DOP-C02 Practice Exam 61 — 20 Questions

Question 1

A team is using AWS CloudFormation to manage infrastructure. They want to implement a change management process where any modifications to the stack must be reviewed and approved. Which feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change Sets. Change Sets allow you to preview how proposed changes to a CloudFormation stack will impact your running resources before you execute them. This enables a review-and-approve workflow because you can generate a change set, have a team member or automated process inspect the list of resource additions, modifications, or deletions, and then either execute or discard the change set. This directly supports the required change management process.

Answer

StackSets

Answer

Drift Detection

Answer

Stack Policy

Question 2

A financial services company is migrating its applications to AWS. The compliance team requires that all Amazon S3 buckets containing personally identifiable information (PII) must have server-side encryption enabled and block public access. The DevOps team discovers that some S3 buckets are not compliant. Which TWO actions should the team take to enforce these requirements automatically for all current and future buckets? (Select TWO.)

Accepted Answer

Use AWS Config managed rules to detect noncompliant buckets and automatically remediate by applying encryption and blocking public access.. To enforce these requirements automatically for all current and future buckets, the team should use AWS Config managed rules (e.g., s3-bucket-server-side-encryption-enabled and s3-bucket-public-read-prohibited) with auto-remediation to detect and automatically fix noncompliant buckets (option B). Additionally, an SCP that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions when the required settings are not specified prevents noncompliant buckets from being created in the first place across all accounts (option E). Together, these provide preventive and corrective controls for all existing and future buckets.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts when noncompliant buckets are created.

Answer

Attach an IAM permissions boundary to all users that prevents them from creating or modifying S3 buckets.

Answer

Apply an S3 bucket policy to each existing bucket that denies all access unless encryption is enabled.

Question 3

A company wants to ensure that its Amazon S3 bucket is resilient to accidental deletion of objects. Which TWO actions should be taken?

Accepted Answer

Enable MFA Delete on the bucket.. Enabling MFA Delete on an S3 bucket requires multi-factor authentication for any delete operations, including object version deletion and bucket deletion. This adds a critical layer of protection against accidental or unauthorized deletions, as the user must present both their AWS credentials and a valid MFA code to perform these destructive actions.

Answer

Enable S3 Object Lock.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure a lifecycle policy to expire objects after 30 days.

Question 4

A company uses AWS OpsWorks for configuration management of a fleet of EC2 instances running a legacy application. The operations team needs to deploy a new version of the application across all instances without causing downtime. The application runs on each instance and requires a rolling update. Which approach should the team use?

Accepted Answer

Use the OpsWorks Deploy command to trigger a rolling update across the stack.. AWS OpsWorks provides a Deploy command that can perform rolling updates across instances in a stack. This command allows you to deploy application code or configuration changes in a controlled manner, updating instances in batches to avoid downtime. It is the native OpsWorks mechanism for rolling deployments, aligning with the requirement to update all instances without downtime.

Answer

Use AWS CodeDeploy to perform a blue/green deployment on the existing instances.

Answer

Create a new Auto Scaling group with the updated AMI and terminate old instances.

Answer

Manually update each instance by adding a new layer and reassigning instances.

Question 5

A DevOps team is configuring CloudWatch alarms for their production environment. They want to receive notifications when the CPUUtilization metric of an EC2 instance exceeds 90% for three consecutive 5-minute periods. Which combination of settings should they use?

Accepted Answer

Period: 5 minutes; Evaluation periods: 3; Datapoints to alarm: 3. To alarm when CPUUtilization exceeds 90% for three consecutive 5-minute periods, you need a period of 5 minutes, evaluation periods of 3, and datapoints to alarm of 3. This means CloudWatch evaluates the metric over three consecutive periods, and all three must breach the threshold to trigger the alarm. This configuration exactly matches the requirement.

Answer

Period: 5 minutes; Evaluation periods: 3; Datapoints to alarm: 1

Answer

Period: 5 minutes; Evaluation periods: 1; Datapoints to alarm: 3

Answer

Period: 5 minutes; Evaluation periods: 5; Datapoints to alarm: 3

Question 6

A company is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from GitHub, a build stage using AWS CodeBuild, and a deploy stage using AWS Elastic Beanstalk. The team wants to ensure that the pipeline only proceeds if the code quality checks pass and unit tests are successful. Which TWO actions should be taken?

Accepted Answer

Add a test stage in the pipeline with a CodeBuild action that runs code quality and unit tests.. Adding a dedicated test stage with a CodeBuild action allows the pipeline to explicitly run code quality checks and unit tests as a separate, visible step. This ensures the pipeline only proceeds to deployment if these tests pass, as CodeBuild can be configured to fail the action on non-zero exit codes from test commands. Option C is also correct because modifying the buildspec file in the existing build stage to include test commands and setting the build to fail on test failures integrates quality gates directly into the build process, which is a common and valid approach for enforcing test success before deployment.

Answer

Add a manual approval step before the deploy stage.

Answer

Configure the source stage to use an S3 bucket and add a test action.

Answer

Use AWS CloudFormation to create a test environment and run tests.

Question 7

Which TWO criteria must be met for an AWS CloudFormation stack update to be successful? (Choose 2.)

Accepted Answer

The update template must be valid and must not contain any syntax errors.. AWS CloudFormation validates the template syntax and structure before initiating any stack update. If the template contains invalid JSON or YAML, references nonexistent resources, or violates intrinsic function rules, the update request is rejected immediately. This validation ensures that only syntactically correct templates proceed to the update operation.

Answer

The stack must be in a steady state with no previous failed updates.

Answer

A change set must be created and executed before the update.

Answer

The stack must have no drift detected.

Question 8

A company runs a containerized application on Amazon EKS. The application must be highly available across multiple Availability Zones and must automatically recover from node failures. Which THREE steps should be taken?

Accepted Answer

Use Pod Disruption Budgets to ensure a minimum number of pods are available during voluntary disruptions.. Pod Disruption Budgets (PDBs) are correct because they allow you to specify the minimum number of pods that must remain available during voluntary disruptions, such as node drains or cluster upgrades. This ensures that the application maintains high availability even when Kubernetes performs planned maintenance, preventing all replicas from being taken down simultaneously.

Answer

Deploy worker nodes in a single Availability Zone to reduce cross-AZ data transfer costs.

Answer

Use a single large instance type for all worker nodes to simplify management.

Question 9

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a parameter for the instance type of EC2 instances. The DevOps team wants to restrict the allowed values to a specific set of instance types. Which CloudFormation section should be used?

Accepted Answer

Parameters with AllowedValues. The Parameters section in AWS CloudFormation allows you to define input values that can be supplied at stack creation or update time. By specifying an AllowedValues constraint on a parameter, you restrict the user to select only from a predefined list of instance types, which enforces compliance and prevents misconfiguration. This is the correct mechanism for limiting instance type choices in a CloudFormation template.

Answer

Outputs

Answer

Conditions

Answer

Mappings

Question 10

A DevOps team uses AWS CodePipeline to deploy a web application. The pipeline has a manual approval step. During an incident, the deployment is stuck at the approval step because the approver is on leave. The team needs to unblock the pipeline quickly. What is the BEST action to take?

Accepted Answer

Use the CodePipeline console to approve the action directly as a different user.. In AWS CodePipeline, a manual approval action can be approved by any IAM user with the appropriate permissions, not just the designated approver. Using the console to approve as a different user is the quickest way to unblock the pipeline without modifying the pipeline structure. This action is immediate and preserves the pipeline's integrity.

Answer

Update the pipeline definition to remove the manual approval step temporarily.

Answer

Disable the transition to the approval stage and manually run the remaining stages.

Answer

Retry the action in the approval stage from the CodePipeline console.

Question 11

A DevOps engineer needs to rotate database credentials stored in AWS Secrets Manager automatically every 30 days. What is the simplest way to achieve this?

Accepted Answer

Enable automatic rotation in Secrets Manager with a rotation interval of 30 days.. AWS Secrets Manager has built-in automatic rotation: you enable it on the secret, specify a rotation interval (e.g., 30 days), and provide a Lambda rotation function (AWS provides templates for RDS, Redshift, DocumentDB). This is the simplest, fully managed approach and requires no custom scheduling infrastructure.

Answer

Store the credentials in Systems Manager Parameter Store and use a scheduled automation to update them.

Answer

Create a CloudWatch Events rule that triggers a Lambda function to rotate the secret.

Answer

Write a custom Lambda function that rotates the secret and schedule it with CloudWatch Events.

Question 12

Which TWO AWS services can be used to distribute incoming traffic across multiple AWS resources in different Availability Zones within a single region?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator uses the AWS global network and Anycast static IP addresses to route incoming traffic to the optimal endpoint, such as an Application Load Balancer or EC2 instance, across multiple Availability Zones within a single region. It improves performance and reliability by directing traffic to the healthiest endpoint and automatically rerouting in case of failure, making it a valid service for distributing traffic across AZs.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

AWS Direct Connect

Question 13

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. How can this be achieved with minimal overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'CreateAccessKey' event and targets an SNS topic.. D is correct because Amazon EventBridge can capture real-time CloudTrail API events, such as 'CreateAccessKey', and route them directly to an SNS topic for immediate notification. This approach requires no polling, no custom code, and minimal overhead, as EventBridge handles event matching and delivery natively.

Answer

Use CloudWatch Logs Insights to run a query every hour and send results via email.

Answer

Set up an AWS Config rule to detect when an access key is created.

Answer

Configure S3 event notifications on the CloudTrail bucket to trigger a Lambda function.

Question 14

An organization uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon S3 bucket with a bucket policy that restricts access to a specific IAM role. During a recent security audit, it was discovered that the bucket policy was modified manually via the AWS Management Console, and the change was not reflected in the CloudFormation template. The security team wants to detect and remediate such drift automatically. Which combination of steps should be taken to achieve this?

Accepted Answer

Enable drift detection on the CloudFormation stack and use Amazon EventBridge to trigger an AWS Lambda function that restores the original bucket policy when drift is detected.. It directly addresses the requirement to both detect and automatically remediate drift in a CloudFormation-managed S3 bucket policy. CloudFormation drift detection identifies manual changes to the bucket policy, and Amazon EventBridge can trigger an AWS Lambda function that uses the CloudFormation UpdateStack API to restore the original policy from the template, ensuring the infrastructure remains in sync with the IaC definition.

Answer

Use AWS CloudTrail to monitor PutBucketPolicy events and send alerts to the security team via Amazon SNS.

Answer

Create an AWS Config rule to check if the bucket policy matches the desired policy, and use an AWS Lambda function to automatically correct any noncompliant buckets.

Answer

Configure S3 event notifications to invoke an AWS Lambda function whenever the bucket policy is modified.

Question 15

Which THREE actions should be taken to ensure that an AWS CloudFormation stack update does not cause downtime for a production application that runs on an Auto Scaling group behind an Application Load Balancer? (Select THREE.)

Accepted Answer

Configure an 'UpdateWaitCondition' in the CloudFormation template to pause the stack update until a healthy signal is received from the new instances.. An 'UpdateWaitCondition' in a CloudFormation template can pause the stack update until a healthy signal is received from the new instances. This ensures that the update proceeds only after the new instances have passed health checks, preventing premature traffic routing and potential downtime.

Answer

Add a custom resource that triggers an AWS Lambda function to take a snapshot of the database before the update.

Answer

Ensure that the Auto Scaling group spans at least three Availability Zones to distribute instances.

Question 16

An application running on Amazon ECS Fargate is experiencing intermittent HTTP 503 errors from the Application Load Balancer (ALB). The target group health checks are passing. Which configuration is MOST likely causing this issue?

Accepted Answer

The deregistration delay is set too short, causing connections to be closed before requests complete.. The intermittent HTTP 503 errors from the ALB, despite health checks passing, indicate that the target (ECS Fargate task) is being deregistered while still processing active requests. A deregistration delay that is too short causes the ALB to close connections to the target before the application has finished responding, resulting in 503 errors for in-flight requests. The default deregistration delay is 300 seconds; setting it too low (e.g., 5 seconds) can cause this issue.

Answer

The ALB's slow start duration is too long, causing requests to be dropped.

Answer

The health check interval is set too low, causing targets to be marked unhealthy prematurely.

Answer

The ALB's circuit breaker is tripping due to high error rates.

Question 17

A company uses AWS CloudFormation to deploy a multi-tier application. The template includes an Amazon RDS DB instance. The DevOps team wants to update the DB instance class without downtime. What should they do?

Accepted Answer

Modify the DB instance class using an RDS blue/green deployment, then update the CloudFormation stack to match the new class.. RDS blue/green deployments allow you to make changes (such as modifying the DB instance class) with minimal downtime by creating a staging environment that mirrors the production environment. After the change is applied and verified, the blue/green deployment switches traffic to the new environment, ensuring zero or near-zero downtime. Subsequently, updating the CloudFormation stack to match the new class keeps the infrastructure code in sync with the actual deployed resources.

Answer

Use a CloudFormation stack update with a 'ReplaceOnDelete' deletion policy on the DB instance.

Answer

Create a new DB instance with the new class, update the application to point to the new endpoint, and delete the old instance.

Answer

Update the DBInstanceClass property in the CloudFormation template and set 'ApplyImmediately: true'.

Question 18

An application running on AWS Lambda is experiencing increased error rates. The DevOps engineer needs to quickly identify the root cause. Which AWS service should the engineer use to analyze the logs and errors?

Accepted Answer

AWS X-Ray. AWS X-Ray is designed for distributed tracing and root-cause analysis of application errors, including Lambda functions. It captures traces, errors, and latency data across services, making it the right tool to quickly identify where failures originate in a Lambda-based application.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail

Question 19

A company uses DynamoDB global tables with two regions. They notice that writes in one region are not replicating to the other region after a brief network partition. Which configuration will ensure replication resumes automatically?

Accepted Answer

No action needed; DynamoDB automatically resumes replication when connectivity is restored.. DynamoDB global tables use a last-writer-wins (LWW) conflict resolution mechanism and are designed to handle temporary network partitions. When connectivity is restored, DynamoDB automatically resumes replication of pending writes using its internal replication engine, which is built on DynamoDB Streams. No manual intervention is required because the service manages eventual consistency across regions.

Answer

Use DynamoDB Streams with a Lambda function to manually replicate writes.

Answer

Manually fail over the table to the other region.

Answer

Delete the replica table and recreate it.

Question 20

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with a 'HealthCheckFailed' error. The application is running, but the health check endpoint returns HTTP 500. What should the team do to resolve this issue?

Accepted Answer

Modify the application to handle the health check endpoint correctly and return HTTP 200.. The health check endpoint returns HTTP 500, indicating the application is not functioning correctly despite running. CodeDeploy uses the health check endpoint to verify the application is healthy after deployment; returning HTTP 200 is required for the deployment to succeed. The team must fix the application code to properly handle the health check endpoint and return a successful status.

Answer

Change the deployment configuration to use AllAtOnce to avoid health checks.

Answer

Increase the health check grace period in the Auto Scaling group.

Answer

Disable the health check in the CodeDeploy deployment configuration.