DOP-C02 Practice Exam 58 — 20 Questions

Question 1

A DevOps engineer wants to automate the creation and cleanup of temporary development environments on AWS. Each environment consists of an Amazon EC2 instance and an Amazon RDS database. The environments should be isolated and cost-effective. Which AWS service is best suited for this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudFormation. AWS CloudFormation is best suited because it allows you to define the entire temporary environment—EC2 instance and RDS database—as infrastructure as code (IaC) in a single template. You can create and delete the entire stack with one API call, ensuring isolation via separate stacks and cost-effectiveness by automating cleanup when the stack is deleted.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

Amazon ECS

Question 2

A company wants to centrally manage user access to multiple AWS accounts using federated identity. Which AWS service should be used to create a single sign-on (SSO) solution?

Accepted Answer

AWS IAM Identity Center (AWS SSO). AWS IAM Identity Center (formerly AWS SSO) is the correct service because it is purpose-built to centrally manage user access and permissions across multiple AWS accounts and applications from a single place. It allows you to create or connect your existing identity source (e.g., Active Directory, Okta, Microsoft Entra ID) and then define fine-grained permission sets that map users or groups to specific roles in each account, enabling a true single sign-on (SSO) experience without needing to create IAM users in every account.

Answer

AWS Organizations

Answer

AWS Directory Service for Microsoft Active Directory

Answer

Amazon Cognito

Question 3

Your company uses AWS CodePipeline to automate the deployment of a critical web application. The pipeline consists of a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy) that deploys to an Auto Scaling group of EC2 instances running Amazon Linux 2. The deployment strategy is 'AllAtOnce'. Recently, the team noticed that during deployments, the application becomes completely unavailable for a few minutes until the new instances are registered with the load balancer. The business requires zero downtime during deployments. You need to modify the deployment process to achieve zero downtime while minimizing cost and complexity. The Auto Scaling group currently has a minimum of 2 instances and a maximum of 4 instances. The application is stateless and sessions are stored in ElastiCache. Which solution should you implement?

Accepted Answer

Use CodeDeploy's blue/green deployment with an Application Load Balancer. Create a new Auto Scaling group for the green environment, deploy to it, and then shift traffic.. CodeDeploy blue/green deployments with an ALB allow traffic to be shifted from the original (blue) Auto Scaling group to a newly provisioned green Auto Scaling group only after the new instances pass health checks, so the application never becomes unavailable. Because the app is stateless and sessions live in ElastiCache, no session affinity or state migration is required, making this both low-risk and low-complexity. This directly satisfies the zero-downtime requirement without over-provisioning capacity.

Answer

Create a second Auto Scaling group, deploy to it, and then update Route 53 to point to the new group.

Answer

Change the deployment configuration to 'HalfAtATime' to update half the instances at a time.

Answer

Increase the Auto Scaling group's minimum size to 4 so there are always extra instances.

Question 4

Which TWO best practices should be followed when configuring AWS CodeBuild projects to improve build performance and security? (Choose TWO.)

Accepted Answer

Configure the build project to use a custom VPC to access resources like private Amazon RDS databases. Configuring a CodeBuild project to use a custom VPC allows it to access resources that are not publicly accessible, such as private Amazon RDS databases or internal services, which is essential for building applications that depend on those resources. This also enhances security by keeping traffic within the VPC and avoiding exposure to the public internet.

Answer

Run builds as the root user to avoid permission errors

Answer

Use the AWS managed policy 'AdministratorAccess' for the CodeBuild service role to avoid permission issues

Answer

Always use the 'latest' tag for the build environment image to ensure up-to-date software

Question 5

A media company runs a video processing pipeline on AWS. Raw videos are uploaded to an S3 bucket, which triggers a Lambda function to start an AWS Batch job for transcoding. The Batch job reads the source video from S3, processes it, and writes the output to another S3 bucket. Recently, the company has seen an increase in processing failures. Investigation shows that the Batch jobs are being terminated with a 'TIMEOUT' status after running for exactly 30 minutes. The video files are large, and some jobs legitimately take up to 45 minutes. The Batch job definition has a 'timeout' setting configured. Which action should be taken to resolve this issue?

Accepted Answer

Modify the Batch job definition to increase the 'timeout' value to 3600 seconds (60 minutes).. The Batch job is being terminated with TIMEOUT after exactly 30 minutes, and the job definition has a timeout setting — this is the Batch job attempt timeout (default 30 minutes if not explicitly set, or set to 1800 seconds). Since legitimate jobs take up to 45 minutes, the fix is to raise the job definition's timeout to at least 3600 seconds (60 minutes) to accommodate the longest jobs with headroom.

Answer

Increase the S3 bucket lifecycle policy to retain videos longer.

Answer

Increase the Lambda function timeout to 60 minutes.

Answer

Change the Batch job queue to a different compute environment.

Question 6

A DevOps engineer is troubleshooting a CloudFormation stack that fails to create. The error message indicates a 'circular dependency' between two resources: a security group and an EC2 instance. The security group contains an ingress rule that references the instance's private IP address, which is not known until the instance is created. The instance's network interface uses the security group. What change should the engineer make to resolve the circular dependency?

Accepted Answer

Add an AWS::EC2::SecurityGroupIngress rule that references the instance's network interface using Fn::GetAtt on the network interface resource.. It resolves the circular dependency by creating an explicit dependency on the network interface resource rather than the EC2 instance. The `AWS::EC2::SecurityGroupIngress` rule can use `Fn::GetAtt` on the `AWS::EC2::NetworkInterface` resource to retrieve the private IP address of the instance's primary network interface, which is known after the network interface is created but before the instance is fully launched. This breaks the cycle because the security group ingress rule depends on the network interface, and the network interface depends on the security group (via association), but the instance itself is not directly referenced in the ingress rule, allowing CloudFormation to resolve the dependencies in the correct order.

Answer

Create the EC2 instance first without a security group, then attach the security group after creation.

Answer

Hardcode the instance's private IP address in the security group rule.

Answer

Use the Ref function on the EC2 instance to get its private IP address.

Question 7

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), an EC2 Auto Scaling group (ASG) for web servers, and an Amazon RDS Multi-AZ DB instance. The ASG uses a launch template with Amazon Linux 2 and a user data script that installs the web application and connects to the RDS database using a static password stored in the user data. Recently, the security team discovered that the user data script is exposed in the EC2 console and could be viewed by anyone with EC2 describe-instances permissions. The team wants to remediate this immediately without causing downtime. The ASG is configured with a min size of 2, max size of 6, and desired capacity of 4. The application is currently under load. Which option describes the best course of action?

Accepted Answer

Create a new launch template version that retrieves the password from AWS Secrets Manager. Update the ASG to use the new template version and perform an instance refresh with a minimum healthy percentage of 100%.. It uses an instance refresh with a minimum healthy percentage of 100% to replace instances without downtime, while the new launch template version retrieves the password from AWS Secrets Manager, eliminating the static password exposure. This approach ensures that the security vulnerability is remediated immediately without disrupting the running application under load.

Answer

Immediately modify the user data on each running EC2 instance to remove the password, then update the launch template to reference AWS Secrets Manager.

Answer

Update the existing launch template to use AWS Secrets Manager for the database password. The ASG will automatically apply the change to existing instances.

Answer

Delete the existing launch template and create a new one with secrets from AWS Secrets Manager. Then terminate all running instances and let the ASG launch new ones.

Question 8

A DevOps engineer needs to automate the creation of a CI/CD pipeline using infrastructure as code. Which AWS service is BEST suited to define and provision the pipeline resources?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an infrastructure-as-code (IaC) service that allows you to define and provision AWS resources, including CI/CD pipeline components like CodePipeline, CodeBuild, and CodeDeploy, using declarative templates. This enables fully automated, repeatable, and version-controlled pipeline creation without manual intervention.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS Service Catalog

Question 9

A company deploys a serverless application using AWS SAM. The application includes an API Gateway REST API and multiple Lambda functions. The team wants to implement canary deployments for the API to gradually shift traffic to a new version. Which SAM template configuration should be used?

Accepted Answer

Use the CanaryDeployment property on the Serverless::Function resource with a DeploymentPreference. AWS SAM's `CanaryDeployment` property on the `AWS::Serverless::Function` resource, combined with a `DeploymentPreference` of type `Canary10Percent5Minutes`, enables gradual traffic shifting for API Gateway integrations. This configuration automatically creates a Lambda alias, publishes new versions, and shifts a percentage of API traffic to the new version over a specified time window, all without manual intervention.

Answer

Create multiple Lambda function versions and use API Gateway stage variables to switch between them

Answer

Define the Lambda function with AutoPublishAlias: live and set the API Gateway integration to point to the alias

Answer

Use AWS CloudFormation's UpdatePolicy with AutoScalingRollingUpdate

Question 10

A DevOps engineer is designing a highly available web application using Amazon Route 53. The application is deployed in two AWS Regions. The engineer wants to route traffic to the nearest healthy endpoint. Which routing policy should be used?

Accepted Answer

Latency routing. Latency routing in Amazon Route 53 directs users to the AWS Region that provides the lowest network latency, which matches the requirement to route traffic to the nearest healthy endpoint. Route 53 uses latency measurements between the user and each AWS Region to select the optimal record. Health checks can be associated with latency records to ensure traffic only goes to healthy endpoints.

Answer

Failover routing

Answer

Weighted routing

Answer

Geolocation routing

Question 11

Match each AWS service health or performance concept to its meaning.

Accepted Answer

Amazon CloudWatch: Monitors AWS resources and applications in real-time.. The correct matches are: Amazon CloudWatch monitors resources in real-time; AWS Trusted Advisor optimizes cost, security, and performance; AWS Health Dashboard provides personalized health alerts. Common confusions involve swapping monitoring (CloudWatch) with auditing (CloudTrail) and recommendations (Trusted Advisor) with monitoring.

Answer

Amazon CloudWatch: Audits API calls for governance and compliance.

Answer

AWS Trusted Advisor: Provides real-time monitoring of application performance.

Question 12

A company runs a microservices architecture on Amazon ECS with Fargate. The operations team wants to collect custom application metrics (e.g., request latency per service) and visualize them in CloudWatch dashboards. The team also needs to set CloudWatch alarms based on these metrics. Which solution requires the LEAST amount of code changes and operational overhead?

Accepted Answer

Use the CloudWatch Embedded Metric Format to emit custom metrics as JSON log entries.. The CloudWatch Embedded Metric Format allows applications to emit metrics as structured JSON logs, which CloudWatch automatically extracts into metrics and logs. This requires minimal code changes (just log format). Option B is wrong because publishing to CloudWatch via PutMetricData requires the AWS SDK and more code changes. Option C is wrong because CloudWatch Agent on Fargate is not supported (requires EC2). Option D is wrong because using a sidecar container for StatsD adds complexity and overhead.

Answer

Deploy a StatsD daemon as a sidecar container and configure the application to send metrics to StatsD, then forward to CloudWatch.

Answer

Modify the application code to use the AWS SDK to call PutMetricData API directly.

Answer

Install the CloudWatch Agent on each Fargate task as a sidecar container to collect custom metrics.

Question 13

A company has deployed a multi-tier application on AWS. The web tier uses an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application tier uses another Auto Scaling group of EC2 instances that process messages from an Amazon SQS queue. The database tier uses Amazon RDS Multi-AZ. Recently, the application experienced a complete outage when the SQS queue became overwhelmed with messages due to a sudden spike in traffic. The application tier could not process messages fast enough, causing the queue to grow indefinitely and eventually exceed the visibility timeout, leading to message loss and degraded performance. The DevOps engineer needs to improve the resilience of the architecture to handle traffic spikes without losing messages. Which solution should be implemented?

Accepted Answer

Configure a dead-letter queue for unprocessed messages and implement Auto Scaling based on SQS queue depth. It addresses both the message loss and processing bottleneck. A dead-letter queue (DLQ) captures messages that cannot be processed successfully after a specified number of attempts, preventing them from being lost when the visibility timeout expires. Implementing Auto Scaling based on SQS queue depth (using a CloudWatch alarm on the ApproximateNumberOfMessagesVisible metric) dynamically adds more application-tier EC2 instances when the queue grows, ensuring the processing rate scales with demand and prevents the queue from being overwhelmed.

Answer

Limit the maximum message size and set a queue size limit to prevent overflow

Answer

Replace the standard SQS queue with a FIFO SQS queue to ensure exactly-once processing

Answer

Increase the visibility timeout in the SQS queue to allow more time for processing

Question 14

A DevOps engineer is investigating a security incident where an EC2 instance was compromised. The engineer needs to collect forensic data without losing volatile information. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Create a snapshot of the attached EBS volumes.. Option C is correct because creating an EBS snapshot captures a point-in-time, crash-consistent copy of the attached volumes, preserving disk-based forensic evidence (file system, logs, malware artifacts) without altering the running instance. Option D is correct because volatile data such as RAM contents, running processes, network connections, and encryption keys exist only in memory and are lost once the instance is stopped or terminated, so a memory dump must be collected first. Option A is wrong because detaching EBS volumes from a running instance is not supported and would disrupt the live system before volatile data is captured. Option B is wrong because instance metadata contains only configuration data (instance ID, AMI, IAM role, user data) and provides no forensic value for the compromise. Option E is wrong because terminating the instance destroys both volatile memory and the instance store, and may also delete EBS volumes depending on the DeleteOnTermination setting, irreversibly destroying evidence.

Answer

Detach the EBS volumes and attach them to a forensic instance.

Answer

Retrieve the instance metadata from the console.

Answer

Terminate the instance immediately to prevent further access.

Question 15

An application running on Amazon ECS with Fargate is experiencing increased latency. The DevOps team suspects that the task is running out of memory and swapping. Which set of CloudWatch metrics should the team examine to confirm this suspicion?

Accepted Answer

MemoryUtilized and MemoryReserved. MemoryUtilized and MemoryReserved are the CloudWatch metrics that directly track memory consumption and allocation for ECS tasks using Fargate. When a task runs out of memory, the Linux kernel’s OOM killer may terminate processes, but before that, swapping can occur if swap space is available, causing increased latency. These metrics allow the DevOps team to compare actual memory usage against the task’s memory reservation, confirming if memory pressure is the root cause of the latency.

Answer

NetworkIn and NetworkOut

Answer

CPUUtilization and CPUReservation

Answer

EphemeralStorageUtilized and EphemeralStorageReserved

Question 16

A large enterprise uses a multi-account AWS strategy with a centralized DevOps account. The DevOps account hosts an AWS CodePipeline that deploys a critical application to production account (111111111111) using AWS CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy). The deploy stage uses a cross-account role (arn:aws:iam::111111111111:role/CrossAccountDeployRole) to perform the deployment. The trust policy on that role allows the DevOps account's CodePipeline service role (arn:aws:iam::222222222222:role/CodePipelineServiceRole) to assume it. The pipeline has been working for months, but after a recent security audit, the security team tightened permissions. Now the deploy stage fails with the error: 'User: arn:aws:sts::222222222222:assumed-role/CodePipelineServiceRole/AWS-CodePipeline-xxx is not authorized to perform: codedeploy:CreateDeployment on resource: arn:aws:codedeploy:us-east-1:111111111111:deploymentgroup:MyApp/MyDG'. The DevOps team has verified that the CrossAccountDeployRole has a permissions policy that allows 'codedeploy:*' on all resources. The CodePipelineServiceRole has a permissions policy that allows 'sts:AssumeRole' on the CrossAccountDeployRole. What is the most likely cause and what action should be taken to resolve the issue?

Accepted Answer

Check the permissions boundary on CrossAccountDeployRole and add a boundary that allows CodeDeploy actions.. The error indicates that the assumed role (CrossAccountDeployRole) is not authorized to perform codedeploy:CreateDeployment, despite having a permissions policy that allows codedeploy:* on all resources. This typically occurs when a permissions boundary is attached to the role that restricts the effective permissions, overriding the permissions policy. Adding a permissions boundary that allows CodeDeploy actions resolves the issue by ensuring the role's effective permissions include the necessary CodeDeploy operations.

Answer

Add 'sts:AssumeRole' to the permissions policy of CodePipelineServiceRole.

Answer

Create the deployment group in the production account again to reset permissions.

Answer

Update the trust policy of CrossAccountDeployRole to include the DevOps account ID.

Question 17

A company uses AWS CloudFormation to manage infrastructure. They want to update a stack but need to ensure that critical database resources are not accidentally replaced during the update. What is the BEST way to protect these resources?

Accepted Answer

Define a stack policy that denies updates to the database resources.. A stack policy explicitly defines which resources can be updated or replaced during a stack update. By applying a stack policy that denies update actions on the critical database resources, you prevent accidental replacement or modification without having to remove the resources from the stack. This is the most direct and robust method to protect specific resources during a CloudFormation update operation.

Answer

Use a CreationPolicy on the database resources.

Answer

Use a DeletionPolicy of Retain on the database resources.

Answer

Set an UpdatePolicy with AutoScalingReplacingUpdate.

Question 18

A company uses Chef for configuration management of their EC2 instances. They want to use AWS OpsWorks for Chef Automate to manage the Chef server. What is the primary benefit of using OpsWorks for Chef Automate compared to running a self-managed Chef server?

Accepted Answer

It reduces operational overhead by managing the Chef server's infrastructure.. The primary benefit of AWS OpsWorks for Chef Automate is that it reduces operational overhead by managing the Chef server's infrastructure, including patching, backups, scaling, and high availability. This allows teams to focus on authoring cookbooks and managing node configurations rather than maintaining the Chef server itself.

Answer

It provides a graphical user interface to author cookbooks.

Answer

It creates cookbooks based on the instance configuration.

Answer

It automatically applies cookbooks to all instances in the account.

Question 19

An application runs on EC2 instances behind an ALB. Users report intermittent 503 errors. The engineer checks ALB metrics and sees 'SurgeQueueLength' increasing periodically. What is the most likely cause?

Accepted Answer

The application instances are not able to process requests quickly enough, causing the request queue to back up.. A high SurgeQueueLength indicates that the ALB is receiving more requests than the target instances can process, causing the request queue to back up. When the queue exceeds the limit (1024 requests), the ALB returns 503 errors. Option B is incorrect because health check failures typically cause the ALB to stop routing traffic to unhealthy instances, reducing the queue rather than increasing it. Option C is incorrect because an expired SSL certificate would cause TLS handshake failures, not 503 errors. Option D is incorrect because a misconfigured security group would block traffic entirely, resulting in connection timeouts or 503s, but it would not cause the SurgeQueueLength to increase.

Answer

The target group health checks are failing, causing the ALB to route traffic to unhealthy instances.

Answer

The SSL certificate on the ALB has expired.

Answer

The ALB security group is blocking traffic from the clients.

Question 20

A DevOps engineer uses AWS CloudFormation to manage infrastructure. The stack creation fails with the error: 'Circular dependency between resources'. The template includes an EC2 instance, an Elastic IP, and an internet gateway. The instance is associated with the Elastic IP, and the Elastic IP uses the internet gateway for the VPC. Which resource relationship is MOST likely causing the circular dependency?

Accepted Answer

The EC2 instance depends on the Elastic IP, and the Elastic IP depends on the EC2 instance.. The circular dependency arises when the EC2 instance depends on the Elastic IP (via an Association resource) and the Elastic IP depends on the EC2 instance (via the InstanceId property). CloudFormation cannot resolve the creation order when two resources each require the other to exist first. This is a classic circular dependency in CloudFormation templates when using an AWS::EC2::EIP with an InstanceId that references the EC2 instance, while the instance itself has a DependsOn or a reference to the Elastic IP.

Answer

The security group depends on the EC2 instance, and the EC2 instance depends on the security group.

Answer

The Elastic IP depends on the internet gateway, and the internet gateway depends on the Elastic IP.

Answer

The internet gateway depends on the VPC, and the VPC depends on the internet gateway.