DOP-C02 Practice Test 47 — 15 Questions

Question 1

A DevOps engineer creates the CloudFormation template shown in the exhibit. When the stack is created, the EC2 instance is launched but the security group is not applied to the instance. What is the likely cause?

Accepted Answer

The instance does not have a SecurityGroup or SecurityGroupIds property referencing the security group.. Option D is correct because the template does not associate the security group with the instance; the DependsOn only ensures creation order, but does not attach the group. Option A is wrong because DependsOn does not automatically attach. Option B is wrong because the security group is created. Option C is wrong because the security group is created first due to DependsOn, but still not attached.

Answer

The security group resource is missing a VpcId property, so it is not created in the same VPC as the instance.

Answer

The security group is created after the instance, so the instance cannot reference it.

Answer

The DependsOn clause should be removed because it causes a circular dependency.

Question 2

A company runs a critical application on EC2 instances in an Auto Scaling group behind an ALB. They want to ensure that if an instance fails, the application remains available with minimal disruption. Which combination of services provides the best resilience?

Accepted Answer

Auto Scaling group with ELB health checks and multiple AZs.. Option D is correct because the combination of Auto Scaling to replace instances, health checks to detect failure, and Multi-AZ deployment ensures availability. Option A is incorrect because it lacks health checks. Option B is incorrect because it uses Auto Scaling in a single AZ. Option C is incorrect because it uses EC2 recovery, which does not replace the instance automatically if it's terminated.

Answer

Auto Scaling group with minimum 2 in a single AZ.

Answer

EC2 instance recovery with CloudWatch alarms.

Answer

Auto Scaling group with desired capacity of 2 and a lifecycle hook.

Question 3

A company wants to design a resilient architecture for a web application using AWS services. Which of the following is a best practice for improving resilience?

Accepted Answer

Deploy EC2 instances in multiple Availability Zones.. Option A is correct because deploying across multiple Availability Zones ensures that if one AZ fails, the application remains available. Option B is incorrect because a single EC2 instance in one AZ is not resilient. Option C is incorrect because a single AZ with RDS Multi-AZ still has a single point of failure at the AZ level. Option D is incorrect because Auto Scaling in one AZ is still vulnerable to AZ failure.

Answer

Use an Auto Scaling group in a single AZ.

Answer

Use a single AZ with RDS Multi-AZ.

Answer

Use one large EC2 instance to handle all traffic.

Question 4

A DevOps engineer runs the command shown in the exhibit to view stack events. The stack update failed. What is the most likely cause of the failure?

Accepted Answer

The Lambda function specifies a runtime that is not available in the region.. Option B is correct because the error message indicates that the runtime 'nodejs18.x' is not supported. Option A is wrong because the error is about runtime, not S3 access. Option C is wrong because the error is specific to Lambda runtime, not IAM. Option D is wrong because the error is about an invalid parameter, not a timeout.

Answer

The IAM role for the Lambda function is missing required permissions.

Answer

The Lambda function code exceeds the maximum size limit.

Answer

The S3 bucket containing the template is not accessible.

Question 5

A DevOps engineer is using AWS CloudFormation to deploy a stack that includes a VPC with public and private subnets. The engineer wants to ensure that the public subnets automatically get a public IP address assigned to instances launched in them. Which property should be set?

Accepted Answer

MapPublicIpOnLaunch on the subnet. Option D is correct because MapPublicIpOnLaunch set to true allows public IP assignment. Option A (AssociatePublicIpAddress) is not a subnet property. Option B (EnableDnsHostnames) is for VPC DNS. Option C (EnableDnsSupport) is also for VPC DNS.

Answer

EnableDnsSupport on the VPC

Answer

EnableDnsHostnames on the VPC

Answer

AssociatePublicIpAddress on the instance

Question 6

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodePipeline and Amazon ECS. The pipeline should build a Docker image, push it to Amazon ECR, and deploy it to an ECS service. Which deployment action should they use in the pipeline?

Accepted Answer

Amazon ECS (Blue/Green) deployment provider with CodeDeploy.. Option B is correct because the ECS deployment provider in CodePipeline supports deploying to ECS services, including blue/green deployments with CodeDeploy. Option A is wrong because CodeBuild is for building, not deploying. Option C is wrong because Elastic Beanstalk is for web applications, not ECS. Option D is wrong because CloudFormation is not a direct deployment action for ECS services.

Answer

AWS Elastic Beanstalk deployment action.

Answer

AWS CodeBuild with a buildspec that runs aws ecs update-service.

Answer

AWS CloudFormation deployment action to update the ECS service.

Question 7

A company uses AWS Systems Manager to manage hybrid servers. They want to automate the patching of Windows servers using Patch Manager. However, some servers are not showing up in the compliance reporting. What should the DevOps engineer check first?

Accepted Answer

Ensure the SSM Agent is installed and running on the servers. The SSM Agent must be installed and running on the servers to communicate with Systems Manager. Option B is correct. Option A is incorrect because tags are used for targeting but not for basic connectivity. Option C is incorrect because the Patch Baseline is a configuration, not a connectivity requirement. Option D is incorrect because the IAM instance profile must be attached to the instance, not a service role.

Answer

Verify that the servers have the correct patch baseline tags

Answer

Check that the Patch Baseline is configured to include the missing servers

Answer

Confirm that the servers have an IAM service role for Systems Manager

Question 8

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team wants to ensure that critical resources, such as an RDS database, are not accidentally deleted when a stack is updated or deleted. Which CloudFormation feature should be used to prevent this?

Accepted Answer

DeletionPolicy attribute with Retain. Option D is correct because DeletionPolicy with Retain prevents the resource from being deleted when the stack is deleted. Option A (Stack policy) controls updates to stack resources, not deletion prevention. Option B (Termination protection) is an EC2 feature, not native to CloudFormation. Option C (DependsOn) only defines resource creation order, not deletion behavior.

Answer

Stack policy

Answer

Termination protection

Answer

DependsOn attribute

Question 9

A company uses AWS CloudFormation to manage infrastructure. The DevOps team wants to implement a change management process where all stack updates must be reviewed before execution. Which AWS feature should be used?

Accepted Answer

Change Sets. Option C is correct because Change Sets allow you to review proposed changes before executing them. Option A (Stack policy) controls update permissions. Option B (StackSets) manage stacks across accounts. Option D (Drift detection) detects configuration drift.

Answer

Drift detection

Answer

StackSets

Answer

Stack policies

Question 10

A company uses AWS CloudFormation to manage infrastructure. They have a stack that includes a VPC, subnets, and EC2 instances. They want to update the AMI ID of an EC2 instance without causing downtime. Which TWO approaches meet this requirement?

Accepted Answer

Use a CloudFormation update with a rolling update policy on the Auto Scaling group.. Option A is correct because a rolling update can replace instances one at a time, minimizing downtime. Option D is correct because a custom resource can run a script to update the instance without replacing it. Option B is wrong because deleting and recreating the stack causes downtime. Option C is wrong because update with replacement replaces the instance, causing downtime. Option E is wrong because multi-AZ is for RDS, not EC2.

Answer

Use CloudFormation stack update with 'UpdatePolicy' set to 'AutoScalingRollingUpdate' and 'MinInstancesInService' set to 0.

Answer

Delete the stack and recreate it with the new AMI.

Answer

Deploy the instances across multiple Availability Zones and update each zone separately.

Question 11

A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application. The application uses AWS Lambda functions and Amazon API Gateway. The engineer wants to implement a canary deployment strategy for the Lambda functions to reduce risk. Which AWS service or feature should be used to achieve this?

Accepted Answer

AWS Lambda traffic shifting using aliases. Option B is correct because AWS Lambda supports traffic shifting using aliases with weighted targets, enabling canary deployments. Option A (CodeDeploy with Lambda) is correct but more specific: CodeDeploy can orchestrate canary deployments for Lambda, but it uses Lambda's built-in traffic shifting. Option C (SAM with AutoPublishAlias) is also correct but is a feature within SAM, not a separate service. However, the question asks for an AWS service or feature; both CodeDeploy and SAM's AutoPublishAlias are valid. But CodeDeploy is the native service for deployment strategies. Option D (CloudFormation with UpdatePolicy) is not applicable for Lambda canary deployments.

Answer

AWS CloudFormation with UpdatePolicy attribute

Question 12

A company uses AWS CloudFormation to deploy infrastructure across multiple accounts. They want to reuse a set of resource definitions for a standard VPC configuration. Which approach minimizes duplication and maintains centralized control?

Accepted Answer

Create a CloudFormation module for the VPC resources and reference it in each stack.. Option A is correct because AWS CloudFormation modules allow packaging reusable resource configurations that can be shared across stacks and accounts, reducing duplication and enabling centralized updates. Option B is wrong because nested stacks require separate templates, not reuse within a template. Option C is wrong because macros are for template processing, not reusable components. Option D is wrong because Service Catalog is for end-user product provisioning, not infrastructure reuse.

Answer

Define the VPC resources in a CloudFormation macro and call the macro from each stack.

Answer

Publish the VPC template in AWS Service Catalog and have each account provision from it.

Answer

Use nested stacks by creating a separate template for the VPC and including it in each account's stack.

Question 13

A team is using AWS CodeDeploy to deploy a web application to EC2 instances. They want to ensure that rollbacks occur automatically if the deployment fails. Which THREE configurations are necessary?

Accepted Answer

Configure a CloudWatch Events rule to trigger a rollback on deployment failure.. Option A is correct because a trigger can invoke a rollback when a deployment fails. Option C is correct because rollback configuration in the deployment group enables automatic rollback. Option D is correct because alarms can trigger rollback based on health metrics. Option B is wrong because load balancer is not required for rollback. Option E is wrong because lifecycle hooks are for running scripts, not for rollback.

Answer

Add lifecycle event hooks to stop the deployment if a script fails.

Answer

Associate an Application Load Balancer with the deployment group.

Question 14

A company uses AWS CodeBuild to build and test code. They need to securely store sensitive parameters, such as database passwords, and inject them into the build process. Which AWS service should they use?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store is designed to store configuration data and secrets securely. Option D is correct. Option A is incorrect because Secrets Manager can also store secrets but is more expensive and not necessary for simple build parameters. Option B is incorrect because KMS is a key management service, not a parameter store. Option C is incorrect because CodeBuild does not store secrets natively.

Answer

Storing them in the CodeBuild project environment variables

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Question 15

A company is using AWS CodePipeline for CI/CD with CloudFormation as the deployment action. The pipeline fails intermittently with the error 'Rate exceeded' when creating or updating stacks. What is the most likely cause and solution?

Accepted Answer

The CloudFormation API rate limit is being hit; request a limit increase from AWS Support.. Option D is correct because CloudFormation has an account-level rate limit for API calls, and the error indicates the limit is being exceeded. The solution is to request a limit increase. Option A is wrong because CodePipeline does not have a rate limit that would cause this specific error. Option B is wrong because IAM permissions would cause an 'AccessDenied' error, not 'Rate exceeded'. Option C is wrong because stack policies do not cause rate limit errors.

Answer

The stack has a stack policy that prevents updates; modify the stack policy.

Answer

The IAM role used by CloudFormation does not have sufficient permissions; update the role policy.

Answer

The pipeline is exceeding the CodePipeline execution frequency limit; reduce the number of pipeline executions.

DOP-C02 Practice Test 47 — 15 Questions

Exhibit

DOP-C02 Practice Test 47 — 15 Questions

Exhibit