DOP-C02 Practice Exam 52 — 20 Questions

Question 1

A company uses AWS CodePipeline with a GitHub source action. The pipeline triggers on changes to the master branch. However, the pipeline does not trigger when changes are pushed to the master branch. What is the MOST likely cause?

Accepted Answer

The webhook in GitHub is not properly configured or has been removed.. Option B is correct because CodePipeline uses webhooks to detect changes in GitHub. If the webhook is not properly configured, changes may not trigger the pipeline. Option A is incorrect because the branch is specified. Option C is incorrect because the pipeline can access public repositories. Option D is incorrect because the pipeline does not need to be in the same region as GitHub.

Answer

The pipeline uses a different branch name.

Answer

The GitHub repository is not in the same AWS region as the pipeline.

Answer

The pipeline does not have permission to access the GitHub repository.

Question 2

A company uses AWS OpsWorks for configuration management. They want to ensure that whenever a new instance is added to a layer, it automatically installs the latest security patches and joins a central logging system. What is the most efficient way to achieve this?

Accepted Answer

Use Chef recipes in a custom OpsWorks layer's Setup lifecycle event.. Option B is correct because Chef recipes in OpsWorks lifecycle events (Setup) run on new instances. Option A is wrong because user data runs only at launch and may not run again if instance is stopped/started. Option C is wrong because it requires manual intervention. Option D is wrong because it is not real-time.

Answer

Schedule a cron job on each instance to check and apply patches daily.

Answer

Configure user data scripts in the launch configuration.

Answer

SSH into each instance and run the commands manually.

Question 3

A DevOps engineer creates the IAM policy above for an instance role. The role is attached to an EC2 instance that runs an application. The application starts and stops EC2 instances and reads a database password from Systems Manager Parameter Store. However, the application fails to retrieve the parameter. What is the most likely cause?

Accepted Answer

The parameter is a SecureString and the policy does not grant 'kms:Decrypt' permission for the KMS key.. The policy allows 'ssm:GetParameter' and 'ssm:GetParameters' on the specific parameter ARN. However, to retrieve a parameter, the action 'ssm:GetParameter' is sufficient, but the resource ARN must be correct. The given ARN includes the parameter name '/MyApp/DBPassword'. If the application is using a different path or the parameter is encrypted, the policy might be insufficient. But the most common issue is that the parameter is a SecureString and the policy also needs 'kms:Decrypt' access to the KMS key. Option C is correct because the policy does not include KMS permissions. Option A and B are less likely. Option D is incorrect because the actions are allowed.

Answer

The policy does not allow 'ssm:GetParameterHistory'.

Answer

The policy does not allow 'ec2:DescribeParameters'.

Answer

The policy does not allow 'ssm:GetParameter' on the specific resource.

Question 4

An organization uses AWS System Manager Patch Manager to patch EC2 instances. The patches are not being applied to some instances. The instances are running Amazon Linux 2 and have the SSM Agent installed. What is the MOST likely reason for the failure?

Accepted Answer

The instances are missing the required IAM role for Systems Manager.. Option C is correct because instances must have an IAM role that allows SSM to manage patches. Without the role, SSM Agent cannot communicate with the service. Option A is incorrect because SSM Agent does not require internet access if using VPC endpoints. Option B is incorrect because Patch Manager supports Amazon Linux 2. Option D is incorrect because SSM Agent is not patched, it is used to apply patches.

Answer

The instances do not have internet access to reach the Systems Manager endpoint.

Answer

The SSM Agent is out of date and needs to be updated.

Answer

The instances are not running a supported operating system.

Question 5

An organization uses AWS Elastic Beanstalk for deploying a web application. They have a custom platform extension that modifies the nginx configuration. After a recent deployment, the custom configuration is not applied. The environment logs show that the platform extension script ran successfully. What should the engineer check first?

Accepted Answer

Check if the nginx configuration file is being overwritten by later deployment phases.. Option A is correct because if the file is overwritten after the script runs, the changes are lost. Option B is wrong because the script ran successfully. Option C is wrong because the script ran. Option D is wrong because it is less likely the first check.

Answer

Review the application source code for errors.

Answer

Ensure the script has execute permissions.

Answer

Verify that the platform extension is in the correct folder.

Question 6

A company wants to implement a configuration management strategy for their EC2 instances that are part of an Auto Scaling group. They need to ensure that new instances are automatically configured with the latest software packages and settings without manual intervention. Which TWO approaches meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS CodeDeploy with an Auto Scaling lifecycle hook to deploy applications to new instances.. Options A and C are correct. Option A uses a bootstrapping script in the user data to install packages on launch. Option C uses AWS CodeDeploy to automatically deploy applications to new instances. Option B is incorrect because AWS Config is for compliance, not configuration management. Option D is incorrect because AWS OpsWorks is a separate service, not directly integrated with Auto Scaling groups. Option E is incorrect because Systems Manager Run Command is manual, not automatic on launch.

Answer

Use AWS OpsWorks to manage configurations and associate with the Auto Scaling group.

Answer

Use AWS Config rules to enforce configuration settings.

Answer

Use AWS Systems Manager Run Command on a schedule to apply configurations.

Question 7

A CloudFormation template includes the above snippet. The stack creation fails with the error 'Unable to validate the following destination configurations'. What is the most likely cause?

Accepted Answer

The account has a public access block that denies public bucket policies.. The error 'Unable to validate the following destination configurations' typically occurs when a bucket policy grants public access but the bucket's public access block settings are enabled. By default, S3 blocks public access. Option B is correct. Option A is incorrect because the bucket name is unique. Option C is incorrect because bucket policies are supported. Option D is incorrect because the template is valid YAML.

Answer

The template has a syntax error in the PolicyDocument section.

Answer

The bucket name is not globally unique.

Answer

S3 Bucket Policy is not supported for this bucket region.

Question 8

A company uses CloudFormation to manage infrastructure. They have a nested stack that creates an Amazon RDS instance. When updating the parent stack, the RDS instance is unexpectedly replaced even though no changes were made to its properties. The engineer suspects a 'Drift' detection issue. What is the most likely reason for the replacement?

Accepted Answer

The logical ID of the RDS resource was changed in the nested stack template.. Option D is correct because if the logical ID in the template changes, CloudFormation treats it as a new resource and replaces the old one. Option A is wrong because replacement may occur without drift. Option B is wrong because stack policy doesn't always prevent replacement. Option C is wrong because deletion policy doesn't cause replacement.

Answer

The RDS instance has drifted from the template definition.

Answer

The deletion policy is set to 'Retain'.

Answer

The stack policy prevents updates to the RDS instance.

Question 9

An engineer uses AWS Elastic Beanstalk to deploy a web application. The application needs to read from an S3 bucket. The engineer has configured an instance profile with the necessary S3 permissions. However, the application returns an access denied error. What is the MOST likely cause?

Accepted Answer

The instance profile has not been assigned to the Elastic Beanstalk environment.. Option B is correct because the instance profile must be associated with the EC2 instances launched by Elastic Beanstalk. Option A is incorrect because security groups control network traffic, not S3 permissions. Option C is incorrect because environment variables are not used for IAM permissions. Option D is incorrect because a bucket policy is not needed if the instance profile grants access.

Answer

The S3 bucket policy denies access to the application.

Answer

The security group assigned to the environment does not allow outbound traffic to S3.

Answer

The S3 bucket is in a different region and the application is not configured to use the correct region.

Question 10

A company is designing a CI/CD pipeline for a microservices architecture using AWS CodePipeline. They want to use infrastructure as code to manage the pipeline itself. Which TWO services can be used together to achieve this?

Accepted Answer

AWS CodePipeline. Option A (CloudFormation) and Option D (CodePipeline) are correct because CloudFormation can define the pipeline resource, and CodePipeline is the service being defined. Option B (CodeDeploy) is for deployment, not pipeline definition. Option C (Elastic Beanstalk) is for application deployment. Option E (Service Catalog) is for product portfolios.

Answer

AWS Service Catalog

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Question 11

A DevOps team is designing a CI/CD pipeline for a microservices application deployed on Amazon ECS. The application uses multiple AWS services including RDS, ElastiCache, and SQS. Which TWO strategies should the team implement to ensure secure and auditable configuration management across environments?

Accepted Answer

Use AWS Secrets Manager to store and rotate database credentials.. Using AWS Secrets Manager for database credentials (B) avoids hardcoding secrets and enables rotation. AWS Config rules (C) ensure resources comply with policies and provide audit trail. Option A (hardcoded) is insecure; D (developer S3 access) violates least privilege; E (manual check) is not scalable.

Answer

Store database credentials in a version-controlled configuration file.

Answer

Manually review configuration changes before deployment.

Answer

Grant developers direct S3 access to upload configuration files.

Question 12

An organization uses AWS CloudFormation StackSets to deploy resources across multiple accounts and regions. They need to update a stack set with a new template version. The update fails in some accounts due to a resource conflict. What is the BEST way to resolve the conflict and complete the update?

Accepted Answer

Use the 'Skip accounts' option to temporarily exclude failing accounts, then fix and retry.. Option C is correct because StackSets allows skipping accounts or regions that fail, and the engineer can retry later. Option A is incorrect because manual deletion may cause data loss. Option B is incorrect because changing the template may not resolve the conflict. Option D is incorrect because recreating the stack set is disruptive.

Answer

Delete the stack set and recreate it with the new template.

Answer

Manually delete the conflicting resources in the failing accounts and retry the update.

Answer

Modify the CloudFormation template to ignore the conflicting resources using a condition.

Question 13

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create an EC2 instance with a custom AMI. The error message indicates that the AMI ID does not exist. The engineer is using a mapping in the template to select the AMI based on the region. However, the stack is being created in a region not covered by the mapping. What is the most efficient way to resolve this issue?

Accepted Answer

Retrieve the AMI ID dynamically using AWS Systems Manager Parameter Store and a dynamic reference in the template.. Option D is correct because AWS Systems Manager Parameter Store can be used to store AMI IDs per region dynamically, eliminating the need to update mappings. Option A is wrong because it doesn't guarantee correct AMI for the region. Option B is wrong because SSM Run Command is not for parameter retrieval. Option C is wrong because it is less dynamic and harder to maintain.

Answer

Create a new mapping entry for the region by updating the template.

Answer

Use AWS Systems Manager Run Command to find the correct AMI ID.

Answer

Hardcode the AMI ID in the template for the missing region.

Question 14

A company uses AWS Systems Manager to manage patching of EC2 instances. They want to ensure that instances in a specific Auto Scaling group are patched before being allowed to serve traffic. Which THREE steps should be part of the solution?

Accepted Answer

Create a new launch configuration with the patched AMI.. Options A, B, and E are correct. Option A ensures instances are patched before use. Option B creates new instances. Option E updates the Auto Scaling group to use the new launch configuration. Option C (CodeDeploy) is not needed for patching. Option D (CloudWatch Events) is optional and not required.

Answer

Deploy the patched version using AWS CodeDeploy.

Answer

Configure Amazon CloudWatch Events to trigger a Lambda function after patching.

Question 15

A DevOps engineer is troubleshooting a CloudFormation stack that creates an Auto Scaling group with a launch configuration. The stack creation fails with the error 'Resource handler returned message: "Invalid IAM Instance Profile name" (Service: AutoScaling, Status Code: 400)'. Which TWO are possible causes?

Accepted Answer

The IAM instance profile has not been created yet.. Option A (IAM instance profile does not exist) and Option C (Instance profile name misspelled) are correct. Option B is wrong because insufficient IAM permissions would cause AccessDenied, not Invalid name. Option D is wrong because instance profile can be in same or different account? But cross-account would need ARN. Option E is wrong because it would cause a different error.

Answer

The launch configuration references a deleted instance profile.

Answer

The instance profile is in a different AWS account.

Answer

The IAM role associated with the instance profile does not have sufficient permissions.

Question 16

A DevOps team is using this IAM policy to allow a CI/CD pipeline to launch EC2 instances and retrieve parameters. However, the pipeline is failing with an 'AccessDenied' error when trying to create an instance. The pipeline uses a role with this policy attached. What is the most likely cause?

Accepted Answer

The policy does not grant permissions on additional resources required for RunInstances, such as images and network interfaces.. Option A is correct because the policy only allows RunInstances for instance resource, but creating an instance also requires permissions on other resources like images, security groups, etc. Option B is wrong because the condition is on instance type, not on resource level. Option C is wrong because ssm:GetParameter is allowed. Option D is wrong because the policy is valid syntax.

Answer

The condition StringEquals on InstanceType is incorrectly formatted.

Answer

The pipeline does not have permission to call ssm:GetParameter because the resource is not specified.

Answer

The policy must include a 'Resource' for the 'ec2:DescribeInstances' action to be valid.

Question 17

A DevOps engineer runs these commands to investigate a failed CloudFormation stack creation. The stack status is ROLLBACK_COMPLETE and the most recent event shows CREATE_FAILED. What should the engineer do next to identify the root cause?

Accepted Answer

Run describe-stack-events with a filter to see the ResourceStatusReason for the CREATE_FAILED event.. Option A is correct because the stack events will show the failure reason in the ResourceStatusReason field. Option B is wrong because the stack has already rolled back. Option C is wrong because describe-stacks does not show failure reasons. Option D is wrong because the stack is already rolled back.

Answer

Run update-stack to recreate the stack and examine the error.

Answer

Run describe-stacks with additional query to get the StackStatusReason.

Answer

Run delete-stack and recreate with debugging enabled.

Question 18

A company uses Ansible for configuration management on EC2 instances. They want to ensure that only instances with a specific tag (Environment: Production) are targeted by their playbooks. What is the best way to achieve this?

Accepted Answer

Use the AWS EC2 dynamic inventory plugin to filter instances based on tags.. Option B is correct because Ansible dynamic inventory with AWS EC2 plugin can filter by tags. Option A is wrong because it assigns tags to instances, not select them. Option C is wrong because it is less dynamic. Option D is wrong because it modifies the playbook to check tags after connecting, which is inefficient.

Answer

Add a 'when' condition in the playbook to check the instance tag at runtime.

Answer

Maintain a static inventory file listing only Production instances.

Answer

Use the ec2_tag module to assign the tag to instances.

Question 19

A DevOps engineer runs this command to list resources of a CloudFormation stack. The stack status is 'CREATE_COMPLETE'. However, the EC2 instance 'i-0abcd1234efgh5678' was manually terminated by another team. The engineer wants to restore the stack to its intended state without deleting the stack. What should the engineer do?

Accepted Answer

Update the stack with the original template.. Option D is correct because updating the stack with the original template will cause CloudFormation to recreate the terminated instance. Option A is wrong because the stack is not in a failed state. Option B is wrong because creating a new stack would cause duplication. Option C is wrong because the instance is not managed outside the stack.

Answer

Import the terminated instance back into the stack.

Answer

Create a new stack with the same template and delete the old one.

Answer

Perform a stack drift detection and then manually fix the drift.

Question 20

A company manages multiple AWS accounts using AWS Organizations. The DevOps team needs to enforce that all newly created S3 buckets in any account automatically have versioning enabled and are encrypted with SSE-S3. Which THREE steps should the team take to achieve this using Infrastructure as Code and policy-based controls?

Accepted Answer

Create an SCP that denies s3:PutObject if the bucket does not have encryption enabled.. Using a Service Control Policy (SCP) (A) prevents creation of buckets without encryption. AWS Config Rules (B) can remediate non-compliant buckets. CloudFormation StackSets (D) deploy a baseline template to all accounts. Option C (manual) is not scalable; E (CodePipeline only) does not enforce policies.

Answer

Configure AWS CodePipeline to run a script that checks bucket configurations after creation.

Answer

Manually configure each new bucket via the AWS Management Console.