DOP-C02 Practice Test 50 — 15 Questions

Question 1

A team creates the CloudFormation template shown in the exhibit. What is a potential security concern with this configuration?

Accepted Answer

The bucket policy allows public read access to all objects.. Option C is correct because the bucket policy allows anonymous access (Principal: "*") to get objects, which can lead to unauthorized access if the bucket contains sensitive data. Option A is wrong because versioning is enabled. Option B is wrong because the bucket name is unique. Option D is wrong because there is no encryption specified, but the primary concern is the public access.

Answer

The bucket name is not unique.

Answer

The bucket does not have server-side encryption enabled.

Answer

The bucket is not versioned.

Question 2

A DevOps engineer is troubleshooting a CloudFormation stack that is in UPDATE_ROLLBACK_FAILED state. The stack attempted to update an Auto Scaling group but failed due to insufficient capacity in the Availability Zone. What is the recommended next step?

Accepted Answer

Use the ContinueUpdateRollback operation to skip the resources that failed. When a stack is in UPDATE_ROLLBACK_FAILED, you can continue the rollback by using the 'ContinueUpdateRollback' API or by deleting the stack. Option D is correct. Option A is incorrect because continuing the rollback will not fix the underlying capacity issue. Option B is incorrect because you cannot update the stack while it is in a failed rollback state. Option C is incorrect because you should not manually fix the resource while the stack is in this state.

Answer

Execute a new stack update with the same template

Answer

Manually increase the Auto Scaling group capacity in the affected AZ

Answer

Delete the Auto Scaling group and recreate it

Question 3

A company runs a mission-critical database on Amazon RDS for MySQL. They need to ensure that if the primary DB instance fails, the database remains available with minimal downtime. Which TWO configurations should they implement? (Choose TWO.)

Accepted Answer

Enable automated backups with point-in-time recovery.. Options A and D are correct. Multi-AZ provides automatic failover to a standby in a different AZ. Automated backups with point-in-time recovery allow restoring to a specific time. Option B is incorrect because read replicas do not provide automatic failover. Option C is incorrect because cross-region replication is for regional DR, not immediate failover. Option E is incorrect because deletion protection prevents accidental deletion but does not help with failure.

Answer

Create a read replica in the same region.

Answer

Enable deletion protection on the DB instance.

Answer

Configure cross-region replication.

Question 4

A DevOps team uses Elastic Beanstalk to deploy a web application. They want to configure environment variables without modifying the application code. Where should they define these variables?

Accepted Answer

As environment properties in the Elastic Beanstalk environment. Elastic Beanstalk allows environment properties to be set in the console, CLI, or via .ebextensions. These are exposed as environment variables to the application. Option C is correct. Option A is incorrect because the application code is the wrong place. Option B is incorrect because User Data is for EC2 initialization, not for application environment variables. Option D is incorrect because Instance Metadata does not expose custom environment variables automatically.

Answer

In the EC2 User Data script

Answer

In the instance metadata

Answer

In the application code

Question 5

An organization uses AWS Systems Manager to manage a fleet of EC2 instances. They want to ensure that all instances have a specific software package installed. Which approach should they take?

Accepted Answer

Create a State Manager association with a custom document that installs the package.. Option A is correct because State Manager associations can enforce desired configurations, such as installing software packages, on a schedule or on demand. Option B is wrong because Run Command is for one-time ad-hoc execution, not continuous enforcement. Option C is wrong because Patch Manager focuses on OS patches, not arbitrary software. Option D is wrong because OpsCenter is for operational issues, not configuration management.

Answer

Use OpsCenter to create an OpsItem for each instance.

Answer

Use Run Command to execute the installation on all instances.

Answer

Create a Patch Baseline that includes the package.

Question 6

Which TWO are correct about using AWS CloudFormation to manage infrastructure across multiple AWS accounts? (Select TWO.)

Accepted Answer

You can use AWS Organizations to centrally manage accounts and use StackSets with trusted access.. Option C is correct because StackSets allow deploying stacks across accounts. Option D is correct because you can use AWS Organizations to manage accounts and StackSets can be integrated. Option A is wrong because StackSets do not support nested stacks across accounts natively. Option B is wrong because CloudFormation does not automatically create accounts. Option E is wrong because CloudFormation templates cannot reference resources across accounts without explicit parameters.

Answer

CloudFormation can automatically create new AWS accounts using a template.

Answer

Nested stacks can be used to deploy resources in different accounts from a single template.

Answer

You can use cross-stack references to share resources between accounts.

Question 7

A DevOps team is using AWS CloudFormation to manage infrastructure. They need to update a stack that includes an EC2 instance with a security group. The update requires changing a security group rule. Which method should the team use to perform this update with minimal disruption?

Accepted Answer

Update the stack directly by submitting the updated template to CloudFormation.. Option B is correct because CloudFormation stack updates can be performed directly using the AWS Management Console, CLI, or SDKs, and the service automatically handles the update by identifying changes from the updated template. Option A is wrong because deleting and recreating the stack causes downtime. Option C is wrong because CloudFormation changesets allow previewing changes but require an explicit execution step, which is not 'directly update.' Option D is wrong because using the EC2 console bypasses CloudFormation and leads to drift.

Answer

Manually modify the security group in the EC2 console and then import the resource into CloudFormation.

Answer

Delete the stack and create a new stack with the updated template.

Answer

Use a change set to review the changes and then execute it.

Question 8

Which THREE are valid AWS Systems Manager capabilities for configuration management? (Select THREE.)

Accepted Answer

Run Command. Option A is correct because State Manager is used for configuration management. Option C is correct because Patch Manager manages patching. Option E is correct because Run Command executes commands remotely. Option B is wrong because OpsCenter is for operational issues. Option D is wrong because Parameter Store is for secrets management, not configuration management per se.

Answer

OpsCenter

Answer

Parameter Store

Question 9

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template needs to reference the secret value dynamically during stack creation. How should the template retrieve the secret?

Accepted Answer

Use a dynamic reference with '{{resolve:secretsmanager:secret-id:secret-string}}' in the template.. CloudFormation dynamic references using 'resolve:secretsmanager' allow the template to retrieve secret values at stack creation time. Option D is correct. Options A, B, and C do not retrieve the secret value dynamically.

Answer

Use a CloudFormation mapping to store the secret ARN.

Answer

Hardcode the password in the template as a literal string.

Answer

Use a CloudFormation parameter with a default value referencing the secret ARN.

Question 10

A developer is writing an AWS CloudFormation template to create an Amazon S3 bucket. The bucket name must be unique across all AWS accounts. Which property should the developer use to ensure the name is unique?

Accepted Answer

Omit the BucketName property so CloudFormation generates a unique name.. Option B is correct because AWS::S3::Bucket's BucketName must be globally unique; if not specified, CloudFormation generates a unique name. Using AWS::NoValue in a condition can help but the intrinsic function Fn::Sub with !Ref AWS::StackName or AWS::AccountId is a common pattern. However, the question asks which property ensures uniqueness. The correct answer is that the BucketName property, if omitted, results in an auto-generated unique name. Option A is wrong because the bucket name is not automatically generated to be unique if you specify it; you must ensure uniqueness yourself. Option B is correct because by not specifying BucketName, CloudFormation generates a unique name. Option C is wrong because DeletionPolicy does not affect naming. Option D is wrong because the UpdateReplacePolicy does not affect naming.

Answer

Use the DeletionPolicy attribute to retain the bucket.

Answer

Set the BucketName property to a unique value using a parameter.

Answer

Use the UpdateReplacePolicy attribute to control replacement.

Question 11

A company uses AWS Systems Manager to manage a fleet of EC2 instances. They need to run a custom script on all instances every time the instance is started. The script is stored in an S3 bucket. Which approach ensures the script runs automatically on every instance start with minimal administrative overhead?

Accepted Answer

Create a State Manager association with the AWS-RunDocument document, targeting the instances, and set the schedule to 'On Instance Start'.. Associating a State Manager association with the AWS-RunDocument document and targeting the instances ensures the script runs on every instance start. Option A is correct because State Manager can be configured to run on instance start. Options B, C, and D are either manual or not triggered automatically on start.

Answer

Place the script in /etc/rc.local on a custom AMI.

Answer

Use AWS Config rules to invoke a Lambda function that runs the script.

Answer

Create an EC2 launch template that includes the script in user data.

Question 12

A DevOps engineer is troubleshooting an AWS CloudFormation stack that failed to create. The error message indicates that a resource 'AWS::Lambda::Function' timed out while being created. The Lambda function code is packaged as a ZIP file in Amazon S3. What is the most likely cause?

Accepted Answer

The Lambda deployment package is very large, causing the S3 download to exceed the resource creation timeout.. Option C is correct because Lambda function creation can time out if the deployment package is very large and the S3 download takes too long. Option A is wrong because execution role permissions cause access denied errors, not timeouts. Option B is wrong because the Lambda function's timeout setting is for execution, not creation. Option D is wrong because CloudFormation service role permissions affect the stack operations but not the resource creation timeout specifically.

Answer

The Lambda function has a very short timeout (e.g., 3 seconds) configured in the function properties.

Answer

The Lambda function's execution role does not have permission to download the ZIP file from S3.

Answer

The CloudFormation service role does not have permissions to create Lambda functions.

Question 13

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture on AWS. They want to use AWS CodeDeploy to deploy applications to an Auto Scaling group. The pipeline must ensure that only a small percentage of instances are updated at a time, and if health checks fail, the deployment is automatically rolled back. Which deployment configuration should be used?

Accepted Answer

In-place deployment with 'CodeDeployDefault.OneAtATime' configuration and automatic rollback enabled.. The 'CodeDeployDefault.OneAtATime' configuration deploys to one instance at a time, minimizing impact. Combined with automatic rollback on health check failure, this meets the requirement. Option C is correct. Options A, B, and D either deploy too many instances at once or do not provide rollback.

Answer

Blue/green deployment with a fixed number of instances.

Answer

In-place deployment with 'CodeDeployDefault.AllAtOnce' configuration.

Answer

In-place deployment with 'CodeDeployDefault.HalfAtATime' configuration.

Question 14

A company uses AWS OpsWorks for configuration management. They want to automate the installation of a custom agent on new EC2 instances. Which OpsWorks feature should they use?

Accepted Answer

Use a custom Chef recipe in the layer's configuration to run the installation.. Option B is correct because OpsWorks uses Chef recipes or Ansible playbooks to define configuration. Custom recipes can be used to install agents. Option A is wrong because Cookbook repositories store cookbooks but don't automatically run them on new instances. Option C is wrong because custom JSON is for input data, not execution. Option D is wrong because Layers define the configuration but recipes are the actual executable code.

Answer

Define the agent installation in the layer's built-in configuration.

Answer

Use custom JSON to pass the installation commands.

Answer

Create a cookbook repository and upload the agent installation script.

Question 15

A company uses AWS OpsWorks for configuration management. They need to automate the installation of a custom package on all instances in a layer. Which OpsWorks feature should they use?

Accepted Answer

Custom Chef recipes associated with lifecycle events. Custom recipes in OpsWorks allow running Chef recipes on instance lifecycle events. Option B is correct. Lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) trigger the recipes. Options A, C, and D are not OpsWorks features.

Answer

AWS CodeDeploy AppSpec file

Answer

AWS CloudFormation custom resources

Answer

AWS Systems Manager Run Command

DOP-C02 Practice Test 50 — 15 Questions

Exhibit

DOP-C02 Practice Test 50 — 15 Questions

Exhibit