto Scaling. The engineer notices that the Auto Scaling group has been launching and terminating instances frequently over the past hour. The group uses a dynamic scaling policy based on average CPU utilization. The CloudWatch alarm that triggers scaling is set to a threshold of 70% CPU for scale-out and 30% for scale-in. The engineer checks the CloudWatch metrics and sees that CPU utilization is oscillating between 40% and 60%, never reaching the thresholds. The engineer suspects that the scaling policy is not working correctly. The engineer is considering the following actions: A) Change the scaling policy to use a target tracking policy with a target value of 50% CPU utilization. B) Increase the cooldown period for the scaling policy to 300 seconds. C) Disable the scale-in policy to prevent frequent terminations. D) Use a simple scaling policy instead of a dynamic scaling policy. Which action should the engineer take?

Accepted Answer

Change the scaling policy to use a target tracking policy with a target value of 50% CPU utilization.. A target tracking policy automatically adjusts the desired capacity to maintain a target utilization (e.g., 50%), which smooths out oscillations by continuously adapting to load rather than reacting to fixed thresholds. Option A is wrong because disabling scale-in could lead to over-provisioning and increased costs. Option C is wrong because simple scaling policies are more prone to causing oscillations due to step adjustments with cooldowns. Option D is wrong because increasing the cooldown period only delays scaling actions and does not address the root cause of oscillations; target tracking is more effective.

Answer

Disable the scale-in policy to prevent frequent terminations.

Answer

Use a simple scaling policy instead of a dynamic scaling policy.

Answer

Increase the cooldown period for the scaling policy to 300 seconds.

Question 15

A company runs a stateful web application on EC2 instances that store session data locally. They want to migrate to a stateless architecture for better resilience. Which TWO actions should they take?

Accepted Answer

Use Amazon DynamoDB to store session data.. DynamoDB provides a fully managed, low-latency, highly available NoSQL database that is ideal for storing session state externally. By moving session data to DynamoDB, the EC2 instances become stateless, allowing any instance to handle any request without relying on local storage, which improves resilience and scalability.

Answer

Use Amazon CloudFront to cache session data at the edge.

Answer

Use Amazon S3 to store session data as objects.

Answer

Use Amazon EFS to store session data as files.