DOP-C02 Practice Exam 51 — 20 Questions

Question 1

A team uses AWS CloudFormation to manage a VPC with multiple subnets. They want to ensure that when a stack is updated, the update does not accidentally replace the VPC or any subnet. Which CloudFormation property should they set on the resources?

Accepted Answer

UpdateReplacePolicy. The 'DeletionPolicy' attribute with 'Retain' keeps the resource if the stack is deleted, but does not prevent replacement during update. To prevent replacement, use 'UpdateReplacePolicy' with 'Retain', or design the template to avoid replacement. However, the most direct way is to use 'UpdateReplacePolicy'. Option C is correct because it specifically handles update replacement.

Answer

CreationPolicy

Answer

DependsOn

Answer

DeletionPolicy

Question 2

A team is using AWS CodeDeploy to deploy an application to EC2 instances. They want to ensure that if a deployment fails, the instances are automatically rolled back to the previous version. What should they configure?

Accepted Answer

Enable automatic rollback in the deployment group settings.. Option D is correct because CodeDeploy supports automatic rollback configuration. When enabled, if a deployment fails, CodeDeploy automatically redeploys the last successful revision. Option A is wrong because a hook is a lifecycle event, not a rollback mechanism. Option B is wrong because a deployment group contains instances but does not have a rollback setting. Option C is wrong because a deployment configuration specifies traffic routing and failure thresholds, not automatic rollback.

Answer

Add a BeforeBlockTraffic hook to the AppSpec file to run a rollback script.

Answer

Set the deployment configuration to 'CodeDeployDefault.OneAtATime' for a gradual deployment.

Answer

Configure the deployment group to use the same Auto Scaling group for rollback.

Question 3

A DevOps engineer uses AWS CodeBuild to build a Java application. The build fails with an error indicating that the build environment does not have the required Java version. What is the MOST efficient way to ensure the correct Java version is installed for all future builds?

Accepted Answer

Specify a managed image in the buildspec that includes the required Java version.. Option A is correct because using an AWS CodeBuild managed image with the required Java version ensures a consistent build environment without manual installation steps. Option B is incorrect because installing Java via a command may be unreliable and increases build time. Option C is incorrect because managing a custom image requires additional maintenance. Option D is incorrect because Lambda is not used for build environments.

Answer

Use AWS Lambda to install Java on the build instance before the build starts.

Answer

Add a command in the buildspec to install the required Java version using apt-get.

Answer

Create a custom Docker image with the required Java version and reference it in the build project.

Question 4

A DevOps team uses AWS CloudFormation to deploy a web application stack. The stack includes an EC2 instance, an RDS database, and an Application Load Balancer. After a successful deployment, they notice that the database security group does not allow inbound traffic from the instance security group. The team wants to enforce that the database security group always allows traffic only from the instance security group, even if the stack is updated. Which TWO methods should the team use? (Choose TWO.)

Accepted Answer

Use Fn::GetAtt or Ref to reference the instance security group in the database security group rule.. Options B and D are correct. Option B uses a parameter to pass the instance security group ID into the database security group rule, ensuring dynamic referencing. Option D uses a Fn::GetAtt to retrieve the security group ID and reference it in the rule. Option A is incorrect because hardcoding IP addresses is not dynamic. Option C is incorrect because a security group rule outside the template is not managed by CloudFormation. Option E is incorrect because VPC flow logs do not enforce security group rules.

Answer

Hardcode the instance security group CIDR in the database security group ingress rule.

Answer

Use AWS CloudTrail to monitor and alert on security group changes.

Answer

Create a separate security group rule outside of CloudFormation using the AWS CLI.

Question 5

A DevOps engineer is designing a Git-based workflow for Infrastructure as Code using AWS CodeCommit and CodePipeline. The pipeline should deploy infrastructure changes to a test environment automatically when a pull request is merged to the 'main' branch. What is the minimal set of resources required?

Accepted Answer

CodeCommit, CodePipeline, CodeBuild, CloudFormation.. Option C is correct because CodeCommit triggers on pull request merge, CodeBuild runs the deployment, and CloudFormation executes the stack. Option A is wrong because CodeDeploy is for application deployment, not infrastructure. Option B is wrong because it lacks a build step. Option D is wrong because it lacks automation.

Answer

CodeCommit, CodePipeline, CodeDeploy.

Answer

CodeCommit, CodePipeline, CloudFormation.

Answer

CodeCommit, CloudFormation, IAM.

Question 6

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts. They notice that a stack instance in one account is in a 'FAILED' status because of a permissions issue. After fixing the permissions, what is the most efficient way to retry the stack instance operation?

Accepted Answer

Use the 'Update stack instances' operation for the failed target account.. Option B is correct because StackSets allow you to update stack instances individually; you can retry the specific failed instance without affecting others. Option A is wrong because updating the entire stack set would affect all accounts, which is inefficient. Option C is wrong because deleting and recreating the stack instance is disruptive. Option D is wrong because manual stack creation outside StackSets defeats the purpose.

Answer

Manually create the stack in the failed account using the same template.

Answer

Update the entire stack set to retry all stack instances.

Answer

Delete the stack instance from the stack set and add it again.

Question 7

A company uses AWS CodePipeline to orchestrate a multi-stage CI/CD pipeline. The build stage uses AWS CodeBuild and the deploy stage uses AWS CodeDeploy. The pipeline includes a manual approval step between build and deploy. The team wants to automatically trigger the pipeline when changes are pushed to a Git repository hosted in AWS CodeCommit. Which pipeline configuration is required for automatic triggers?

Accepted Answer

Configure the source stage to use CodeCommit as the source provider and enable 'Amazon CloudWatch Events' (EventBridge) to detect changes.. To automatically trigger the pipeline on code changes, the source stage must use CodeCommit as a source action with 'Amazon CloudWatch Events' (now Amazon EventBridge) configured to detect changes. CodePipeline integrates with EventBridge to start the pipeline on repository events. Option D is correct. Options A, B, and C are not sufficient alone.

Answer

Configure the source stage to use periodic polling of the CodeCommit repository.

Answer

Set up an SNS topic to notify the pipeline when code changes occur.

Answer

Add a Lambda function that calls StartPipelineExecution in response to CodeCommit events.

Question 8

A company uses AWS CloudFormation to manage infrastructure. After updating a stack, a resource fails to update because it requires a physical replacement. The stack update is set to 'Rollback on failure'. The engineer wants to test the effect of the change without affecting the production environment. Which approach should the engineer use?

Accepted Answer

Create a change set to review the proposed changes before executing the update.. Option D is correct because a change set allows previewing changes without applying them. Option A is incorrect because disabling rollback still applies changes. Option B is incorrect because using a different stack set requires manual synchronization. Option C is incorrect because a new stack does not compare changes against the existing stack.

Answer

Disable rollback on failure and update the stack, then manually revert if issues occur.

Answer

Create a new stack using the same template but with a different stack name.

Answer

Use a different AWS region and replicate the stack there for testing.

Question 9

An organization uses AWS Elastic Beanstalk to manage a production web application. The application uses a custom AMI that needs to be updated periodically. The team wants to automate the process of updating the AMI and deploying it to the environment with zero downtime. Which THREE steps should the team include in the automation? (Choose THREE.)

Accepted Answer

Build a new AMI using a tool like Packer and store it in EC2 Image Builder.. Options A, C, and E are correct. Option A creates a new AMI version. Option C updates the environment configuration with a rolling update to minimize downtime. Option E uses an immutable update for zero downtime. Option B is incorrect because terminating instances without a deployment strategy causes downtime. Option D is incorrect because deleting the environment is disruptive.

Answer

Delete the environment and recreate it with the new AMI.

Answer

Terminate all existing instances and allow Auto Scaling to launch new ones with the new AMI.

Question 10

A DevOps team is using AWS CloudFormation to manage infrastructure. They want to reuse the same template across multiple environments (dev, test, prod) with minor parameter variations. Which CloudFormation feature should they use to pass environment-specific values without modifying the template?

Accepted Answer

Parameters. Parameters allow passing custom values to the template at stack creation or update time. Mappings are for static lookup tables, Conditions control resource creation, and Outputs return stack values. Option B is correct.

Answer

Conditions

Answer

Outputs

Answer

Mappings

Question 11

A DevOps team is using AWS CodeBuild to run unit tests and package a Java application. They want to cache the Maven local repository (~/.m2) between builds to improve build times. Which TWO steps are necessary to enable caching in CodeBuild? (Select TWO.)

Accepted Answer

Add a 'cache' section in the buildspec file specifying the paths to cache.. Option A is correct because caching requires an S3 bucket to store the cache. Option D is correct because the buildspec must specify the paths to cache. Option B (setting environment variable) is not required. Option C (local cache mode) is a different feature for Docker layer caching. Option E (buildspec artifact) is for output artifacts, not caching.

Answer

Set the MAVEN_OPTS environment variable to use a custom repository path.

Answer

Configure the buildspec to upload the Maven repository as a build artifact.

Answer

Enable 'Local cache' mode in the CodeBuild project.

Question 12

A DevOps engineer needs to manage configuration files for multiple applications across several EC2 instances. The configuration values are sensitive (e.g., database passwords) and must be encrypted at rest and in transit. Which AWS service should be used to store and retrieve these configuration values?

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store supports secure string parameters that are encrypted with KMS. It also integrates with EC2 instances via the SSM Agent for secure retrieval. Option B is correct. Options A, C, and D either lack encryption or are not designed for configuration management.

Answer

AWS CloudFormation template parameters

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Question 13

A DevOps team manages a multi-account AWS environment using AWS Organizations. They need to enforce a mandatory tag (e.g., 'CostCenter') on all resources created across accounts. Which combination of services should be used to automatically remediate non-compliant resources?

Accepted Answer

AWS Config rules with automatic remediation using AWS Systems Manager Automation or Lambda.. Option B is correct because AWS Config can detect non-compliant resources and trigger a custom Lambda function to automatically add the missing tag. Option A is incorrect because SCPs only prevent certain actions but do not remediate existing resources. Option C is incorrect because CloudTrail logs events but does not remediate. Option D is incorrect because Tag Editor is a manual tool, not automated.

Answer

AWS Service Control Policies (SCPs) to deny creation of resources without the tag.

Answer

AWS CloudTrail to detect non-compliant resource creation and send notifications.

Answer

AWS Resource Groups & Tag Editor to manually add tags to non-compliant resources.

Question 14

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance in us-east-1. What will happen?

Accepted Answer

The action is allowed because StopInstances is explicitly allowed and not denied.. Option D is correct because the policy explicitly allows ec2:StopInstances for all resources, and there is no explicit deny for StopInstances. The Deny only applies to TerminateInstances. Option A is incorrect because StopInstances is allowed. Option B is incorrect because the Deny is not ambiguous. Option C is incorrect because there is no condition key about instance state.

Answer

The action is denied because the policy does not explicitly allow stopping an instance that is running.

Answer

The action is denied because the Deny statement is ambiguous and could apply to StopInstances.

Answer

The action is allowed only if the instance is in a stopped state.

Question 15

A team uses Terraform to manage AWS infrastructure. After a recent update, a state file shows that a security group rule was created, but the rule does not exist in AWS. Running 'terraform plan' shows no changes. What is the most likely cause?

Accepted Answer

The security group rule was added manually via the AWS console and is not managed by Terraform, causing state to be out of sync.. Option A is correct because if the rule was created outside Terraform, the state file may be out of sync, and Terraform detects no drift if the rule is not managed. Option B is wrong because 'terraform refresh' would update state, but plan shows no changes. Option C is wrong because if import is needed, plan would show changes. Option D is wrong because it would cause errors, not missing rules.

Answer

The security group rule was imported into state but not defined in configuration.

Answer

The 'terraform refresh' command was not run before the plan.

Answer

There is a conflict between multiple Terraform workspaces.

Question 16

A company is using AWS Elastic Beanstalk for a production environment. They have observed that during deployments, the environment's health status intermittently becomes 'Severe' even though the application is functioning correctly. The deployment uses rolling updates with a batch size of 50%. Which TWO configuration changes would improve deployment stability without completely redesigning the deployment process? (Select TWO.)

Accepted Answer

Increase the health check interval to allow more time for the application to stabilize.. Option A is correct because decreasing the batch size reduces the number of instances updated at once, limiting the impact of potential issues. Option D is correct because increasing the health check interval gives the application more time to stabilize before Elastic Beanstalk marks it as unhealthy. Option B (immutable updates) completely changes the deployment strategy, which may not be desired. Option C (decreasing cooldown) could worsen stability. Option E (increasing batch size) would increase instability.

Answer

Switch from rolling to immutable updates.

Answer

Increase the batch size to 75%.

Answer

Decrease the deployment cooldown time.

Question 17

A company uses AWS OpsWorks for configuration management. The operations team needs to apply a configuration change to all instances in a layer without downtime. Which approach should they use?

Accepted Answer

Use a custom Chef recipe and run it on the layer using OpsWorks 'Run Command'.. Option D is correct because OpsWorks allows running custom recipes on a layer, which can be applied without recreating instances. Option A is incorrect because cloning does not apply changes. Option B is incorrect because Chef solo is not managed by OpsWorks. Option C is incorrect because Auto Scaling does not apply configuration updates.

Answer

Use an Auto Scaling lifecycle hook to apply the change during instance launch.

Answer

Clone the layer and update the clone with the new configuration, then switch traffic.

Answer

SSH into each instance and manually apply the change.

Question 18

A company uses AWS CloudFormation StackSets to deploy a common network infrastructure across multiple AWS accounts. They need to ensure that all StackSet operations are audited and any failed stack instances are automatically retried. Which THREE configurations should be implemented? (Select THREE.)

Accepted Answer

Configure Amazon SNS notifications for StackSet events.. Option A is correct because enabling StackSet operation preferences includes retry on failure. Option C is correct because AWS CloudTrail logs all StackSet API calls for auditing. Option D is correct because SNS notifications can alert on failures. Option B is incorrect because automatic rollback on failure is an option, but the question asks for retry, not rollback. Option E is not needed for auditing/retry.

Answer

Enable automatic rollback on failure.

Answer

Use AWS Config rules to monitor StackSet compliance.

Question 19

A DevOps engineer uses AWS Secrets Manager to rotate database credentials. The rotation fails because the Lambda function used for rotation does not have network access to the database. The database is in a private VPC. How should the engineer fix this?

Accepted Answer

Configure the Lambda function to be VPC-enabled and place it in the same subnet as the database.. Option A is correct because the Lambda function must be configured to run in the same VPC and subnet as the database to access it. Option B is incorrect because Secrets Manager uses Lambda for rotation, not direct access. Option C is incorrect because VPC Peering adds complexity and is unnecessary. Option D is incorrect because NAT Gateway is for outbound internet access, not inbound.

Answer

Assign a public IP address to the database and update the security group to allow access from the Lambda function.

Answer

Set up a VPC Peering connection between the Lambda service and the VPC.

Answer

Add a NAT Gateway to the VPC to allow Lambda to reach the database.

Question 20

A CloudFormation stack creation failed. The engineer runs the describe-stack-events command and sees the output above. What is the root cause of the failure?

Accepted Answer

The EC2 instance failed to create because the AMI ID is invalid or does not exist in the region.. The event for the EC2 instance shows 'CREATE_FAILED' with a status reason indicating the AMI ID is invalid. The error says 'Expected: 'ami-0abcdef1234567890'' which suggests a typo or wrong AMI ID. Option B is correct. Option A is incorrect because the stack is in ROLLBACK_IN_PROGRESS due to the EC2 failure. Option C is incorrect because the error is about the AMI, not instance type. Option D is incorrect because the error is not about permissions.

Answer

The stack is rolling back because a network resource failed to create.

Answer

The stack lacks permissions to launch EC2 instances.

Answer

The EC2 instance failed because the instance type 't2.micro' is not supported.