DOP-C02 Practice Questions 1 — 50 Questions

Question 1

A company uses AWS CodePipeline with a multi-branch strategy. A new feature branch triggers a pipeline that runs unit tests and deploys to a test environment. The deployment step uses AWS CodeDeploy with a deployment group configured for in-place deployment to Amazon EC2 instances. The deployment fails intermittently with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The instances are healthy and pass health checks. What is the most likely cause?

Accepted Answer

A previous deployment is still in progress or frozen in the CodeDeploy deployment group.. Option D is correct because CodeDeploy enforces a per-deployment-group concurrency limit of one deployment at a time. If a previous deployment is still in progress or in a 'frozen' state (e.g., due to a failed or stopped deployment that hasn't been explicitly rolled back or cleaned up), new deployments will fail with the 'too many individual instances failed' error even when instances are healthy. The error message is misleading because it reflects CodeDeploy's inability to proceed with the new deployment, not actual instance health issues.

Answer

The pipeline has a failed execution that is blocking subsequent executions.

Answer

The CodeDeploy agent on the instances is not running, causing the deployment to fail.

Answer

The pipeline is configured with a high frequency of changes, causing throttling from CodePipeline.

Question 2

A development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?

Accepted Answer

Configure CodeBuild to cache dependencies in an Amazon S3 bucket.. Caching dependencies in an Amazon S3 bucket allows CodeBuild to reuse previously downloaded Maven/Gradle dependencies across builds, eliminating the need to re-download them each time. Since the codebase and dependencies are stable, this directly reduces the build time by avoiding repeated network transfers of large artifact repositories.

Answer

Move the build process to a local developer machine to avoid CodeBuild overhead.

Answer

Reduce the number of unit tests executed in the build phase.

Answer

Increase the compute type of the build environment to a larger instance.

Question 3

A company uses AWS CodePipeline with multiple stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The build stage runs a series of tests, and if they pass, the pipeline proceeds to deploy. Recently, a developer committed a change that passed all tests but caused a production outage. The team wants to add an approval step before the deploy stage, but they also want to ensure that only changes from specific branches can be deployed. What is the MOST secure and maintainable way to enforce this?

Accepted Answer

Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.. Option C is correct because it enforces branch-based deployment at the pipeline level, ensuring that only changes from specific branches trigger the production pipeline with the approval step. This approach is secure and maintainable as it leverages AWS CodePipeline's native ability to trigger on branch events, avoiding custom logic or manual verification. By isolating production deployments to a dedicated pipeline, the team reduces the risk of unauthorized or untested code reaching production.

Answer

Use a Lambda function in the pipeline to check the branch name and fail if not allowed.

Answer

Add a manual approval step in the pipeline and rely on the approver to verify the branch.

Answer

Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.

Question 4

A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled JARs) to the repository, causing the repository size to grow rapidly and slowing down clone operations. The team wants to enforce a policy to reject pushes that contain files larger than 50 MB. Which approach should be used?

Accepted Answer

Configure a CodeCommit trigger that invokes an AWS Lambda function to validate file sizes and reject the push.. Option A is correct because AWS CodeCommit supports custom triggers that invoke AWS Lambda functions on repository events, including pushes. By configuring a trigger for the 'push' event, a Lambda function can inspect each file in the push payload, check its size against the 50 MB threshold, and programmatically reject the push by returning an error response. This approach enforces the policy at the repository level without requiring client-side changes.

Answer

Set up an Amazon CloudWatch Events rule to monitor repository size and alert when it exceeds a threshold.

Answer

Create an IAM policy that denies the `codecommit:GitPush` action if the file size exceeds 50 MB.

Answer

Use a pre-receive hook in the repository to reject large files by generating an S3 pre-signed URL.

Question 5

An organization uses AWS CodePipeline to orchestrate deployments to multiple environments (dev, test, prod). Each environment uses a different AWS account. The pipeline uses cross-account actions with IAM roles. Recently, the pipeline failed at the deploy stage for the prod account with the error 'Access Denied' when assuming the cross-account role. The role ARN is correct and the trust policy allows the pipeline's service role. What is the MOST likely cause?

Accepted Answer

The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.. The pipeline's service role must have an `sts:AssumeRole` permission on the cross-account role to perform the role assumption. Even if the trust policy on the cross-account role allows the pipeline's service role, the pipeline's service role itself needs an IAM policy granting `sts:AssumeRole` for the cross-account role ARN. Without this permission, the `AssumeRole` API call fails with 'Access Denied', which is the exact error described.

Answer

The EC2 instances in the prod account do not have an appropriate instance profile.

Answer

The cross-account role's permissions boundary denies the deploy action.

Answer

The pipeline's service role does not have permission to perform the deploy action in the prod account.

Question 6

A company uses AWS Key Management Service (KMS) to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific attribute in their SAML assertion can decrypt the data. Which KMS key policy should be used?

Accepted Answer

Modify the KMS key policy to include a condition that allows kms:Decrypt only if the SAML assertion contains the specific attribute.. Option B is correct because KMS key policies can use the `kms:ViaService` or `kms:CallerPrincipal` conditions, but more importantly, they can reference SAML-based attributes using the `aws:PrincipalTag` or `saml:sub` conditions. By adding a condition in the KMS key policy that checks for a specific SAML assertion attribute (e.g., `saml:sub` or a custom SAML attribute mapped to an IAM role session tag), only users whose SAML assertion includes that attribute will be allowed to call `kms:Decrypt`. This directly enforces the security team's requirement at the key level, independent of S3 bucket policies or IAM policies.

Answer

Create an S3 bucket policy that denies kms:Decrypt unless the request includes a specific tag.

Answer

Attach a resource-based policy to the S3 bucket that allows decryption only for users with the specific attribute.

Answer

Use an IAM policy that grants kms:Decrypt only if the user has the specific attribute.

Question 7

A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own code repository and build artifacts. The team wants to use AWS CodePipeline with multiple parallel actions to build and test all microservices simultaneously. They also want to ensure that if one microservice's build fails, the pipeline does not block other microservices. Which THREE steps should the team take? (Choose THREE.)

Accepted Answer

Use a parallel action group with separate build actions for each microservice.. Option A is correct because using a parallel action group with separate build actions for each microservice allows all microservices to be built simultaneously within a single pipeline. This design ensures that if one microservice's build fails, the other parallel actions continue unaffected, as CodePipeline treats each action in a parallel group independently.

Answer

Configure the pipeline to block subsequent stages if any build action fails.

Answer

Configure a single build action that sequentially builds all microservices.

Question 8

A company uses AWS OpsWorks to manage a set of EC2 instances. They need to ensure that a custom recipe runs on all instances during the 'Configure' lifecycle event. What is the correct way to achieve this?

Accepted Answer

Upload the recipe to a custom cookbook repository and assign it to the 'Configure' lifecycle event in the stack settings.. In AWS OpsWorks, lifecycle events (such as Configure) are tied to layers, not individual instances. To run a custom recipe on all instances during the Configure event, you must upload the recipe to a custom cookbook repository (e.g., S3 or Git) and then assign that recipe to the Configure lifecycle event in the stack's layer settings. This ensures OpsWorks Chef runs the recipe on every instance in that layer whenever the Configure event fires (e.g., after scaling or instance state changes).

Answer

Modify the stack's CloudFormation template to include the recipe.

Answer

Add the recipe commands to the instance's user data script.

Answer

Use AWS CodeDeploy to trigger the recipe during the Configure event.

Question 9

A DevOps team is designing a CI/CD pipeline using AWS CodeBuild and CodePipeline. They want to use infrastructure as code to define the build environment. Which TWO options are valid approaches to define the build environment in CodeBuild?

Accepted Answer

Define the build environment using a buildspec.yml file that includes runtime versions and environment variables.. Option B is correct because the buildspec.yml file is the primary mechanism in AWS CodeBuild to define the build environment, including runtime versions (e.g., runtime: nodejs:18) and environment variables. This file is placed at the root of the source code and instructs CodeBuild on how to execute the build phases, making it a valid infrastructure-as-code approach for environment configuration.

Answer

Configure CodeDeploy to set up the build environment before the build starts.

Answer

Use an Elastic Beanstalk environment to run the build.

Answer

Use an AWS CloudFormation template to specify the build environment configuration.

Question 10

A development team wants to ensure that their application can continue serving traffic even if an entire AWS Availability Zone (AZ) becomes unavailable. The application runs on Amazon EC2 instances in an Auto Scaling group and uses an Application Load Balancer (ALB). Which configuration should the team implement to meet this requirement?

Accepted Answer

Configure the Auto Scaling group to launch EC2 instances across multiple AZs, and ensure the ALB is enabled for cross-zone load balancing.. Option A is correct because deploying EC2 instances across multiple Availability Zones (AZs) ensures that if one AZ fails, the remaining AZs continue to serve traffic. Enabling cross-zone load balancing on the ALB distributes incoming requests evenly across all healthy instances in all AZs, preventing traffic from being sent only to instances in the same AZ as the client. This architecture meets the requirement for high availability and fault tolerance at the AZ level.

Answer

Use a launch template with multiple instance types to ensure diversity across the fleet.

Answer

Use a single AZ but configure EC2 Auto Scaling to replace unhealthy instances automatically.

Answer

Launch all EC2 instances in the same AZ to minimize latency, and configure the Auto Scaling group to maintain a minimum of two instances.

Question 11

A DevOps team is designing a monitoring strategy for a microservices application deployed on Amazon EKS. The application emits custom metrics, and the team needs to collect them with minimal latency and at high resolution. The team also needs to retain logs for 90 days for compliance. Which THREE steps should the team take to meet these requirements? (Choose three.)

Accepted Answer

Use Fluent Bit daemonset to send application logs to CloudWatch Logs.. Option A is correct because Fluent Bit is a lightweight, high-performance log processor that can be deployed as a DaemonSet on Amazon EKS to collect application logs with minimal latency. It sends logs directly to CloudWatch Logs, which supports a retention policy of up to 10 years, easily meeting the 90-day compliance requirement. Fluent Bit's low resource footprint and efficient data pipeline ensure high-resolution log collection without impacting application performance.

Answer

Stream logs to Amazon Kinesis Data Firehose for transformation before landing in CloudWatch Logs.

Answer

Enable CloudWatch Container Insights for the EKS cluster.

Question 12

A DevOps engineer is troubleshooting an application running on an EC2 instance. The application needs to access an Amazon RDS database using IAM database authentication. The EC2 instance is associated with an IAM role 'EC2-AppRole', and the RDS instance has a resource-based policy that allows 'DatabaseAccessRole' to connect. The engineer sees the error in the exhibit. What is the most likely cause?

Accepted Answer

The trust policy of the IAM role 'DatabaseAccessRole' does not allow the EC2 instance role 'EC2-AppRole' to assume it.. The error indicates that the EC2 instance's IAM role 'EC2-AppRole' cannot authenticate to the RDS instance. IAM database authentication requires the EC2 instance to assume a database authentication token, which is generated by calling the RDS API with the 'EC2-AppRole' credentials. However, the RDS instance's resource-based policy only allows 'DatabaseAccessRole' to connect. For 'EC2-AppRole' to successfully authenticate, it must first assume 'DatabaseAccessRole' via a trust policy that permits the EC2 instance role to assume it. Without this trust relationship, the authentication token request fails, causing the error.

Answer

The RDS instance does not have a resource-based policy that grants access to 'DatabaseAccessRole'.

Answer

The security group for the EC2 instance does not allow outbound traffic to the RDS instance.

Answer

The EC2 instance does not have the correct IAM instance profile attached.

Question 13

A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?

Accepted Answer

Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.. Option B is correct because attaching an IAM role to the EC2 instance and using the instance profile allows the application to obtain temporary credentials from the EC2 instance metadata service (IMDS). These credentials are automatically rotated by AWS before they expire, and they are never stored on disk—they are fetched on-demand from the metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). This satisfies both the requirement for automatic rotation and the prohibition against disk storage.

Answer

Store the credentials in AWS Secrets Manager and retrieve them at application startup.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and retrieve them using the EC2 instance's IAM role.

Answer

Generate an access key and secret key for an IAM user and store them in a configuration file on the EC2 instance.

Question 14

A company is experiencing an ongoing security incident where an unauthorized user gained access to an AWS access key and is making API calls. The security team needs to immediately stop the unauthorized access and preserve evidence for investigation. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Enable CloudTrail logging to capture API calls for forensic analysis.. Option B is correct because enabling CloudTrail logging captures detailed API call records, including source IP, user agent, and request parameters, which are essential for forensic analysis and understanding the scope of the incident. CloudTrail logs provide immutable evidence that can be stored in S3 with versioning and MFA delete, ensuring the integrity of the investigation data.

Answer

Rotate the access key by creating a new key and updating the application.

Answer

Change the IAM policy attached to the user to deny all actions.

Answer

Contact AWS Support to have the key disabled.

Question 15

A company uses AWS Organizations to manage multiple accounts. The Security team wants to prevent member accounts from disabling AWS CloudTrail or deleting CloudTrail log files. Which TWO actions should the Security team take in the organization's management account? (Choose TWO.)

Accepted Answer

Create an SCP to deny s3:DeleteObject on the CloudTrail log bucket.. Option C is correct because an SCP that denies s3:DeleteObject on the CloudTrail log bucket prevents member accounts from deleting log files stored in S3, even if they have full administrative permissions. This is a critical control to ensure log integrity and compliance with security policies.

Answer

Create an SCP to deny cloudtrail:UpdateTrail.

Answer

Create an IAM policy in each member account to deny cloudtrail:StopLogging.

Answer

Enable AWS CloudTrail from the management account with organization trail.

Question 16

A DevOps engineer needs to ensure that all API calls made to AWS are recorded for auditing purposes. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This provides a complete audit trail of user activity and API usage, which is essential for auditing, security analysis, and compliance requirements.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs

Question 17

A company has a requirement to rotate database credentials every 30 days for an Amazon RDS for MySQL instance. The credentials are currently stored in AWS Secrets Manager. The DevOps engineer needs to implement automatic rotation without modifying the application code. Which solution should be used?

Accepted Answer

Configure Secrets Manager to automatically rotate the secret every 30 days using a Lambda rotation function, and have the application retrieve the secret using the Secrets Manager API.. Option D is correct because AWS Secrets Manager natively supports automatic rotation of secrets using a Lambda function that updates both the secret in Secrets Manager and the password in the RDS MySQL instance. This solution meets the 30-day rotation requirement without modifying application code, as the application retrieves the current secret via the Secrets Manager API, which automatically handles versioning and caching.

Answer

Create a scheduled job that runs every 30 days to update the secret in Secrets Manager with a new password.

Answer

Store the credentials in AWS Systems Manager Parameter Store and configure automatic rotation using a Lambda function.

Answer

Use the AWS RDS automatic password rotation feature, which automatically updates the password every 30 days.

Question 18

A company uses AWS CloudFormation to deploy a multi-tier web application. The template includes a nested stack for the database layer. When updating the stack, the database stack fails with a 'CREATE_FAILED' status, but the parent stack continues updating other resources. What is the most likely cause and best practice to prevent this?

Accepted Answer

The parent stack's update policy is set to 'CONTINUE' by default. To prevent this, set 'OnFailure' to 'ROLLBACK' in the stack update options.. Option A is correct because, by default, when a CloudFormation stack update encounters a failure in a nested stack, the parent stack's update policy is set to 'CONTINUE', meaning it will proceed with updating other resources despite the failure. To prevent this, you should set the 'OnFailure' parameter to 'ROLLBACK' in the stack update options, which instructs CloudFormation to roll back the entire parent stack if any resource (including nested stacks) fails to update, ensuring consistency across the deployment.

Answer

The parent stack was created without the '--capabilities' parameter, so it cannot roll back.

Answer

The nested stack failure automatically triggers a rollback of the parent stack, but the rollback also failed.

Answer

The parent stack is configured with 'OnFailure' set to 'DO_NOTHING'. Change it to 'DELETE'.

Question 19

A DevOps engineer manages infrastructure using Terraform. The team needs to store secrets such as database passwords in a secure manner and reference them in Terraform configurations. They have configured AWS Secrets Manager. What is the recommended approach to reference secrets in Terraform without exposing them in state files?

Accepted Answer

Use the 'data.aws_secretsmanager_secret_version' data source and mark the attribute as 'sensitive = true' in the output.. Option D is correct because using the `data.aws_secretsmanager_secret_version` data source retrieves the secret value at plan time without storing it in the Terraform state file. Marking the attribute as `sensitive = true` in the output prevents the value from being displayed in the CLI output, but the key protection is that the secret value itself is never written to the state file when using this data source — Terraform only stores the data source's ID and metadata, not the actual secret payload.

Answer

Store the secret ARN in a Terraform variable and use 'var.secret_arn' in the resource.

Answer

Store the secret in AWS Systems Manager Parameter Store and reference it using 'data.aws_ssm_parameter'.

Answer

Pass the secret as an environment variable to Terraform and reference it with 'var.secret_value'.

Question 20

A DevOps team uses AWS CodePipeline to automate deployments. The pipeline has a Deploy stage that uses AWS CloudFormation to create or update a stack. Recently, a stack update failed because the template referenced an AMI that was deprecated. The team wants to automatically roll back the stack to the last known good state if a deployment fails. What should they do?

Accepted Answer

Configure the CloudFormation deployment action in CodePipeline with 'ActionMode' set to 'CREATE_UPDATE' and check the 'Rollback on failure' option.. Option A is correct because the CloudFormation deployment action in CodePipeline supports a 'Rollback on failure' option when 'ActionMode' is set to 'CREATE_UPDATE'. When enabled, if the stack update fails, CloudFormation automatically rolls back the stack to the last known good state (the previously deployed stack). This directly addresses the team's requirement to revert to a stable state after a failed deployment due to a deprecated AMI.

Answer

Use the CodePipeline console to enable 'Automatic rollback' for the Deploy stage.

Answer

Set the stack's 'DisableRollback' parameter to 'true' in the template.

Answer

Add a stack policy to the CloudFormation stack that denies updates to the AMI parameter.