DOP-C02 Mock Exam 72 — 25 Questions

Question 1

A company is using AWS CodePipeline to deploy a web application across multiple AWS accounts using CloudFormation stack sets. The pipeline is in the tools account, and it deploys to production account. The security team requires that all CloudFormation changes to production account be reviewed and approved by a senior engineer. Which approach meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a manual approval step in the CodePipeline before the CloudFormation deployment stage.. Adding a manual approval step in CodePipeline before the CloudFormation deployment stage allows a senior engineer to review and approve changes, meeting the security requirement. Option A is incorrect because CloudTrail only logs actions after they occur and does not provide a review mechanism. Option B is incorrect because denying CloudFormation actions to all but a specific role would prevent the pipeline from deploying unless it uses that role, but it does not enforce a manual review process. Option D is incorrect because SCPs are preventive controls that block actions, not a mechanism for manual approval.

Answer

Use AWS CloudTrail to monitor deployments and send notifications for review.

Answer

Configure an IAM policy that denies CloudFormation actions in the production account except for a specific role used by the senior engineer.

Answer

Use a service control policy (SCP) to prevent CloudFormation changes from the tools account.

Question 2

A DevOps engineer is setting up a CI/CD pipeline for a Python application using AWS CodePipeline. The pipeline includes a build stage with CodeBuild and a deploy stage that runs an AWS CLI command to update a Lambda function. Which THREE steps are necessary to ensure the pipeline can update the Lambda function? (Choose 3)

Accepted Answer

Store the AWS CLI command in the buildspec file or as a separate script in the source repository.. The AWS CLI command to update the Lambda function must be defined in the buildspec file or as a script in the source repository so that CodeBuild can execute it during the deploy stage. This ensures the pipeline has the exact command to run, and it becomes part of the version-controlled build specification.

Answer

Configure a CloudWatch Events rule to trigger the pipeline when the Lambda function is updated.

Answer

Use AWS CodeDeploy instead of the AWS CLI to update the Lambda function.

Question 3

Refer to the exhibit. An IAM policy is attached to a CodePipeline service role. When the pipeline tries to start a CodeBuild project, it fails with an 'AccessDenied' error. The CodeBuild project uses a different service role (arn:aws:iam::123456789012:role/CodeBuildServiceRole2). What is the MOST likely cause?

Accepted Answer

The policy only allows iam:PassRole for a specific role ARN, but the CodeBuild project uses a different role.. When CodePipeline starts a CodeBuild project, it must pass the CodeBuild service role to CodeBuild using iam:PassRole. If the pipeline's service role policy only allows iam:PassRole for a specific role ARN (e.g., CodeBuildServiceRole1) but the CodeBuild project is configured with a different role (CodeBuildServiceRole2), the PassRole action will be denied, causing an AccessDenied error. This is the most likely cause because the error occurs at the start of the build, and the policy explicitly restricts the role that can be passed.

Answer

The policy has a condition on the s3 actions that is not satisfied.

Answer

The policy does not allow codebuild:StartBuild for the specific project.

Answer

The policy does not allow s3:GetObject on the artifact bucket.

Question 4

A company uses AWS CodePipeline with a manual approval stage before deploying to production. The approval notification is sent via Amazon SNS. The approvers report that they are not receiving the email notifications. What should the DevOps engineer check first?

Accepted Answer

Confirm that the email subscriptions to the SNS topic have been confirmed by clicking the link in the initial confirmation email.. Amazon SNS requires that email subscribers confirm their subscription by clicking the link in the initial confirmation email before they can receive notifications. If the approvers never confirmed the subscription, the SNS topic will not deliver any messages to them, even though the pipeline and IAM permissions are correctly configured. This is the most common cause of missing SNS email notifications and should be the first check.

Answer

Ensure that the IAM role for CodePipeline has permission to publish to the SNS topic.

Answer

Verify that the SNS topic's subscription has a filter policy that matches the approval event.

Answer

Check the email recipients' mailbox quota to see if it is full.

Question 5

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack creation. The stack creates an EC2 instance with a user data script that runs a configuration management tool. The instance launches successfully, but the user data script fails. How can the engineer retrieve the user data execution logs to debug the issue?

Accepted Answer

Access the instance via EC2 Instance Connect and check /var/log/cloud-init-output.log.. The user data script output is logged by cloud-init to /var/log/cloud-init-output.log on the EC2 instance. By using EC2 Instance Connect to access the instance, the engineer can directly read this log file to see the full execution output, including any error messages from the configuration management tool.

Answer

Use AWS CloudTrail to view the user data execution events.

Answer

Use AWS Systems Manager Run Command to retrieve the logs remotely.

Answer

Check the CloudWatch Logs group for the instance.

Question 6

A developer wants to grant an EC2 instance read-only access to a specific S3 bucket. Which AWS mechanism should they use to securely provide credentials to the instance?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.. IAM roles with instance profiles provide temporary, automatically rotated credentials to EC2 instances via the AWS STS service. This eliminates the need to hardcode or store long-term access keys on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the AMI.

Answer

Store AWS access keys in the EC2 user data script.

Answer

Retrieve the credentials from AWS Systems Manager Parameter Store using a custom script.

Question 7

A company is using AWS KMS to encrypt data at rest for S3 objects. The security team wants to rotate the KMS key annually. Which action should the team take to implement automatic key rotation?

Accepted Answer

Enable automatic key rotation when creating the KMS key. AWS KMS supports automatic annual key rotation for customer managed keys (CMKs) when enabled at creation or via the key's rotation configuration. Once enabled, KMS automatically rotates the key material every 365 days, creating a new backing key while retaining the old one for decryption of previously encrypted data. This satisfies the security team's requirement without manual intervention.

Answer

Create a new key manually each year and update the S3 bucket policy

Answer

Use AWS Certificate Manager (ACM) to rotate the KMS key

Answer

Use an AWS managed key, which rotates automatically every year

Question 8

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with the error 'UPDATE_ROLLBACK_FAILED'. What should the engineer do to resolve this?

Accepted Answer

Use the 'ContinueUpdateRollback' operation to fix the resource that caused the failure.. When a CloudFormation stack update fails and rollback also fails, the stack enters UPDATE_ROLLBACK_FAILED, a terminal state where CloudFormation cannot automatically recover. The ContinueUpdateRollback API operation tells CloudFormation to resume rolling back the stack, optionally skipping specific resources that are stuck, so the engineer can manually fix the problematic resource and then complete the rollback. This is the documented recovery path for this state.

Answer

Retry the stack update with the same parameters.

Answer

Delete the stack and recreate it.

Answer

Ignore the error and continue using the stack.

Question 9

A DevOps team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They need to ensure that sensitive configuration parameters such as database passwords are not stored in plaintext in the source code repository. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use AWS Systems Manager Parameter Store with secure strings, and reference them in the pipeline using parameter-store action.. AWS Systems Manager Parameter Store with secure strings provides a native, fully managed service for storing sensitive configuration data like database passwords. By using the parameter-store action in CodePipeline, the pipeline can retrieve the secure parameter at runtime without exposing it in the source code or requiring manual encryption/decryption logic, minimizing operational overhead.

Answer

Store the parameters in a separate encrypted Git repository and use Git submodules.

Answer

Use AWS KMS to encrypt the parameters and include the encrypted blob in the source code.

Answer

Store the parameters in an S3 bucket with server-side encryption, and have the pipeline download them.

Question 10

A team wants to automate the deployment of a serverless application using AWS SAM. They have a template.yaml file defining Lambda functions, an API Gateway, and a DynamoDB table. Which command should they use to build and deploy the application?

Accepted Answer

sam build && sam deploy. The correct command sequence is `sam build && sam deploy` because AWS SAM requires the `sam build` command to transform the SAM template into an AWS CloudFormation template with the necessary artifact packaging, and then `sam deploy` to create or update the stack. Option C is the only choice that performs both the build (which resolves local dependencies and prepares deployment artifacts) and the deployment step, which is essential for a serverless application defined in a SAM template.

Answer

aws cloudformation deploy --template-file template.yaml

Answer

sam package --output-template-file packaged.yaml

Answer

sam deploy --guided

Question 11

A company is using AWS CloudFormation to deploy infrastructure. An engineer needs to ensure that any changes to the production stack are reviewed and approved before they are applied. The engineer also wants to prevent unauthorized changes. Which solution should the engineer implement?

Accepted Answer

Use CloudFormation Change Sets and require manual approval to execute the change set.. CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact running resources before you apply them. By requiring manual approval to execute the change set, the engineer ensures that all modifications are reviewed and approved, preventing unauthorized changes. This directly meets the requirement for a review-and-approval workflow without introducing unnecessary complexity.

Answer

Use CloudFormation StackSets to manage the production stack across multiple accounts.

Answer

Use AWS Service Catalog to create a product for the stack and require approval for any portfolio changes.

Answer

Use AWS CodePipeline to deploy the stack and require manual approval at the deploy stage.

Question 12

A DevOps team has set up centralized logging for multiple AWS accounts using Amazon OpenSearch Service. The team uses CloudWatch cross-account observability to collect logs from various accounts into a monitoring account. Recently, logs from one source account stopped appearing in the monitoring account's OpenSearch dashboard. Other source accounts continue to send logs successfully. Which step should the team take to troubleshoot this issue?

Accepted Answer

Check the source account's CloudWatch Logs subscription filter for the OpenSearch destination.. The most likely cause of logs from a single source account failing to appear is a misconfigured or broken CloudWatch Logs subscription filter. This filter is responsible for forwarding log events from the source account to the OpenSearch destination in the monitoring account. If the filter is missing, misconfigured, or has been accidentally deleted, logs will not be sent, while other accounts continue to work normally.

Answer

Verify that the monitoring account's CloudWatch cross-account observability is enabled.

Answer

Review the source account's CloudWatch Logs retention policy to confirm logs are not expired.

Answer

Ensure the IAM role in the source account has the correct trust policy for the monitoring account.

Question 13

An Amazon RDS for PostgreSQL instance is running low on storage. The DevOps engineer needs to increase the allocated storage without downtime. Which action should be taken?

Accepted Answer

Modify the DB instance to increase the allocated storage.. Amazon RDS supports storage autoscaling and manual storage scaling by modifying the DB instance's allocated storage. Increasing allocated storage is an online operation that does not require downtime; RDS handles the underlying volume expansion transparently. This is the correct action to increase storage without downtime.

Answer

Modify the DB instance to a larger instance class.

Answer

Create a snapshot of the DB instance and restore it with larger storage.

Answer

Launch a new read replica with larger storage and promote it.

Question 14

A DevOps engineer is using AWS OpsWorks for configuration management. They need to ensure that custom recipes are applied to all instances in a layer in a specific order. What should the engineer do?

Accepted Answer

Assign the recipes to the appropriate lifecycle events in the layer configuration.. AWS OpsWorks uses lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) to control when custom recipes run on instances within a layer. By assigning recipes to the appropriate lifecycle events in the layer configuration, the engineer ensures they execute in the defined order for that event across all instances in the layer, which is the native mechanism for ordering in OpsWorks.

Answer

Use AWS CloudFormation Init with cfn-init to order the scripts.

Answer

Include all recipes in a single wrapper recipe and use include_recipe with the desired order.

Answer

Add the recipes to the instance's user data script.

Question 15

A company uses AWS Systems Manager to manage a fleet of EC2 instances. The operations team needs to run a script on all instances that are missing a specific security patch. Which Systems Manager capability should be used to accomplish this?

Accepted Answer

Run Command. Run Command lets you execute an SSM document (including an arbitrary shell/PowerShell script) once, on demand, against a targeted fleet of instances -- exactly what's needed to run a one-time remediation script across all instances missing a specific patch. It returns per-instance output/status immediately so you can confirm the script ran successfully. State Manager, by contrast, is built for enforcing a recurring/continuous desired state via scheduled associations and compliance tracking; since the requirement here is a single ad hoc script execution with no mention of an ongoing schedule or compliance reporting, State Manager would be unnecessary overhead.

Answer

Automation

Answer

State Manager

Answer

Patch Manager

Question 16

A company uses AWS CodeCommit and CodePipeline. The pipeline triggers on commits to the main branch. The DevOps engineer wants to add a stage that runs unit tests in a build environment. After the tests pass, the pipeline should deploy to a staging environment. If the tests fail, the pipeline should stop and notify the team. Which AWS service should be used to implement this workflow?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it can be integrated directly into a CodePipeline as a build action that runs unit tests in a managed build environment. When tests fail, CodeBuild can be configured to exit with a non-zero status, which causes CodePipeline to stop the execution and optionally trigger notifications via Amazon SNS or CloudWatch Events. This matches the requirement for a build stage that runs tests and conditionally proceeds or halts the pipeline.

Answer

AWS CodeStar

Answer

AWS Lambda

Answer

AWS CodeDeploy

Question 17

A DevOps team uses AWS CodePipeline to deploy a microservices application. The pipeline includes a CodeBuild project that runs unit tests. Recently, builds have been failing intermittently due to test timeouts. The team wants to improve the reliability of the pipeline without increasing the build timeout. Which action should the team take?

Accepted Answer

Configure the CodeBuild project to run tests in parallel by using separate build environments or test splits.. Running unit tests in parallel using separate build environments or test splits directly addresses intermittent timeouts by reducing the total execution time without increasing the build timeout. This approach leverages CodeBuild's ability to run multiple build jobs concurrently, distributing the test load and improving pipeline reliability.

Answer

Increase the build timeout to the maximum allowed value of 8 hours.

Answer

Use AWS CodeDeploy to run the unit tests on EC2 instances with more CPU and memory.

Answer

Modify the unit tests to be non-flaky by adding retries for network calls.

Question 18

A DevOps team is implementing a comprehensive logging strategy for a microservices architecture running on Amazon EKS. They need to collect logs from all containers and send them to a centralized log analytics platform. The solution must be agentless and support multi-line log events. Which approach should the team use?

Accepted Answer

Deploy a Fluent Bit DaemonSet on the EKS cluster and configure it to send logs to Amazon CloudWatch Logs.. Fluent Bit is a lightweight, CNCF-graduated log processor that can be deployed as a DaemonSet on EKS to collect logs from all nodes without requiring sidecar containers. It supports multi-line log events natively via its multiline filter plugin, and it can output directly to Amazon CloudWatch Logs using the cloudwatch_logs output plugin, meeting the agentless requirement since it runs as a Kubernetes DaemonSet rather than as a per-pod sidecar.

Answer

Use the Amazon CloudWatch agent as a sidecar container in each pod to forward logs to CloudWatch Logs.

Answer

Install the Amazon Kinesis Agent on each EC2 instance and configure it to stream logs to Amazon Kinesis Data Firehose.

Answer

Deploy a Fluentd DaemonSet on the EKS cluster and configure it to send logs to Amazon S3.

Question 19

A developer is troubleshooting a failed CodeBuild build. The build is triggered by a pull request from a forked repository. The buildspec includes a command to fetch pull request references. What is the most likely cause of the failure?

Accepted Answer

The CodeBuild project is not configured to allow pull requests from forked repositories.. When a build is triggered by a pull request from a forked repository, CodeBuild requires explicit configuration to allow builds from forks. By default, CodeBuild projects do not accept webhook events from forked repositories. The error occurs because the project lacks the 'Allow pull requests from forked repositories' setting enabled, even though the IAM role and buildspec may be correctly configured.

Answer

The IAM role for CodeBuild does not have permission to read from the repository.

Answer

The buildspec file is not present in the source code.

Answer

The buildspec contains invalid syntax.

Question 20

A company uses AWS CloudTrail to monitor API activity. During an incident, they need to quickly identify any unauthorized IAM role assumption attempts. Which CloudTrail feature should be used to filter and alert on this specific event?

Accepted Answer

Enable CloudTrail Insights to detect anomalous AssumeRole events.. CloudTrail Insights automatically analyzes management events to detect unusual activity, such as spikes in AssumeRole calls, without requiring manual filter configuration. This feature uses machine learning to establish a baseline and then alerts on deviations, making it ideal for quickly identifying unauthorized role assumption attempts during an incident.

Answer

Configure VPC Flow Logs to capture traffic to the IAM endpoint.

Answer

Use S3 event notifications on the CloudTrail bucket for PutObject events.

Answer

Set up a CloudWatch Logs metric filter on the CloudTrail log group for 'AssumeRole' events.