DOP-C02 Practice Exam 52 — 20 Questions

Question 1

A company runs a critical application on Amazon ECS with Fargate launch type. During an incident, the DevOps engineer notices that tasks are failing with 'CannotPullContainerError: API error (500)'. Which TWO steps should the engineer take to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that the ECR repository policy allows the task execution role to pull images.. Options C and E are correct. When a Fargate task fails with 'CannotPullContainerError: API error (500)', it typically indicates an issue with pulling the container image from Amazon ECR. The task execution IAM role (E) must have the necessary permissions (ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, ecr:BatchCheckLayerAvailability) to pull images from ECR. Additionally, if the image resides in a private ECR repository, the repository policy (C) must allow the task execution role to perform those actions. Option A is wrong because Fargate does not support attaching EBS volumes; it stores image layers ephemerally. Option B is incorrect because the ECS service role is used for load balancer integration, not for pulling images. Option D is incorrect because increasing task memory does not fix image pull errors; memory affects running tasks, not the pull process.

Answer

Attach an EBS volume to the Fargate task for caching.

Answer

Check that the ECS service role has the required permissions.

Answer

Increase the task memory to accommodate the image pull.

Question 2

A company runs a stateful application on EC2 instances in an Auto Scaling group. The application stores state on local instance storage. During a scaling event, users lose session data. How can the company make the application resilient without modifying the application code?

Accepted Answer

Use Elastic Block Store (EBS) volumes instead of instance store.. Using EBS volumes instead of instance store provides persistent storage that survives instance termination. By attaching an EBS volume to the EC2 instances and configuring the application to store state on that volume (e.g., through the same file path), the data is preserved even when instances are scaled in. This does not require modifying application code, only infrastructure configuration. Option A is incorrect because reducing the cooldown period does not prevent data loss; it only affects scaling speed. Option B is incorrect because sticky sessions route users to the same instance but do not preserve session data when that instance is terminated during scale-in. Option C is incorrect because larger instances reduce the frequency of scaling events but data loss still occurs when instances are terminated.

Answer

Reduce the Auto Scaling group cooldown period.

Answer

Enable sticky sessions on the Application Load Balancer.

Answer

Increase the instance size to reduce scaling events.

Question 3

A DevOps team uses Ansible for configuration management of EC2 instances. They want to ensure that the Ansible control node can connect to managed nodes securely without storing SSH keys in plaintext. Which AWS service should they integrate with Ansible to securely manage SSH keys?

Accepted Answer

AWS Secrets Manager to store the SSH private keys and retrieve them dynamically.. AWS Secrets Manager is designed to store, rotate, and retrieve secrets such as SSH private keys programmatically, and Ansible can integrate with it via lookup plugins or dynamic inventory to fetch keys at runtime without persisting them in plaintext on the control node. This satisfies the requirement of secure, dynamic key management with rotation support.

Answer

AWS KMS to encrypt the SSH keys at rest.

Answer

AWS IAM roles to grant Ansible access to the instances.

Answer

AWS Systems Manager Parameter Store to store the keys.

Question 4

A company's security policy requires that all data in transit between on-premises and AWS is encrypted. Which AWS service provides a dedicated network connection with encryption?

Accepted Answer

AWS Direct Connect + VPN. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, and when combined with a VPN over that connection, it adds IPsec encryption. This satisfies the requirement for a dedicated connection with encryption. Direct Connect alone is not encrypted, so the VPN overlay is necessary.

Answer

AWS Transit Gateway

Answer

Amazon VPC peering

Answer

AWS Site-to-Site VPN over the internet

Question 5

A company uses AWS Elastic Beanstalk to deploy web applications. The DevOps team wants to implement a blue/green deployment strategy to minimize downtime. Which Elastic Beanstalk feature should be used?

Accepted Answer

Environment URL swap. Elastic Beanstalk's environment URL swap feature enables blue/green deployment by routing traffic from the current (blue) environment to a new (green) environment via a simple DNS swap. This swap is instantaneous at the DNS level, resulting in zero downtime for users, as the green environment is fully tested before the swap occurs.

Answer

Rolling update

Answer

Canary deployment

Answer

Immutable update

Question 6

A DevOps engineer receives the error shown in the exhibit when attempting to update an existing CloudFormation stack that deploys a VPC with subnets. The stack was created successfully earlier using the same template. What is the most likely cause of this error?

Accepted Answer

The IAM role used for the stack update lacks the 'ec2:DescribeSubnets' permission.. When updating a CloudFormation stack that deploys a VPC with subnets, the update operation must be able to read the current state of the subnet resources to determine if changes are needed. The IAM role used for the stack update must have the 'ec2:DescribeSubnets' permission to query the existing subnet configuration. Without this permission, CloudFormation cannot verify the subnet's current properties, leading to the error shown in the exhibit.

Answer

The subnet ID in the template is already used by another stack in the same account.

Answer

The subnet specified in the template does not exist in the selected AWS region.

Answer

The CloudFormation template has a syntax error in the subnet definition.

Question 7

A company uses AWS Elastic Beanstalk to deploy a web application. They want to ensure that configuration changes (e.g., environment variables, instance type) are version-controlled and can be rolled back. Which strategy should they use?

Accepted Answer

Store configuration in a configuration file (e.g., .ebextensions) included with the application source code.. Storing configuration in .ebextensions files (YAML/JSON) within the application source bundle allows version control of environment settings (e.g., environment variables, instance type) alongside the code. When the application is deployed or updated, Elastic Beanstalk applies these configuration files automatically, enabling consistent rollback by redeploying a previous source bundle version. This approach integrates configuration management with the application lifecycle, ensuring that changes are tracked and reversible.

Answer

Use AWS CloudFormation to manage the Beanstalk environment outside of Beanstalk.

Answer

Use Elastic Beanstalk saved configurations to store environment settings.

Answer

Manually change environment configuration using the Elastic Beanstalk console when needed.

Question 8

A DevOps engineer uses AWS Secrets Manager to rotate database credentials. The rotation fails because the Lambda function used for rotation does not have network access to the database. The database is in a private VPC. How should the engineer fix this?

Accepted Answer

Configure the Lambda function to be VPC-enabled and place it in the same subnet as the database.. The Lambda rotation function must reach the private database, so it needs to run inside the VPC with network access to the database's subnet and security group. Configuring the Lambda function to be VPC-enabled and placing it in the same subnet (or a subnet with routing to the database) allows it to resolve and connect to the private RDS/DB endpoint, fixing the rotation failure.

Answer

Assign a public IP address to the database and update the security group to allow access from the Lambda function.

Answer

Set up a VPC Peering connection between the Lambda service and the VPC.

Answer

Add a NAT Gateway to the VPC to allow Lambda to reach the database.

Question 9

A company is building a global application that requires low-latency access to static content across multiple AWS Regions. The content changes infrequently. Which solution is MOST resilient and cost-effective?

Accepted Answer

Use Amazon CloudFront with an S3 bucket as origin. Amazon CloudFront with an S3 bucket as origin provides low-latency global content delivery by caching static content at edge locations worldwide. It is highly resilient because CloudFront automatically routes around failures, and cost-effective since it reduces load on origin and data transfer costs.

Answer

Use Amazon S3 Transfer Acceleration

Answer

Set up a VPN to a single Region

Answer

Deploy EC2 instances in each Region with a global load balancer

Question 10

Which TWO actions should a DevOps engineer take to implement a GitFlow branching strategy for infrastructure as code using AWS CodeCommit and CodePipeline? (Choose two.)

Accepted Answer

Use CodeBuild to run unit tests on feature branches before merging.. Options B and D are correct. Option B: CodeBuild can run unit tests on feature branches before merging, ensuring code quality. Option D: Separate pipelines for develop and master branches allow different deployment behaviors (e.g., non-prod vs. prod). Option A is wrong because disabling automatic triggers on the master branch would prevent automated deployments when changes are merged, which is contrary to GitFlow where master deployments are desired. Option C is wrong because a single pipeline for all branches reduces flexibility and can cause unintended deployments. Option E is wrong because CodePipeline does not natively support pull request triggers; use CodeBuild or other services for that.

Answer

Disable automatic triggers on the master branch to prevent accidental deployments.

Answer

Use a single pipeline that handles all branches.

Answer

Configure CodePipeline to trigger on pull request creation.

Question 11

A company is designing a highly available architecture for a stateless web application using AWS services. Which TWO steps should they take to achieve high availability?

Accepted Answer

Deploy EC2 instances in multiple Availability Zones. Option B is correct because deploying EC2 instances across multiple Availability Zones ensures the application survives an AZ-level failure, which is a fundamental requirement for high availability in AWS. Option E is correct because an Application Load Balancer distributes incoming traffic across healthy targets in multiple AZs, performs health checks, and automatically routes around failed instances, directly supporting high availability for a stateless web tier. Option A is incorrect because storing session state on an EBS volume tied to a single instance creates a single point of failure and is unnecessary for a stateless application. Option C is incorrect because a single NAT instance is itself a single point of failure and cannot provide high availability. Option D is incorrect because choosing a specific instance type like M5 improves performance but does nothing to increase availability.

Answer

Store session state in an EBS volume attached to each instance

Answer

Use a single NAT instance in a public subnet

Answer

Use only M5 instance types for better performance

Question 12

A company uses Amazon CloudWatch Logs to store application logs from EC2 instances. The security team requires that logs be retained for 5 years for compliance. Which action should be taken to meet this requirement cost-effectively?

Accepted Answer

Export the logs to Amazon S3 and use S3 Glacier Deep Archive for long-term storage.. Exporting logs to Amazon S3 and using lifecycle policies to transition them to S3 Glacier Deep Archive is the most cost-effective way to retain logs for 5 years. S3 provides low-cost storage, and Glacier Deep Archive offers the lowest storage cost for long-term archival, making it ideal for compliance requirements. In contrast, retaining logs in CloudWatch Logs beyond a short period is more expensive due to higher storage costs. Option B is incorrect because setting a 5-year retention policy in CloudWatch Logs incurs significant costs compared to exporting to S3. Option C is incorrect because disabling retention causes logs to expire after 90 days, not indefinite. Option D is incorrect because AWS CloudTrail captures API activity, not application logs.

Answer

Set a log retention policy of 5 years on the CloudWatch Logs log groups.

Answer

Disable log retention and let CloudWatch Logs keep the logs indefinitely.

Answer

Use AWS CloudTrail to store the logs for 5 years.

Question 13

A developer needs to allow an EC2 instance to read from an S3 bucket. Which is the most secure way to grant this access?

Accepted Answer

Create an IAM role with an S3 read policy and attach it to the EC2 instance profile.. The most secure way to grant an EC2 instance access to an S3 bucket is to use an IAM role with an S3 read policy attached to the instance profile. This allows the instance to obtain temporary security credentials via the instance metadata service, avoiding hardcoded keys or exposing credentials. Option A is wrong because root credentials are overly privileged and should never be used for routine access. Option B is wrong because storing access keys in user data is insecure—keys can be exposed through instance metadata or logs. Option C is wrong because bucket policies based on public IP addresses are not secure; IPs can change and other instances could have the same IP, plus S3 bucket policies should not rely on IP addresses for authentication. Option D is the correct approach because it uses IAM roles, the best practice for granting permissions to AWS services.

Answer

Use the root user credentials of the AWS account.

Answer

Store AWS access keys in the instance's user data and use them in the application.

Answer

Create an S3 bucket policy that allows the EC2 instance's public IP address.

Question 14

A DevOps team uses AWS Lambda functions to process events from an SQS queue. The Lambda function occasionally fails due to transient errors, and the team wants to capture and analyze the full error details, including stack traces, for debugging. The errors are not always related to invocation failures (e.g., timeouts) but include exceptions thrown within the function code. Which approach will capture the MOST comprehensive error information?

Accepted Answer

Ensure the Lambda function code returns a meaningful error object (e.g., throws an exception) so that the error is logged in CloudWatch Logs with a stack trace.. When a Lambda function throws an exception or returns an error object, AWS Lambda automatically logs the error details, including the stack trace, to CloudWatch Logs. This captures the full error information necessary for debugging transient errors. Option A is incorrect because a Dead Letter Queue (DLQ) on SQS captures the failed messages themselves, not the error details or stack traces of the function execution. Option B is incorrect because CloudWatch Logs automatic invocation logging provides only basic information such as invocation time, duration, and status; it does not include the function's stack trace unless explicitly logged by the code. Option D is incorrect because AWS X-Ray provides tracing of requests and can show service maps and latency, but it does not necessarily capture the full stack trace of application-level exceptions; it focuses on request flow rather than detailed error logs.

Answer

Configure a DLQ on the SQS queue to capture failed messages and inspect them.

Answer

Enable CloudWatch Logs and rely on the automatic logging of invocation results.

Answer

Use AWS X-Ray to trace the function execution and analyze the traces.

Question 15

A company runs a critical application on Amazon ECS with Fargate launch type. During an incident, the DevOps engineer notices that tasks are failing with 'CannotPullContainerError: API error (500)'. Which TWO steps should the engineer take to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Logs metric filter to count errors, then a CloudWatch alarm.. The correct solution is to use Amazon CloudWatch Logs metric filter to count errors from application logs, which creates a custom metric representing the error count or rate. Then, a CloudWatch alarm can be configured on that metric to trigger when the error rate exceeds 5% over a 5-minute period. Option C is correct. Option A is incorrect because CloudWatch Synthetics is for synthetic monitoring (endpoint health checks), not for analyzing logs for error rates. Option B is incorrect because CloudWatch Logs Insights is an interactive query tool for ad-hoc analysis, not designed for real-time alarming. Option D is incorrect because CloudWatch Contributor Insights analyzes top contributors (e.g., error sources), but does not directly count error rates for alarms.

Answer

Amazon CloudWatch Synthetics to monitor the application endpoint and create an alarm.

Answer

Amazon CloudWatch Logs Insights to query logs every 5 minutes and trigger a Lambda function.

Answer

Amazon CloudWatch Contributor Insights to detect error patterns, then an alarm.

Question 16

A company uses AWS CloudFormation to deploy a multi-tier application. The stack creation fails with a 'CREATE_FAILED' error for a resource. The engineer wants to troubleshoot the issue. Which TWO steps should the engineer take? (Choose TWO.)

Accepted Answer

Use the 'describe-stack-events' AWS CLI command to view the events.. The 'describe-stack-events' AWS CLI command retrieves all stack events, including the specific event for the failed resource. This event contains the 'ResourceStatusReason' field, which provides the detailed error message from CloudFormation explaining why the resource creation failed. Option C is correct because checking the 'ResourceStatusReason' field in the stack events directly reveals the underlying error. Option B is incorrect because CloudFormation does not automatically create a CloudWatch Logs log group for stack errors; resource-specific logs are only available if the resource itself writes to CloudWatch. During a stack creation failure, there may be no such logs to review. Option D is incorrect because deleting the stack would lose the event history and prevent effective troubleshooting. Option E is incorrect because 'describe-stacks' only returns stack outputs and status, not failure details.

Answer

Review the CloudWatch Logs log group for the stack to find detailed error logs.

Answer

Run 'delete-stack' to remove the failed stack and start over.

Answer

Use the 'describe-stacks' AWS CLI command to get the stack outputs.

Question 17

An application running on an EC2 instance in a private subnet needs to access an S3 bucket. The instance has an IAM role with S3 access. However, the application is failing with timeout errors. The security group allows all outbound traffic, and the NACL allows outbound ephemeral ports. What is the most likely cause?

Accepted Answer

No VPC endpoint for S3. A VPC endpoint for S3 (Gateway or Interface) is needed for private subnet access to S3 without NAT. Without a VPC endpoint, the EC2 instance in a private subnet cannot reach S3, resulting in timeout errors. The security group and NACL settings are permissive, so they are not the issue. Option B is incorrect because the instance is in a private subnet; routing to an Internet Gateway is not necessary and would require a NAT device. Option C is incorrect because the IAM role has the necessary S3 permissions. Option D is incorrect because no HTTP proxy is required for S3 access.

Answer

Missing route in the route table to an Internet Gateway

Answer

IAM role does not have correct trust policy

Answer

Missing HTTP proxy configuration

Question 18

A company wants to implement a CI/CD pipeline for an application that runs on Amazon ECS with Fargate. The pipeline should build a Docker image, push it to Amazon ECR, and deploy a new task definition to ECS. Which THREE AWS services are required to build this pipeline?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is required because it manages the deployment of the updated task definition to the ECS service, supporting strategies like blue/green and canary deployments. It integrates with AWS CodePipeline to orchestrate the deployment step, ensuring minimal downtime and rollback capabilities.

Answer

Amazon S3

Answer

AWS CodeCommit

Question 19

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. They have configured a CodeBuild project that triggers on pushes to the 'develop' branch. The build runs unit tests and packages the application. However, developers report that the pipeline fails intermittently with a 'BUILD_FAILED' status due to test failures, but the tests pass locally. What is the MOST likely cause of this discrepancy?

Accepted Answer

The CodeBuild project has different environment variables or dependency versions compared to the local environment.. The most common cause of tests passing locally but failing in CodeBuild is environment inconsistency. CodeBuild runs in a managed environment with specific runtime versions, environment variables, and dependency caches that may differ from the developer's local machine. This discrepancy can lead to test failures due to different library versions, missing environment variables, or platform-specific behaviors.

Answer

The CodeBuild project is configured with a VPC that restricts access to external dependency repositories.

Answer

The CodePipeline has a timeout setting that causes the build to be terminated before tests complete.

Answer

The CodePipeline is configured with a branch filter that only triggers on the 'main' branch.

Question 20

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to protect the application from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. It allows you to create rules that filter and monitor HTTP(S) requests based on conditions such as IP addresses, HTTP headers, URI strings, and SQL injection or cross-site scripting patterns. By integrating with an Application Load Balancer, AWS WAF can inspect incoming traffic and block malicious requests before they reach the EC2 instances.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Network Firewall