DOP-C02 Practice Test 48 — 15 Questions

Question 1

A company uses AWS CodeCommit as a source repository and AWS CodeBuild for building artifacts. The DevOps team wants to ensure that all commits to the main branch trigger a build. Which steps should be taken? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the CodeBuild project to use the CodeCommit repository as the source and specify the main branch. Configuring the CodeBuild project to use the CodeCommit repository as the source and specifying the main branch ensures that CodeBuild knows which repository and branch to monitor for changes. This is the foundational step that links the source code to the build project, enabling automated builds when commits are pushed to the main branch.

Answer

Configure a webhook in the CodeCommit repository to notify CodeBuild

Answer

Use AWS CodeDeploy to trigger the build on commits

Question 2

A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline. The source stage is AWS CodeCommit, and the build stage uses AWS CodeBuild. The pipeline must only trigger on changes to the main branch. However, the engineer notices that the pipeline is also triggering on changes to feature branches that are merged via pull requests. What configuration change should the engineer make to ensure the pipeline only triggers on direct commits to the main branch?

Accepted Answer

Add a branch filter in the CloudWatch Events rule that triggers the pipeline, specifying only the main branch.. AWS CodePipeline pipelines are triggered by CloudWatch Events rules that monitor CodeCommit repository events. By default, the rule may trigger on all branch changes. Adding a branch filter in the CloudWatch Events rule that specifies only the main branch ensures that only direct commits to main trigger the pipeline, ignoring feature branch merges.

Answer

Configure the CodeCommit repository to disable events for all branches except main.

Answer

Modify the pipeline's source stage to use a branch name filter, which will ignore events from other branches.

Answer

Use a Lambda function as a source action to check the branch before starting the build.

Question 3

Which TWO actions should a DevOps engineer take to prevent an S3 bucket from being publicly accessible? (Choose two.)

Accepted Answer

Enable S3 Block Public Access at the bucket level.. Enabling S3 Block Public Access at the bucket level provides a centralized, override-proof mechanism to prevent any public access to the bucket, regardless of other policies or ACLs. This setting blocks all public access by default, including access granted via bucket policies, access control lists (ACLs), or object-level permissions, and cannot be overridden by any other S3 configuration.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable S3 Server Access Logging.

Answer

Configure a lifecycle policy to delete objects.

Question 4

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with AWS Key Management Service (SSE-KMS) and enforce that all new objects are encrypted. Which bucket policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}. Option C uses the valid condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` to deny `s3:PutObject` if the request does not include the specified KMS key ID. This enforces that all new objects are encrypted with that specific KMS key. Option A is incorrect because `s3:ServerSideEncryption` is not a valid condition key for S3. Option B is incorrect because it uses `StringEquals` instead of `StringNotEquals`, causing it to deny requests that include the specified KMS key, which prevents the use of SSE-KMS. Option D is incorrect because it uses `s3:x-amz-server-side-encryption` with value `AES256`, which enforces SSE-S3, not SSE-KMS.

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:ServerSideEncryption":"awskms"}}}

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 5

A company is running a critical application on Amazon ECS with Fargate launch type. The application writes logs to Amazon CloudWatch Logs. The DevOps team needs to set up an alert when the application generates more than 100 error logs in any 5-minute window. Which configuration should be used?

Accepted Answer

Create a CloudWatch Logs metric filter for 'ERROR' and a CloudWatch alarm on the resulting metric with a period of 5 minutes. A CloudWatch Logs metric filter can be configured to count occurrences of the word 'ERROR' in log streams. This filter creates a custom metric that can be monitored by a CloudWatch alarm with a period of 5 minutes. When the metric exceeds the threshold of 100, the alarm triggers an action such as an SNS notification. Option A is incorrect because CloudWatch Logs Insights is a query tool for interactive analysis, not for continuous real-time alerting. Option B is incorrect because EventBridge events are not generated from log content directly; you would need a metric filter or subscription filter to turn log data into events. Option D is incorrect because AWS CloudTrail logs API activities, not application error logs written to CloudWatch Logs.

Answer

Create a CloudWatch Logs Insights query that runs every 5 minutes and triggers an SNS notification

Answer

Create an Amazon EventBridge rule that matches CloudWatch Logs events for the word 'ERROR' and triggers an alarm

Answer

Enable AWS CloudTrail logging for the ECS task and create a metric filter on CloudTrail logs

Question 6

A DevOps engineer notices that an Amazon RDS for MySQL instance's CPU is consistently high during business hours. The engineer wants to identify the specific queries causing the high CPU. Which combination of services should be used to capture and analyze the queries? (Choose the best answer.)

Accepted Answer

Enable RDS Performance Insights and analyze the top SQL queries. RDS Performance Insights provides a database performance tuning feature that visualizes database load and identifies the specific SQL queries causing high CPU. It captures query-level metrics such as wait events, SQL digest, and host/user information, allowing the DevOps engineer to pinpoint the exact queries responsible for the CPU spike during business hours.

Answer

Enable RDS Enhanced Monitoring and view metrics in CloudWatch

Answer

Enable AWS X-Ray tracing on the application and database

Answer

Enable RDS audit logs and stream them to Amazon CloudWatch Logs

Question 7

A company runs a high-traffic web application on a fleet of EC2 instances behind an Application Load Balancer (ALB) with Auto Scaling. The application uses an Amazon RDS for PostgreSQL database. Recently, during a traffic spike, the application became unresponsive. Investigation revealed that the database CPU utilization reached 100%, causing queries to timeout. The Auto Scaling group added more EC2 instances, which only increased the load on the database. The DevOps team needs to implement a solution that prevents the database from being overwhelmed during traffic spikes while maintaining application availability. The solution must be cost-effective and require minimal changes to the application code. Which solution should the DevOps team implement?

Accepted Answer

Use Amazon RDS Proxy between the application and the database to pool and reuse connections.. RDS Proxy manages database connections efficiently, reducing the number of connections and CPU overhead. It also provides connection pooling, which helps handle spikes without overwhelming the database.

Answer

Implement read replicas for the RDS database and modify the application to use read replicas for read queries.

Answer

Increase the instance size of the RDS database to a larger instance type to handle more connections.

Answer

Configure Auto Scaling to launch EC2 instances based on a custom metric that tracks database CPU utilization, and throttle the number of instances.

Question 8

A developer is using AWS CloudFormation to deploy a stack that includes an AWS Lambda function. The Lambda function code is stored in an S3 bucket. The CloudFormation template references the S3 bucket and object key. The developer wants to update the Lambda function code by uploading a new zip file to S3 and then updating the stack. The developer updates the S3 object with a new version, but the stack update does not automatically use the new code. What should the developer do to ensure the stack update uses the new code?

Accepted Answer

Upload the new code to a different S3 key or specify a new version ID in the CloudFormation template.. CloudFormation only detects changes to S3 objects if the S3 key or version changes. By uploading the new code with a different key or specifying a new version ID in the template, CloudFormation will recognize the change and update the Lambda function. Option A is incorrect because S3 event notifications do not automatically trigger stack updates for code changes; they are typically used for other automation. Option B is incorrect because stack policies control whether resources can be updated, but they do not cause CloudFormation to detect the code change; the template reference itself must indicate a new version. Option C is incorrect because deleting and recreating the stack is unnecessary and disruptive; a simple stack update with a new version ID is sufficient.

Answer

Enable S3 event notifications to trigger a CloudFormation stack update when the object is updated.

Answer

Modify the CloudFormation stack policy to allow updates to the Lambda function.

Answer

Delete the stack and recreate it with the new code.

Question 9

A DevOps engineer needs to securely store and automatically rotate database credentials for a MySQL RDS instance. The credentials should be accessible to a Lambda function without hardcoding them. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it allows you to store secrets, automatically rotate them for supported RDS databases, and retrieve them programmatically via the Lambda runtime using the Secrets Manager API. AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for RDS. AWS KMS is used for managing encryption keys, not storing secrets. IAM roles for EC2 provide permissions to EC2 instances but cannot store credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

IAM roles for EC2

Question 10

A company is building a multi-tier web application on AWS. The web tier runs on EC2 instances behind an ALB. The application tier runs on EC2 instances that are not publicly accessible. The database tier runs on RDS MySQL. Which design provides the HIGHEST level of resilience for the database tier?

Accepted Answer

Deploy an RDS DB instance in a Multi-AZ configuration.. Multi-AZ RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, RDS automatically fails over to the standby, providing high availability with minimal downtime. This design ensures the database tier remains resilient against AZ-level failures without manual intervention.

Answer

Deploy a single RDS DB instance in one Availability Zone.

Answer

Deploy an RDS DB instance with a cross-region read replica.

Answer

Deploy an RDS DB instance with a read replica in the same region.

Question 11

A company wants to monitor and detect anomalous API calls in their AWS account. Which THREE AWS services should they use together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API calls made in the AWS account, providing the raw data needed to detect anomalous activity. By enabling CloudTrail on all regions and logging to a centralized S3 bucket, you capture the identity, source IP, and request parameters for every API call, which is essential for anomaly detection.

Answer

Amazon Inspector

Answer

AWS Config

Question 12

A DevOps engineer needs to implement a CI/CD pipeline that builds a Docker image, scans it for vulnerabilities, and deploys it to Amazon ECS. The scanning must be integrated into the pipeline before the image is pushed to Amazon ECR. Which approach meets these requirements?

Accepted Answer

Use CodeBuild to run a vulnerability scanner on the Docker image, then push to ECR only if the scan passes.. It uses CodeBuild to run a vulnerability scanner on the Docker image before pushing to ECR, ensuring that only images that pass the scan are stored and deployed. This satisfies the requirement to scan before the image is pushed to ECR, which is critical for preventing vulnerable images from entering the registry.

Answer

Enable ECR 'Scan on Push' and configure CodePipeline to deploy only if the scan result is clean.

Answer

Use AWS Lambda to scan the image after push and automatically roll back if vulnerabilities are found.

Answer

Use AWS Security Hub to scan images in ECR and block deployment.

Question 13

Refer to the exhibit. The CloudWatch alarm is set on CPUUtilization. The instance's CPU at 10:00 is 75%, at 10:05 is 82%, and at 10:10 is 85%. Will the alarm trigger?

Accepted Answer

Yes, but only after 10:10 when two consecutive periods are above the threshold.. The alarm evaluates 2 consecutive periods (each 5 minutes). At 10:05, the average for that period is 82% (above 80), but the previous period (10:00) average is 75% (below 80). So only one period is breached. At 10:10, the average for that period is 85% (above 80), and the previous period (10:05) average is 82% (above 80). So two consecutive periods are breached, triggering the alarm.

Answer

Yes, because the CPU exceeded 80% at 10:05.

Answer

No, because the alarm uses Average statistic and the average over the entire time is below 80%.

Answer

No, because the first data point at 10:00 is below the threshold.

Question 14

A DevOps team is designing a CI/CD pipeline for a microservices application that runs on Amazon ECS. They need to implement automated canary deployments. Which TWO AWS services would be essential for this implementation?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is essential because it natively supports canary deployments for Amazon ECS through its ECS blue/green deployment type, allowing you to specify a canary traffic shift (e.g., 10% for 5 minutes) before full promotion. This enables automated, controlled rollouts with built-in rollback capabilities based on CloudWatch alarms.

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Answer

Amazon EC2 Auto Scaling

Question 15

A DevOps team is designing a CI/CD pipeline for a microservices application using AWS CodePipeline. They want to incorporate infrastructure as code (IaC) using AWS CloudFormation. Which three practices should they follow to ensure reliable and repeatable deployments? (Choose THREE.)

Accepted Answer

Use the same CloudFormation template across all environments, with parameterization for environment-specific values.. Using a single CloudFormation template across all environments with parameterization ensures consistency and reduces drift. Environment-specific values (e.g., instance sizes, subnet IDs) are passed as parameters, so the same template logic applies to dev, test, and prod, making deployments repeatable and auditable.

Answer

Create a single monolithic template for all microservices to simplify management.

Answer

Skip change sets during stack updates to speed up the pipeline.