DOP-C02 Practice Test 48 — 15 Questions

Question 1

A company uses AWS OpsWorks for configuration management. The DevOps team wants to automate the patching of operating system updates on a set of EC2 instances managed by OpsWorks. Which OpsWorks feature should be used?

Accepted Answer

Weekly Auto Update. Option B is correct because OpsWorks Stacks supports automatic patching via the 'Auto Healing' and 'Custom Recipes' but also has a built-in 'Weekly Auto Update' feature for managed instances. Option A (Auto Scaling) handles capacity, not patching. Option C (Lifecycle events) can be used to trigger custom recipes for patching, but the question asks for a specific feature. Option D (Chef Automate) is a separate product, not natively integrated with OpsWorks Stacks.

Answer

Auto Scaling

Answer

Chef Automate

Answer

Lifecycle events (Setup, Configure, Deploy, etc.)

Question 2

A DevOps team uses AWS CodePipeline to deploy a web application. They notice that the deployment stage fails intermittently due to a missing configuration file. Which troubleshooting step should they take first?

Accepted Answer

Review the build logs in AWS CodeBuild to identify the error.. Option A is correct because checking the build logs is the first step to identify why the file is missing. Option B is wrong because recreating the pipeline does not address the root cause. Option C is wrong because CodeBuild is for building, not deployment. Option D is wrong because CodeDeploy logs are relevant only if the file is missing at deployment time, but the issue occurs during the build stage.

Answer

Switch to AWS CodeBuild for the deployment stage.

Answer

Recreate the pipeline with the same configuration to see if the issue repeats.

Answer

Verify the deployment group settings in AWS CodeDeploy.

Question 3

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. They want to ensure that the VPC has internet access for the public subnets. Which THREE resources must be included in the template?

Accepted Answer

AWS::EC2::Route (pointing to InternetGateway). Option A is correct because an internet gateway is required for internet access. Option B is correct because a route table is needed to route traffic. Option D is correct because a route to the internet gateway must be added to the route table. Option C is wrong because a NAT gateway is for private subnets. Option E is wrong because a VPC endpoint is for private connectivity to AWS services.

Answer

AWS::EC2::VPCEndpoint

Answer

AWS::EC2::NatGateway

Question 4

A company uses AWS Config to evaluate compliance of their AWS resources. They have a custom rule that checks whether EC2 instances have a specific tag. They notice that the rule is not triggering on existing instances. What is a possible reason?

Accepted Answer

The rule is not configured with a trigger type of 'Configuration changes' or 'Periodic'. AWS Config custom rules evaluate resources only when they are created or changed, or during periodic evaluations. If the rule is not configured for periodic evaluation, it won't check existing resources until a change occurs. Option C is correct. Option A is incorrect because permissions are needed for the rule to invoke the Lambda function, but if it's not triggering at all, it's not a permission issue. Option B is incorrect because AWS Config supports custom rules with Lambda. Option D is incorrect because resource types must be recorded, but that is usually set up initially.

Answer

AWS Config does not support custom rules

Answer

The Lambda function does not have permission to describe EC2 instances

Answer

The EC2 instances are not in the resource types being recorded by AWS Config

Question 5

A DevOps engineer is troubleshooting a CloudFormation stack creation failure. The stack includes an EC2 instance with a UserData script that installs software. The stack creation fails with the error: 'The following resource(s) failed: EC2Instance (AWS::EC2::Instance) – Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack creation timed out or was manually cancelled. Option D is correct because Resource creation cancelled indicates the stack creation timed out or was manually cancelled. UserData scripts do not affect CloudFormation resource status unless the instance is created with a CreationPolicy or WaitCondition. Option A is incorrect because UserData failure does not cause a CloudFormation error. Option B is incorrect because Resource creation cancelled is not due to API rate limiting. Option C is incorrect because missing IAM role would cause an 'AccessDenied' error, not cancellation.

Answer

The EC2 instance type is not supported in the region

Answer

The IAM role attached to the instance lacks permissions

Answer

The UserData script failed due to a syntax error

Question 6

An organization manages multiple AWS accounts using AWS Organizations. They want to enforce that all Amazon S3 buckets across accounts have versioning enabled. Which approach is the most scalable and least error-prone?

Accepted Answer

Create an SCP that denies s3:PutBucketVersioning if versioning is not enabled.. Option C is correct because using a service control policy (SCP) at the organizational level can deny the creation of S3 buckets without versioning, enforcing compliance across all accounts. Option A is wrong because it is not automated and depends on each account owner. Option B is wrong because Config rules only detect non-compliance, they do not prevent it. Option D is wrong because CloudFormation StackSets would require deploying a template to every account and region, which is more complex than an SCP.

Answer

Use AWS Config rules to detect buckets without versioning and send alerts.

Answer

Deploy a CloudFormation StackSet to all accounts with a template that enables versioning.

Answer

Manually enable versioning on each bucket after creation.

Question 7

A company uses AWS Elastic Beanstalk to deploy web applications. The DevOps team wants to implement a blue/green deployment strategy to minimize downtime. Which Elastic Beanstalk feature should be used?

Accepted Answer

Environment URL swap. Option C is correct because Elastic Beanstalk supports blue/green deployments by swapping environment URLs between two environments. Option A (Rolling update) updates instances incrementally, not blue/green. Option B (Immutable update) creates a new Auto Scaling group but does not swap URLs. Option D (Canary deployment) is not supported natively in Elastic Beanstalk; it is for Lambda.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update

Question 8

A company uses AWS Elastic Beanstalk for application deployments. They want to integrate infrastructure-as-code practices using AWS CloudFormation. Which approach allows them to manage the Elastic Beanstalk environment and underlying resources as part of a CloudFormation stack?

Accepted Answer

Define the Elastic Beanstalk environment in the CloudFormation template using the AWS::ElasticBeanstalk::Environment resource.. Option B is correct because CloudFormation supports the AWS::ElasticBeanstalk::Environment resource type, which can be used to create and manage Elastic Beanstalk environments within a stack. Option A is wrong because Elastic Beanstalk environments are not directly compatible with CloudFormation custom resources. Option C is wrong because CloudFormation does not import existing Elastic Beanstalk environments. Option D is wrong because Elastic Beanstalk does not generate CloudFormation templates automatically.

Answer

Use a custom resource backed by a Lambda function to create the Elastic Beanstalk environment.

Answer

Use the CloudFormation import feature to bring the existing Elastic Beanstalk environment into the stack.

Answer

Export the Elastic Beanstalk environment configuration as a CloudFormation template from the console.

Question 9

A DevOps engineer is designing a configuration management solution for a fleet of EC2 instances. The instances are ephemeral and frequently replaced by an Auto Scaling group. The engineer needs to ensure that newly launched instances are automatically configured with the latest software packages and settings. Which AWS service should be used?

Accepted Answer

AWS Systems Manager State Manager. Option A is correct because AWS Systems Manager State Manager can associate a configuration with instances based on tags or resource groups, ensuring new instances are configured automatically. Option B (OpsWorks) is suited for long-lived instances. Option C (CloudFormation) is for infrastructure provisioning, not ongoing configuration. Option D (CodeDeploy) is for deploying applications, not system configuration.

Answer

AWS CodeDeploy

Answer

AWS OpsWorks Stacks

Answer

AWS CloudFormation

Question 10

A developer wants to provision AWS resources using AWS Cloud Development Kit (CDK) and ensure that the infrastructure can be version-controlled and reviewed. Which practice should they follow?

Accepted Answer

Write the CDK app in TypeScript, store it in a Git repository, and use CDK pipelines for deployment.. Option A is correct because CDK apps should be written in a supported programming language, synthesized to CloudFormation templates, and deployed. Version control of the source code enables review. Option B is wrong because CDK does not generate Terraform. Option C is wrong because CDK apps are not deployed directly; they are synthesized. Option D is wrong because CDK does not require separate templates; it generates them.

Answer

Write the CDK app and deploy directly without synthesis to avoid extra steps.

Answer

Write the CDK app to generate Terraform configurations and store them in Git.

Answer

Write raw CloudFormation templates instead of CDK to simplify version control.

Question 11

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a parameter for the instance type of EC2 instances. The DevOps team wants to restrict the allowed values to a specific set of instance types. Which CloudFormation section should be used?

Accepted Answer

Parameters with AllowedValues. Option C is correct because the AllowedValues property in the Parameters section restricts input values. Option A (Mappings) maps keys to values, not input restriction. Option B (Conditions) determine resource creation. Option D (Outputs) return values after stack creation.

Answer

Outputs

Answer

Conditions

Answer

Mappings

Question 12

An operations team manages a fleet of Amazon EC2 instances that require periodic software updates. They want to use AWS Systems Manager to apply patches automatically while ensuring that patches are tested before production deployment. Which approach meets these requirements?

Accepted Answer

Use AWS Systems Manager Patch Manager with maintenance windows, and configure a patch baseline that approves patches after a test period.. Option C is correct because Systems Manager Patch Manager supports patch baselines and maintenance windows, and can be used with State Manager to schedule patching. By creating separate patching schedules for test and production, patches can be tested first. Option A is wrong because Patch Manager does not automatically install patches without a maintenance window. Option B is wrong because Run Command is manual. Option D is wrong because Automation is not designed for patching.

Answer

Use AWS Systems Manager Automation to create a runbook that patches instances one by one.

Answer

Create a patch baseline and assign it to all instances; enable automatic approval for all patches.

Answer

Use AWS Systems Manager Run Command to manually run patch commands on test instances, then on production.

Question 13

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to ensure that stack updates are reviewed and approved by a senior engineer before being executed. Which feature should they implement?

Accepted Answer

Change sets. Change sets allow you to preview proposed changes before applying them. Option B is correct. Option A is incorrect because stack policies protect stack resources during updates but do not provide a review mechanism. Option C is incorrect because drift detection detects changes outside of CloudFormation. Option D is incorrect because stack sets deploy stacks across accounts/regions.

Answer

Stack policies

Answer

Drift detection

Answer

Stack sets

Question 14

A company is designing a CI/CD pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy. They need to ensure that the pipeline can deploy to multiple environments (dev, test, prod) with manual approval gates. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create separate stages in the pipeline for dev, test, and prod. To implement manual approval gates, CodePipeline supports approval actions. Each environment can be a separate stage. Options B and D are correct. Option A is incorrect because one pipeline cannot have multiple branches for different environments; you would use separate pipelines or stages. Option C is incorrect because CodeDeploy deployment groups can be used for different environments, but the approval gate is in CodePipeline. Option E is incorrect because CodeBuild is for building, not for approvals.

Answer

Configure a single pipeline with multiple branches in the source stage

Answer

Use CodeDeploy deployment groups to represent each environment

Answer

Use CodeBuild batch builds to manage environment promotion

Question 15

A company is designing a multi-region disaster recovery strategy for a stateless web application. They want to minimize RTO and RPO. Which TWO of the following should they implement? (Choose TWO.)

Accepted Answer

Use cross-region replication for data stores.. Options A and D are correct. Active-active with Route 53 weighted records provides immediate failover with minimal RTO. Cross-region replication of data keeps the data in sync, reducing RPO. Option B is incorrect because standby in a single AZ does not help for regional failures. Option C is incorrect because backup and restore has high RTO/RPO. Option E is incorrect because read replicas are for read scaling, not DR.

Answer

Use a passive standby in a single Availability Zone.

Answer

Perform periodic backups and restore in the DR region.

Answer

Configure cross-region read replicas for the database.