DOP-C02 Practice Exam 54 — 20 Questions

Question 1

A DevOps engineer is troubleshooting an Amazon RDS for PostgreSQL instance that is running out of storage. The engineer wants to resolve the issue without downtime. Which TWO actions can achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable storage auto scaling on the DB instance.. Enabling storage auto scaling on an Amazon RDS for PostgreSQL instance allows the database to automatically increase its allocated storage when it detects that available storage is running low, preventing out-of-storage errors without requiring manual intervention or downtime. Option E is correct because modifying the DB instance to increase the allocated storage size is a dynamic operation that can be performed without downtime, as Amazon RDS supports online storage scaling for PostgreSQL instances, allowing the change to take effect while the database remains available.

Answer

Create a read replica and promote it to primary.

Answer

Delete old automated snapshots to free up storage.

Answer

Scale up the DB instance to a larger instance class.

Question 2

A DevOps team is debugging a production incident where an Application Load Balancer (ALB) is returning 503 errors for some requests. The target group instances are healthy. What is the most likely cause?

Accepted Answer

The deregistration delay setting on the target group is too long. The deregistration delay setting controls how long the ALB continues to send requests to an instance that is being deregistered. If this delay is too long, the ALB may route traffic to an instance that has already stopped accepting connections, resulting in 503 errors even though the health checks pass. Option A is incorrect because a missing security group rule would prevent any traffic from reaching the ALB, causing connection timeouts rather than 503 errors. Option B is incorrect because the instance health checks are passing (as stated), so the health check path must be correct. Option D is incorrect because disabling cross-zone load balancing affects traffic distribution but does not cause 503 errors.

Answer

The security group for the ALB does not allow inbound traffic on port 443

Answer

Health checks are misconfigured to use an incorrect path

Answer

Cross-zone load balancing is disabled

Question 3

A DevOps team is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a Source stage using CodeCommit, a Build stage using CodeBuild, and a Deploy stage using CloudFormation. The team wants to add manual approval before the Deploy stage for production deployments. How should this be configured?

Accepted Answer

Add an Approval stage to the pipeline with SNS topic for notification.. AWS CodePipeline natively supports Approval stages that can be configured to pause the pipeline and send a notification via an SNS topic. The SNS topic can be subscribed to by email, SMS, or other endpoints, allowing a manual approver to review the build output and then approve or reject the transition to the Deploy stage. This directly meets the requirement for a manual approval gate before production deployment without custom code or separate pipelines.

Answer

Configure a CloudWatch event to send an email on build success.

Answer

Use a Lambda function to approve based on build status.

Answer

Create a separate pipeline for production and trigger it manually.

Question 4

An organization uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with 'UPDATE_ROLLBACK_FAILED' status. The engineer needs to bring the stack to a consistent state without losing data. What is the BEST approach?

Accepted Answer

Use the 'ContinueUpdateRollback' API to skip the resource that caused the failure.. The 'ContinueUpdateRollback' API is the best approach because it allows the stack to resume the rollback process, skipping the resource that caused the failure, and bringing the stack to a consistent 'UPDATE_ROLLBACK_COMPLETE' state without manual intervention or data loss. This API is specifically designed for the 'UPDATE_ROLLBACK_FAILED' status, enabling you to skip resources that cannot be rolled back (e.g., due to a non-reversible change) while preserving the rest of the stack's state.

Answer

Create a new stack from the same template and migrate resources.

Answer

Manually correct the resource configuration that caused the failure, then perform a stack update.

Answer

Delete the stack and then recreate it from the same template.

Question 5

A DevOps engineer is setting up an AWS CodePipeline to deploy a web application to an EC2 instance using AWS CodeDeploy. The deployment group uses an in-place deployment configuration. The pipeline's deploy stage fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The engineer checks the CodeDeploy logs on the instance and finds that the 'BeforeInstall' lifecycle hook script is failing. The script attempts to download a package from an Amazon S3 bucket that is encrypted with SSE-KMS. What is the MOST likely cause of the failure?

Accepted Answer

The IAM role attached to the EC2 instance lacks the 'kms:Decrypt' permission for the AWS KMS key used to encrypt the S3 object.. The error occurs because the EC2 instance's IAM role lacks the `kms:Decrypt` permission for the AWS KMS key used to encrypt the S3 object. When the `BeforeInstall` script attempts to download the package, the AWS SDK or CLI on the instance must decrypt the object using the KMS key. Without this permission, the download fails, causing the lifecycle hook to fail and the overall deployment to abort due to too many failed instances.

Answer

The EC2 instance does not have internet access to reach the S3 bucket.

Answer

The S3 bucket name is misspelled in the 'BeforeInstall' script.

Answer

The CodeDeploy agent does not have permissions to read from the S3 bucket.

Question 6

A company is using AWS CodeDeploy with a blue/green deployment strategy for an Amazon ECS service. After a deployment, the new task set fails health checks, and CodeDeploy automatically rolls back to the original task set. However, the rollback fails because the original task set's desired count is set to 0. What is the most likely cause?

Accepted Answer

The original task set's desired count was set to 0 during the blue/green deployment and the rollback is unable to restore it because the original task definition is no longer available.. During a blue/green deployment on ECS, CodeDeploy sets the original (blue) task set's desired count to 0 after the new (green) task set is created and begins serving traffic. If the green task set fails health checks and triggers an automatic rollback, CodeDeploy attempts to restore the original task set's desired count to its previous value. However, if the original task definition has been deregistered or deleted (e.g., due to lifecycle policies or manual cleanup), the rollback cannot scale the original task set back up, causing the rollback to fail.

Answer

The original task set's health checks are failing.

Answer

The original task set's CloudFormation stack was deleted during the deployment.

Answer

The original task set was deregistered from the target group.

Question 7

An EC2 instance shows as 'running' in the AWS console, but the system status check is 'impaired'. What is the most likely cause?

Accepted Answer

The underlying physical host has experienced a failure.. The system status check specifically monitors the underlying physical host and hypervisor-level networking. When it is impaired, it indicates a failure of the AWS infrastructure supporting the instance, such as a power loss, network connectivity issue, or hardware degradation on the physical server. Since the instance status check (which monitors the guest OS) is not mentioned, the most likely cause is a host-level failure.

Answer

The instance's security group rules are blocking traffic.

Answer

The EBS root volume is corrupted.

Answer

The instance's operating system is not responding.

Question 8

Which THREE factors should be considered when designing a deployment strategy using AWS CodeDeploy to minimize downtime during updates? (Choose three.)

Accepted Answer

Configure a load balancer to deregister instances before deployment.. Deregistering instances from a load balancer before deployment ensures that traffic is not routed to instances that are being updated, preventing downtime during the deployment process. AWS CodeDeploy integrates with Elastic Load Balancing to automatically deregister instances, wait for in-flight requests to complete, and then register them back after the deployment succeeds.

Answer

Deploy to all instances simultaneously to reduce total time.

Answer

Use the same instance type for all instances.

Question 9

A DevOps team is designing a disaster recovery solution for an Amazon RDS for MySQL database. The primary database is in us-east-1, and the recovery point objective (RPO) is 5 minutes, recovery time objective (RTO) is 1 hour. Which solution meets these requirements?

Accepted Answer

Create a cross-Region read replica in the secondary Region.. A cross-Region read replica in the secondary Region meets the RPO of 5 minutes because replication from the primary RDS instance to the read replica is asynchronous but typically completes within seconds to a few minutes, well under the 5-minute threshold. In a disaster, promoting the read replica to a standalone instance can be done manually or automated, and the RTO of 1 hour is achievable because promotion takes only a few minutes, leaving ample time for DNS and application failover. This solution provides a continuous replication stream without manual intervention, unlike snapshot-based approaches.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Take manual snapshots and copy them to the secondary Region daily.

Answer

Configure automated backups with a retention period of 35 days.

Question 10

A company uses an Application Load Balancer (ALB) in front of a fleet of EC2 instances. The security team reports that a specific client IP address is sending malicious requests and must be blocked immediately. The ALB's security group only allows HTTP/HTTPS from 0.0.0.0/0. What is the FASTEST way to block traffic from this IP address without affecting other traffic?

Accepted Answer

Create an AWS WAF web ACL with an IP set deny rule and associate it with the ALB.. AWS WAF with an IP set deny rule associated to the ALB is the fastest and most surgical way to block a specific client IP. WAF evaluates requests at the ALB before they reach targets, and an IP match condition with a block action takes effect within seconds without touching security groups or routing. This blocks only the offending IP while all other traffic continues normally.

Answer

Modify the ALB listener rules to drop requests from the client IP.

Answer

Update the ALB security group to add a deny rule for the client IP address.

Answer

Update the VPC route table to drop packets from the client IP.

Question 11

A company uses AWS CloudFormation to deploy infrastructure across multiple accounts. They want to reuse a set of resource definitions for a standard VPC configuration. Which approach minimizes duplication and maintains centralized control?

Accepted Answer

Create a CloudFormation module for the VPC resources and reference it in each stack.. CloudFormation modules allow you to encapsulate a set of resource definitions into a reusable component that can be referenced across multiple stacks. This approach minimizes duplication because the module is defined once in a central registry (e.g., the CloudFormation public or private module registry) and each stack simply includes a `Module` declaration. It also maintains centralized control because updates to the module are automatically propagated to all stacks that reference it, without requiring manual template copying or stack updates.

Answer

Define the VPC resources in a CloudFormation macro and call the macro from each stack.

Answer

Publish the VPC template in AWS Service Catalog and have each account provision from it.

Answer

Use nested stacks by creating a separate template for the VPC and including it in each account's stack.

Question 12

You are a DevOps engineer at a company that runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed using AWS CodeDeploy with an in-place deployment strategy. The deployment group contains 10 EC2 instances in an Auto Scaling group. Recently, a deployment failed with the error 'The overall deployment failed because too many individual instances failed deployment.' You check the CodeDeploy agent logs on one of the failed instances and see the error 'Script at /opt/codedeploy-agent/deployment-root/deployment-logs/scripts/application_start.sh failed with exit code 1.' The application_start.sh script is part of the AppSpec file. The script attempts to restart the web server. You notice that the script uses a path that exists only on some instances. What should you do to resolve this issue and prevent future failures?

Accepted Answer

Modify the application_start.sh script to check for the existence of the path before running the restart command.. The error indicates that application_start.sh failed because it references a path that does not exist on all instances. The correct fix is to make the script robust by checking for the path's existence before attempting the restart, so it does not fail on instances where the path is absent. This addresses the root cause and prevents future deployment failures.

Answer

Increase the deployment timeout in CodeDeploy.

Answer

Remove the application_start.sh script from the AppSpec file.

Answer

Reinstall the CodeDeploy agent on all instances.

Question 13

A company uses AWS Elastic Beanstalk for deploying web applications. They want to automate deployments whenever a new commit is pushed to the master branch of their CodeCommit repository. Which AWS service should they use to trigger the deployment?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed continuous delivery service that can be configured to automatically trigger a deployment pipeline when a new commit is pushed to a CodeCommit repository's master branch. It integrates directly with CodeCommit as a source action and Elastic Beanstalk as a deployment provider, enabling end-to-end automation without custom scripting.

Answer

AWS CloudTrail

Answer

AWS OpsWorks

Answer

Amazon CloudWatch Events

Question 14

The exhibit shows the output of the AWS CLI command 'batch-get-builds' for a CodeBuild build. The build failed. What is the most likely cause of the failure?

Accepted Answer

The S3 bucket 'my-bucket' does not exist or the build project lacks permissions to access it.. The `batch-get-builds` output shows a failure in the DOWNLOAD_SOURCE phase, with an error indicating that the build could not access the S3 bucket `my-bucket`. The error details, such as 'Access Denied' or 'NoSuchBucket', imply that the CodeBuild service role lacks the required `s3:GetObject` permission on the bucket, or the bucket does not exist. This is a common misconfiguration when the source code is stored in an S3 bucket and the build project is not properly configured to retrieve it.

Answer

The source code has compilation errors.

Answer

The buildspec file is malformed.

Answer

The build project does not have sufficient memory.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. They want to implement a change management process that requires approval before any stack update is executed. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use AWS CodePipeline with a manual approval stage before the CloudFormation deployment action.. AWS CodePipeline can include a manual approval action that pauses the pipeline until an authorized user approves the change, after which the CloudFormation deployment action executes the stack update. This enforces a formal approval gate before any infrastructure change is applied.

Answer

Use CloudFormation StackSets with approval tokens.

Answer

Use CloudFormation Change Sets and require a separate user to execute them.

Answer

Use AWS Service Catalog to manage CloudFormation templates and require approval for product launches.

Question 16

A development team uses AWS CodeCommit for source control and wants to automatically run unit tests on every push to the main branch. Which AWS service should they use to trigger the tests?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it provides a fully managed continuous delivery service that can be configured to automatically trigger a build action (such as running unit tests in AWS CodeBuild) whenever a change is pushed to a specified branch in AWS CodeCommit. This is achieved by setting the source stage to the CodeCommit repository and branch, and then adding a build stage that invokes CodeBuild to execute the tests, enabling an automated CI/CD workflow.

Answer

AWS CodeBuild

Answer

Amazon CloudWatch Events

Answer

AWS CodeDeploy

Question 17

A team uses AWS CodeBuild to build a Node.js application. The buildspec.yml file is at the root of the repository. The build fails with 'Error: Cannot find module 'aws-sdk''. Which TWO actions could resolve the issue? (Choose TWO.)

Accepted Answer

Ensure 'aws-sdk' is listed in the 'dependencies' section of package.json.. The 'aws-sdk' module must be declared in the 'dependencies' section of package.json for npm to install it during the build. Without this declaration, npm install will not download the module, causing the 'Cannot find module' error at runtime. Option D is correct because CodeBuild does not automatically run npm install; you must explicitly include an 'install' phase in buildspec.yml to execute 'npm install' and populate node_modules.

Answer

Specify a different Node.js runtime version in the buildspec.

Answer

Add a 'pre_build' phase that runs 'npm test'.

Answer

Add a 'build' phase command to compile the code.

Question 18

Which THREE are features of AWS Key Management Service (KMS) that help with compliance requirements? (Choose 3)

Accepted Answer

Automatic key rotation every year (optional).. AWS KMS supports optional automatic annual key rotation for customer managed keys. This helps meet compliance frameworks (e.g., PCI DSS, SOC, HIPAA) that require periodic cryptographic key rotation to limit the amount of data encrypted under a single key. When enabled, KMS automatically rotates the key material once per year, creating a new backing key while retaining the old one for decryption of previously encrypted data.

Answer

Automatic password generation for databases.

Answer

Automatic deletion of keys after a specified period.

Question 19

A DevOps engineer is troubleshooting a slow API response. They suspect that the issue is related to database queries. The application runs on EC2 instances behind an ALB and uses Amazon RDS for MySQL. Which monitoring approach will provide the most granular insight into database query performance?

Accepted Answer

Enable Enhanced Monitoring and Performance Insights for the RDS instance.. Amazon RDS Performance Insights provides a database load view that breaks down wait events by SQL statement, user, host, and database, which is the most granular way to identify slow queries. Enhanced Monitoring complements this with OS-level metrics at up to one-second granularity. Together they give the DevOps engineer the query-level and host-level detail needed to pinpoint the slow API's database bottleneck.

Answer

Enable CloudWatch Logs for the RDS instance and query the error log.

Answer

Install the CloudWatch agent on the EC2 instances to collect database performance counters.

Answer

Monitor the ALB's 'TargetResponseTime' metric and correlate with RDS 'CPUUtilization'.

Question 20

A development team uses AWS CodeCommit as a source repository for their AWS CodePipeline. They want to automatically trigger a pipeline execution when a new branch is created. Which solution should they implement?

Accepted Answer

Use Amazon CloudWatch Events to trigger the pipeline on a CodeCommit 'Reference Created' event.. AWS CodePipeline can be configured to start execution automatically when a new branch is created in CodeCommit by using Amazon CloudWatch Events (now part of Amazon EventBridge) to listen for the 'Reference Created' event type. This event is emitted by CodeCommit whenever a new Git reference (such as a branch or tag) is created, and it can directly target a CodePipeline pipeline as a rule target, triggering a new execution without any custom polling or webhook setup.

Answer

Create an S3 event notification to invoke the pipeline when a branch is created.

Answer

Configure a webhook in CodePipeline to detect branch creation events.

Answer

Set up a polling mechanism in CodePipeline to check for new branches every minute.