DOP-C02 Practice Test 49 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a VPC with public and private subnets. They want to ensure that the VPC has internet access for the public subnets. Which THREE resources must be included in the template?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS::EC2::Route (pointing to InternetGateway). An AWS::EC2::Route resource that points to an InternetGateway is required to direct traffic from the public subnet's route table to the internet. Without this route, instances in the public subnet cannot send or receive traffic from the internet, even if an Internet Gateway is attached to the VPC.

Answer

AWS::EC2::VPCEndpoint

Answer

AWS::EC2::NatGateway

Question 2

A company runs a critical application on EC2 instances behind an Application Load Balancer. The application uses an Amazon RDS for PostgreSQL Multi-AZ DB instance. During a recent failover test, the application experienced a 5-minute downtime. The RDS failover completed within 30 seconds. What is the most likely cause of the prolonged downtime?

Accepted Answer

The application caches DNS resolutions, causing it to connect to the old writer endpoint. The most likely cause is that the application caches DNS resolutions, causing it to continue connecting to the old writer endpoint after failover. When an RDS Multi-AZ failover occurs, the DNS record for the writer endpoint is updated to point to the new primary instance, but the application's cached DNS entry still points to the old IP address. Since the old primary is now a standby and no longer accepts connections, the application experiences downtime until the DNS cache expires (typically 5–60 seconds) or the application refreshes the DNS resolution. The 5-minute downtime suggests the application uses a long DNS TTL or a custom caching layer that delays reconnection.

Answer

The RDS Multi-AZ failover took longer than expected due to a large transaction log

Answer

The Application Load Balancer health checks marked all instances as unhealthy during the failover

Answer

The application was using read replicas for writes, which failed during failover

Question 3

A company is designing a CI/CD pipeline for a serverless application using AWS CodePipeline. Which TWO actions are valid ways to deploy an AWS Lambda function?

Accepted Answer

Use AWS CloudFormation to update the Lambda function's stack.. AWS CloudFormation can manage Lambda function deployments as part of a stack update. By defining the Lambda function resource in a CloudFormation template, CodePipeline can trigger a stack update that creates or updates the function, ensuring infrastructure-as-code best practices and consistent deployments.

Answer

Use Amazon S3 to trigger the Lambda function deployment.

Answer

Use AWS CodeBuild to directly deploy the Lambda function.

Answer

Use AWS CodeCommit to push the Lambda code.

Question 4

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) across multiple Availability Zones. The application stores session data in a shared Amazon ElastiCache for Redis cluster. The operations team reports that during a recent AZ failure, users experienced session loss and application errors. Which combination of actions should the company take to improve resilience and maintain session state during an AZ failure? (Choose TWO.)

Accepted Answer

Configure the ALB with cross-zone load balancing enabled and connection draining set to a suitable timeout.. Enabling cross-zone load balancing on the ALB ensures traffic is distributed evenly across all EC2 instances in all AZs, and connection draining with a suitable timeout allows in-flight requests to complete before instances are deregistered, preventing session loss during an AZ failure. Option C is correct because enabling cluster mode for ElastiCache for Redis with replica nodes in different AZs provides automatic sharding and replication, ensuring session data remains available and consistent even if a primary node in one AZ fails. Option E is incorrect because while ElastiCache for Redis supports Multi-AZ with automatic failover, it alone does not guarantee that replica nodes are placed in different Availability Zones for each shard; enabling cluster mode with replicas in different AZs (Option C) provides a more comprehensive solution for maintaining session state during an AZ failure.

Answer

Deploy an Auto Scaling group with a dynamic scaling policy that adds instances in the remaining AZs.

Answer

Configure the application to use a custom DNS name with a low TTL pointing to the ElastiCache cluster endpoint.

Answer

Enable Multi-AZ for the ElastiCache cluster to automatically fail over to a replica in another AZ.

Question 5

A company's security team notices that an IAM user has permissions to terminate EC2 instances but should only be allowed to stop them. The current policy allows ec2:TerminateInstances. What is the most secure way to prevent termination while allowing stop?

Accepted Answer

Add a Deny statement for ec2:TerminateInstances with a condition for the user's ARN.. The most secure because adding a Deny statement for ec2:TerminateInstances with a condition for the user's ARN explicitly blocks the termination action, regardless of any other policies that might allow it. Option A is wrong because an SCP affects the entire account, not just the user, and may be too broad. Option B is wrong because simply modifying the policy to include ec2:StopInstances and remove ec2:TerminateInstances does not prevent termination if the user has other policies that grant ec2:TerminateInstances. Option D is wrong because attaching a separate Deny policy is effective but less direct and more complex than adding a Deny in the same policy.

Answer

Use an SCP to deny ec2:TerminateInstances for the entire account.

Answer

Modify the existing policy to include ec2:StopInstances and remove ec2:TerminateInstances.

Answer

Attach a separate managed policy that denies ec2:TerminateInstances to the user.

Question 6

A DevOps team uses Elastic Beanstalk to deploy a web application. They want to configure environment variables without modifying the application code. Where should they define these variables?

Accepted Answer

As environment properties in the Elastic Beanstalk environment. Elastic Beanstalk environment properties are key-value pairs defined in the environment configuration that are injected as environment variables into the application's runtime. They allow configuration changes without modifying application code, and can be set via the console, CLI, or .ebextensions. This is the standard mechanism for externalizing configuration in Elastic Beanstalk.

Answer

In the EC2 User Data script

Answer

In the instance metadata

Answer

In the application code

Question 7

A company uses AWS CodeBuild to run builds for a Java application. The buildspec includes a 'mvn test' command. The build succeeds but the tests fail. The team wants to fail the build if any test fails. What should they do?

Accepted Answer

Ensure the buildspec's 'build' phase includes the test command and that the command returns a non-zero exit code on failure.. CodeBuild determines build success or failure based on the exit code of commands in the buildspec. The 'mvn test' command returns a non-zero exit code when tests fail, which causes the build to fail if placed in the 'build' phase. By ensuring the test command is in the 'build' phase and not suppressed (e.g., with '|| true'), the build will fail on test failure.

Answer

Add a 'post_build' phase that fails the build if tests fail.

Answer

Add a 'test' phase in the buildspec before the 'build' phase.

Answer

Configure the build project to use batch builds.

Question 8

A company uses Terraform to manage a multi-account AWS environment. The Terraform state files are stored in an S3 bucket with DynamoDB locking. Recently, a DevOps engineer ran 'terraform apply' from a CI/CD pipeline, and it failed with the error: 'Error acquiring the state lock. Lock ID: "abc123". Possible causes: Another process has the lock; or a previous process crashed.' The engineer checks DynamoDB and sees that the lock item exists but there is no active Terraform process. The engineer needs to proceed with the deployment urgently. What should the engineer do?

Accepted Answer

Use the 'terraform force-unlock' command with the lock ID to remove the lock.. The correct action is to use 'terraform force-unlock' with the lock ID to remove the stale lock. This command is specifically designed to safely release a lock when no active Terraform process holds it, allowing the deployment to proceed. It ensures the lock is removed in a controlled manner, preserving state integrity.

Answer

Wait for the lock to expire automatically.

Answer

Delete the state file from S3 and recreate it from the last backup.

Answer

Manually delete the lock item from DynamoDB using the AWS Console.

Question 9

A DevOps engineer sets up a CloudWatch dashboard to monitor an application's performance. The application runs on EC2 instances in an Auto Scaling group. The engineer wants to display the average CPU utilization across all instances in the group. Which CloudWatch metric and statistic should be used?

Accepted Answer

CPUUtilization metric with the Average statistic, filtered by Auto Scaling group.. To display the average CPU utilization across all instances in an Auto Scaling group, you should use the CPUUtilization metric with the Average statistic, filtered by the Auto Scaling group dimension. This aggregates the CPU utilization of all instances, providing a representative average.

Answer

CPUUtilization metric with the Sum statistic, filtered by Auto Scaling group.

Answer

StatusCheckFailed metric with the Average statistic, filtered by Auto Scaling group.

Answer

NetworkOut metric with the Average statistic, filtered by Auto Scaling group.

Question 10

A company wants to ensure that all code changes are reviewed before being merged to the main branch in AWS CodeCommit. Which feature should be enabled?

Accepted Answer

Create an approval rule template and associate it with the main branch.. AWS CodeCommit does not natively support branch protection rules like GitHub or GitLab. Instead, you must create an approval rule template and associate it with the main branch to require at least one approved pull request before merging. This ensures all code changes are reviewed before being merged to the main branch.

Answer

Configure a Lambda function to validate commits and block pushes.

Answer

Enable branch protection rules on the repository.

Answer

Use CloudWatch Events to notify when a push occurs.

Question 11

A DevOps engineer is designing a CI/CD pipeline for a Python application using AWS CodeBuild and AWS CodeDeploy. The application is deployed to an Auto Scaling group of EC2 instances. The engineer wants to ensure that the deployment does not impact availability. Which TWO strategies can be used? (Choose 2.)

Accepted Answer

Rolling deployment with a small batch size.. Rolling deployment with a small batch size (Option B) updates a limited number of instances at a time, ensuring that the majority of the Auto Scaling group remains available throughout the deployment. Blue/green deployment (Option D) creates a separate, fully-provisioned environment (green) and switches traffic to it only after validation, which eliminates downtime during the cutover. Both strategies directly preserve application availability by avoiding full-scale disruption.

Answer

In-place deployment with a large batch size.

Answer

Immutable deployment.

Answer

Canary deployment.

Question 12

A company runs a microservices application on Amazon EKS. The application's frontend service needs to communicate with the backend service. The DevOps team wants to implement service-to-service authentication using AWS IAM. Which method should the team use?

Accepted Answer

Use IAM roles for service accounts (IRSA) to associate an IAM role with each service's Kubernetes service account.. IAM roles for service accounts (IRSA) allows each Kubernetes service account to assume an IAM role with fine-grained permissions, enabling secure service-to-service authentication without managing long-lived credentials. The frontend service can use its associated IAM role to sign AWS API requests (e.g., STS AssumeRole) to authenticate to the backend service, which validates the role via IAM policies. This approach integrates natively with EKS and follows AWS best practices for workload identity.

Answer

Configure the backend service as an Amazon RDS database with IAM database authentication.

Answer

Use AWS App Mesh with mTLS for authentication between services.

Answer

Create an IAM user with access keys and store them as Kubernetes secrets.

Question 13

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that failed. Which TWO resources should the engineer examine to identify the cause of the failure? (Choose two.)

Accepted Answer

CloudWatch Logs for CodeDeploy. AWS CodeDeploy emits detailed logs about deployment lifecycle events (e.g., BeforeInstall, ApplicationStop) to CloudWatch Logs. These logs contain error messages, script output, and status codes that directly indicate why a deployment step failed, such as a permission issue or a script syntax error. Examining CloudWatch Logs for CodeDeploy is the primary method to diagnose deployment failures.

Answer

EC2 instance system logs

Answer

S3 access logs

Answer

CloudTrail logs

Question 14

A company uses AWS Secrets Manager to rotate database credentials automatically. The rotation is configured to occur every 30 days. The DevOps engineer notices that the latest secret version is not being used by the application after rotation. The application is an EC2 instance that retrieves the secret using the AWS SDK. The engineer checks the secret and sees that the rotation succeeded and the new version is marked as 'AWSCURRENT'. The EC2 instance role has permissions to retrieve the secret. What is the most likely reason the application is still using the old secret?

Accepted Answer

The application caches the secret value and does not refresh it until the cache expires or the application is restarted.. The most likely reason is that the application caches the secret value in memory and does not refresh it until the cache expires or the application restarts. Even though the secret rotation succeeded and the new version is marked AWSCURRENT, the application continues to use the cached old credentials until it re-fetches the secret. This is a common issue with applications that retrieve secrets at startup and hold them.

Answer

The secret is in a different AWS Region than the application.

Answer

The EC2 instance does not have permission to call secretsmanager:GetSecretValue.

Answer

The rotation Lambda function is not updating the secret version label to AWSCURRENT.

Question 15

A company runs a stateless web application on AWS Lambda behind an Application Load Balancer (ALB). During a deployment, the team updates the Lambda function to a new version. Some users report seeing the old version of the application for several minutes after the deployment. What is the MOST likely cause?

Accepted Answer

The ALB target group is still pointing to the old Lambda function version due to connection draining.. When an ALB is used with Lambda, the ALB invokes a specific Lambda function version or alias. If the deployment updates the Lambda function but the ALB target group alias is not updated atomically, or if connection draining keeps old connections active, some requests may still be routed to the old version. This can cause users to see the old application for several minutes. Option A is wrong because Lambda versions are immutable, so gradual rollout is not related. Option B is wrong because Lambda@Edge is not used in this setup (the application runs behind an ALB, not CloudFront). Option C is wrong because CloudFront is not mentioned in the architecture—the traffic goes directly from ALB to Lambda.

Answer

The Lambda function versions are not immutable, causing a gradual rollout.

Answer

Lambda@Edge is overriding the function version at the edge locations.

Answer

Amazon CloudFront is caching the old response and has not been invalidated.