DOP-C02 Practice Exam 60 — 20 Questions

Question 1

A company wants to centrally manage and apply policies across multiple AWS accounts in an AWS Organization. Which service should be used to define and enforce compliance rules?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are the correct choice because they centrally manage permissions across all accounts in an AWS Organization by defining maximum allowable permissions. SCPs act as a guardrail, restricting what member accounts can do, even if IAM policies within those accounts grant broader access. This makes SCPs the ideal service for enforcing compliance rules at the organization level.

Answer

AWS Config rules

Answer

AWS CloudTrail

Answer

IAM policies

Question 2

An organization manages multiple AWS accounts using AWS Organizations. They want to use AWS CloudFormation StackSets to deploy a standard VPC configuration across all accounts. However, some accounts require specific CIDR blocks that differ from the default. What is the most efficient way to handle this variation?

Accepted Answer

Use a single StackSet with parameters and pass account-specific parameter files via AWS CloudFormation parameter overrides in the StackSet instance.. AWS CloudFormation StackSets support parameter overrides at the stack instance level, allowing you to deploy a single StackSet template across multiple accounts while specifying account-specific CIDR blocks without duplicating infrastructure. This approach minimizes management overhead by using one template and one StackSet, with parameter overrides applied per target account or organizational unit (OU) via the StackSet instance configuration.

Answer

Create separate StackSets for each CIDR range and assign accounts accordingly.

Answer

Create a nested stack for each account that overrides the default parameters.

Answer

Maintain separate templates per account with hardcoded CIDR blocks.

Question 3

A DevOps engineer needs to set up a monitoring solution for an AWS Lambda function that processes messages from an Amazon SQS queue. The engineer wants to be alerted if the function fails to process a message (i.e., the message ends up in the dead-letter queue). Which approach should they use?

Accepted Answer

Create a CloudWatch alarm on the ApproximateNumberOfMessagesVisible metric of the dead-letter queue.. The `ApproximateNumberOfMessagesVisible` metric on the dead-letter queue (DLQ) directly reflects the number of messages that have failed processing and been moved there. By creating a CloudWatch alarm on this metric (e.g., when it exceeds 0 for a period), the engineer receives an alert precisely when messages are failing, without needing to parse logs or rely on indirect indicators.

Answer

Enable CloudTrail to log SQS API calls and create a metric filter for SendMessage to the DLQ.

Answer

Create a CloudWatch Events rule to monitor the Lambda function errors.

Answer

Configure the Lambda function's dead-letter queue to send notifications via Amazon SNS.

Question 4

Drag and drop the steps to set up an AWS CodeBuild project to build a Docker image and push it to Amazon ECR.

Accepted Answer

Create ECR repository, then Write buildspec.yml, then Create CodeBuild project with privileged mode, then Start build. The correct order to set up an AWS CodeBuild project for building a Docker image and pushing to Amazon ECR is: first create the ECR repository, then write the buildspec.yml file, then create the CodeBuild project with privileged mode enabled, and finally start the build. This sequence ensures the repository exists, the build specification is ready, and the project has the necessary permissions to build and push the Docker image.

Answer

Create CodeBuild project, then Create ECR repository, then Write buildspec.yml, then Start build

Answer

Write buildspec.yml, then Create ECR repository, then Create CodeBuild project without privileged mode, then Start build

Answer

Create ECR repository, then Start build, then Create CodeBuild project, then Write buildspec.yml

Question 5

A company uses an Auto Scaling group with a dynamic scaling policy based on a custom CloudWatch metric. After a recent deployment, the metric spikes unexpectedly, causing the Auto Scaling group to launch several EC2 instances. The operations team wants to quickly determine whether the spike was caused by a real load increase or a deployment issue. What is the MOST efficient way to investigate this?

Accepted Answer

Use CloudWatch Logs Insights to query application logs for error patterns or deployment markers that coincide with the metric spike.. CloudWatch Logs Insights allows you to query application logs for error patterns or deployment markers (e.g., new version tags, exception stack traces) that coincide with the metric spike. This directly correlates the scaling event with application-level evidence, enabling rapid root-cause analysis without altering infrastructure or relying on indirect notifications.

Answer

Check the SNS topic that the scaling policy publishes to for notifications.

Answer

Use AWS CloudTrail to review API calls that modified the scaling policy.

Answer

Temporarily disable the scaling policy and manually increase the desired capacity to handle the load.

Question 6

A DevOps team is implementing a CI/CD pipeline for a microservices architecture. Each microservice is built and deployed independently. The team wants to ensure that only one build runs per microservice at a time to avoid resource contention, and that the build artifacts are stored securely. Which THREE steps should the team take?

Accepted Answer

Enable versioning on the S3 bucket storing build artifacts. Option B is correct because enabling versioning on the S3 bucket preserves every revision of the build artifacts, allowing recovery of previous versions and protecting against accidental overwrites or deletions, which supports secure artifact storage. Option C is correct because configuring a concurrency limit in each microservice's CodeBuild project ensures only one build for that microservice runs at a time, directly preventing resource contention as required. Option E is correct because enabling server-side encryption on the S3 bucket encrypts artifacts at rest using AWS-managed or KMS keys, satisfying the requirement to store build artifacts securely. Option A is not correct because AWS CodeArtifact is a package/dependency repository for artifacts like npm, Maven, and PyPI packages, not the general build-artifact store used by CodePipeline, and the scenario's secure storage requirement is met by S3 with versioning and encryption. Option D is not correct because creating a separate CodePipeline per microservice supports independent deployment but does not by itself enforce one build at a time or secure artifact storage.

Answer

Store build artifacts in AWS CodeArtifact

Answer

Create a separate CodePipeline for each microservice

Question 7

A DevOps team is using AWS CloudFormation to manage infrastructure. They want to reuse the same template across multiple environments (dev, test, prod) with minor parameter variations. Which CloudFormation feature should they use to pass environment-specific values without modifying the template?

Accepted Answer

Parameters. CloudFormation Parameters let you pass environment-specific values (like instance sizes, CIDR ranges, or environment names) into a template at stack creation or update time without modifying the template itself. This is exactly the use case described: one template, multiple environments, different values supplied at deploy time via the console, CLI, or a parameters file.

Answer

Conditions

Answer

Outputs

Answer

Mappings

Question 8

A company uses AWS CloudFormation to deploy a web application across multiple AWS accounts using StackSets. The DevOps team notices that stack instance updates are failing in some accounts with the error: 'Insufficient IAM permissions to perform the action'. The team has already verified that the StackSet IAM role has the necessary permissions. What is the most likely cause of this issue?

Accepted Answer

The target accounts do not have the necessary trust policy to allow the StackSet IAM role to assume the execution role.. StackSets require a trust relationship between the StackSet IAM role (in the management account) and an execution role in each target account. Even if the StackSet IAM role has full permissions, the target accounts must have a trust policy that allows the StackSet IAM role to assume the execution role. Without this trust policy, the assumption fails, resulting in the 'Insufficient IAM permissions' error.

Answer

The target accounts have reached the limit of 200 stacks per region.

Answer

AWS Organizations has a service control policy (SCP) that denies the required action, but the StackSet IAM role has full admin permissions.

Answer

The StackSet name contains invalid characters that are not allowed in some accounts.

Question 9

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. The application is deployed using AWS CodeDeploy with an in-place deployment configuration. During a recent deployment, the deployment failed because the new application version caused a health check failure, and CodeDeploy did not automatically roll back. What should the engineer do to ensure automatic rollback on health check failure?

Accepted Answer

Enable automatic rollback in the CodeDeploy deployment group and set up a CloudWatch alarm for the ALB health check. CodeDeploy can automatically roll back a deployment when a CloudWatch alarm, such as one monitoring ALB health check failures, enters the ALARM state. By enabling automatic rollback in the deployment group and associating the CloudWatch alarm, the deployment will revert to the previous version as soon as the health check fails, without manual intervention.

Answer

Set up an EC2 instance lifecycle hook to trigger a rollback script when the instance enters a pending state

Answer

Configure an Amazon SQS queue to monitor health checks and invoke a rollback Lambda function

Answer

Modify the Auto Scaling group to replace unhealthy instances automatically

Question 10

A company is using Amazon RDS for PostgreSQL and wants to monitor the database for performance issues. They need to capture slow queries and analyze them over time. Which combination of AWS services should they use?

Accepted Answer

Enable RDS Performance Insights and Enhanced Monitoring.. RDS Performance Insights provides a database performance schema with detailed wait events and SQL-level metrics to identify slow queries, while Enhanced Monitoring offers OS-level metrics (CPU, memory, disk I/O) at sub-minute granularity. Together, they allow you to capture and analyze slow queries over time without additional log parsing or export overhead.

Answer

Enable RDS Event notifications to send alerts for performance issues.

Answer

Enable CloudWatch Logs for PostgreSQL and export logs to Amazon S3.

Answer

Use CloudWatch Metrics to monitor database connections and CPU utilization.

Question 11

A DevOps engineer is setting up an AWS CodeBuild project that needs to access resources in a VPC, such as an Amazon RDS database. The engineer has configured the CodeBuild project to run in the VPC. Which additional configuration is required for CodeBuild to pull the build Docker image?

Accepted Answer

Create a VPC interface endpoint for Amazon ECR and configure the CodeBuild project to use it.. When a CodeBuild project runs inside a VPC, it loses default internet access, so it cannot reach public endpoints like Amazon ECR (Docker Hub or ECR) to pull the build image. A VPC interface endpoint (powered by AWS PrivateLink) creates a private, highly available connection to Amazon ECR within the VPC, allowing CodeBuild to pull images without traversing the internet. This is the correct solution because it provides direct, secure access to ECR while keeping all traffic within the AWS network.

Answer

Create a VPC peering connection to another VPC that has internet access.

Answer

Configure a VPC gateway endpoint for Amazon ECR.

Answer

Attach an internet gateway to the VPC and add a default route to it.

Question 12

A DevOps team uses AWS CodePipeline to deploy a static website to an Amazon S3 bucket. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that runs a build tool), and a deploy stage (S3). After a recent code change, the build stage succeeded but the deploy stage failed with the error: 'Access Denied' when uploading artifacts to the S3 bucket. What should the team do to fix the issue?

Accepted Answer

Add 's3:PutObject' permission to the CodePipeline service role. The deploy stage in CodePipeline uses the CodePipeline service role to upload artifacts to the S3 bucket. The error 'Access Denied' indicates that this role lacks the necessary permissions. Adding 's3:PutObject' to the CodePipeline service role grants it the required write access to the S3 bucket, resolving the issue.

Answer

Configure the S3 bucket to allow public access

Answer

Add an S3 bucket policy that grants the CodeBuild service role s3:PutObject access

Answer

Verify that the CodeCommit repository has the correct permissions for the pipeline

Question 13

Which AWS service is primarily used to automate the building, testing, and deployment of code changes to AWS infrastructure based on a defined release process?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the building, testing, and deployment of code changes through a defined release process. It integrates with source control (e.g., CodeCommit, GitHub), build services (e.g., CodeBuild), and deployment services (e.g., CodeDeploy) to automate the entire pipeline from commit to production.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 14

A company uses AWS CodePipeline with multiple stages: source, build, test, and deploy. The test stage takes 45 minutes to complete. Developers complain that the pipeline takes too long to provide feedback. The team wants to run tests in parallel across multiple environments. Which approach should be taken to reduce the pipeline execution time?

Accepted Answer

Configure the test stage with parallel actions in CodePipeline. AWS CodePipeline supports parallel actions within a stage, allowing multiple test environments (e.g., different OS or browser configurations) to run simultaneously. This reduces the overall pipeline execution time from the sum of sequential tests to the duration of the longest single test (45 minutes), provided the parallel actions are independent. By configuring the test stage with parallel actions, the team can achieve faster feedback without altering the underlying test logic or infrastructure.

Answer

Increase the compute capacity of the test environment

Answer

Use AWS CodeBuild batch builds with a single buildspec

Answer

Create multiple pipelines, each running a subset of tests

Question 15

Which TWO options are valid ways to trigger an AWS CodePipeline execution automatically?

Accepted Answer

Create an Amazon CloudWatch Events rule that starts the pipeline on a schedule.. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a cron or rate expression to trigger an AWS CodePipeline execution on a schedule. This is a native integration that directly starts the pipeline without requiring additional compute resources or custom code.

Answer

Use a git push to the repository via SSH.

Answer

Set up a manual approval step in the pipeline.

Answer

Enable AWS CodeBuild to start the pipeline after a build.

Question 16

A startup is using AWS CloudFormation to manage their infrastructure. They have a stack that creates an Amazon S3 bucket and an Amazon DynamoDB table. The stack was created successfully, but when they try to update the stack to add a new S3 bucket, the update fails with the error 'CREATE_FAILED - S3 bucket already exists'. The new bucket name is unique and does not exist. The template uses the same AWS::S3::Bucket resource type. What is the most likely cause?

Accepted Answer

The S3 bucket name was previously used and is still in the process of being deleted (bucket name not yet released).. S3 bucket names are globally unique across all AWS accounts and regions. When a bucket is deleted, its name is not immediately released — it enters a 'bucket name not yet available' state that can last from minutes to hours (historically up to 24 hours or longer). If the template tries to create a bucket with a name that was recently deleted, CloudFormation reports CREATE_FAILED with 'bucket already exists' even though the name appears unique to the user.

Answer

The IAM user does not have permission to create S3 buckets.

Answer

The stack is in a different region than where the bucket is being created.

Answer

The CloudFormation template uses the wrong resource type for the bucket.

Question 17

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover due to an availability zone outage. After the failover, the application team reports that the database endpoint is not resolving to the new primary. What is the most likely reason?

Accepted Answer

The application is using a cached DNS resolution that points to the old primary.. After an RDS Multi-AZ failover, the DNS CNAME record for the DB instance is updated to point to the new primary in the standby AZ. However, if the application or its DNS resolver has cached the previous DNS resolution, it will continue to use the old IP address, which is no longer reachable. This is a common issue that can be resolved by reducing the TTL on the DNS record or implementing retry logic with DNS re-resolution in the application.

Answer

The RDS CNAME record was not updated by AWS after the failover.

Answer

The application is using the read replica endpoint instead of the primary endpoint.

Answer

The application is using a Route 53 health check that failed and redirected traffic away from the endpoint.

Question 18

A company uses AWS CodePipeline with a GitHub source action. They want to automatically start the pipeline when a pull request is merged to the main branch. However, the pipeline also starts on every push to any branch. How can they limit the pipeline to only trigger on push events to the main branch?

Accepted Answer

Configure the source action's 'Branch' field to 'main' and set 'PollForSourceChanges' to false, and use a webhook with filters.. It configures the source action to only respond to push events on the main branch by setting the 'Branch' field to 'main' and disabling polling ('PollForSourceChanges': false), while using a webhook with branch filters. This ensures that only pushes to the main branch trigger the pipeline, not pushes to any other branch.

Answer

Use a Lambda function as a source action instead of GitHub.

Answer

Create a GitHub webhook manually and point it to a Lambda function that starts the pipeline only for main branch pushes.

Answer

Add a condition in the pipeline's first stage to check the branch name.

Question 19

A company is using AWS CodeCommit with multiple repositories. Developers are required to create pull requests for all changes, and the pull request must be associated with a JIRA issue key (e.g., PROJ-123) in the commit message. A DevOps engineer needs to enforce this policy automatically. Which approach meets the requirement with minimal operational overhead?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function to validate the pull request description and reject if missing JIRA key. CodeCommit triggers can invoke an AWS Lambda function on pull request events (e.g., created or updated). The Lambda function can parse the pull request description or commit messages for a JIRA key pattern (e.g., regex `[A-Z]+-\d+`) and, if missing, automatically reject the pull request by updating its status or adding a comment. This serverless approach enforces the policy without requiring any changes to developer workflows or additional infrastructure, minimizing operational overhead.

Answer

Store JIRA keys in an S3 bucket and configure a CloudWatch Events rule to check commits

Answer

Use AWS CodeBuild to run a validation script during the build phase

Answer

Require developers to install a pre-commit hook script locally

Question 20

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). Recently, deployments have been failing intermittently during the deploy stage with the error: 'The service has reached its maximum number of running tasks.' How should a DevOps engineer resolve this issue?

Accepted Answer

Update the ECS service configuration to increase the maximum number of tasks. The error 'The service has reached its maximum number of running tasks' indicates that the ECS service's desired count or maximum tasks (if using a placement constraint) has been hit. Updating the ECS service configuration to increase the maximum number of tasks (or the desired count) allows the deployment to proceed by accommodating the new tasks during a rolling update. This directly resolves the capacity limit that CodeDeploy encounters when trying to launch new tasks.

Answer

Increase the memory reservation for the task definition

Answer

Configure an Amazon ECS Service Auto Scaling policy to scale out

Answer

Increase the number of concurrent deployments allowed in CodeDeploy