DOP-C02 Practice Test 8 — 10 Questions

Question 1

An IAM policy is attached to a user. The user is trying to push a commit to the 'main' branch of the 'MyRepo' repository. The push is denied. What is the most likely reason?

Accepted Answer

The condition key 'codecommit:References' is not correctly formatted for an array value.. The condition key 'codecommit:References' must be formatted as an array value when used in an IAM policy to restrict pushes to specific branches. If the policy uses a string value instead of an array (e.g., 'refs/heads/main' instead of ['refs/heads/main']), the condition fails to match, and the push is denied even if the user has the 'codecommit:GitPush' action allowed. This is a common misconfiguration in IAM policies for CodeCommit.

Answer

The user does not have permission to push to any branch.

Answer

The policy does not allow the 'codecommit:GitPush' action for the main branch.

Answer

The resource ARN is incorrect.

Question 2

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The application is deployed to the instances using an in-place deployment. The instances are running Amazon Linux 2. What should the DevOps engineer check first?

Accepted Answer

Verify that the AWS CodeDeploy agent is installed and running on each EC2 instance.. The error message indicates that individual instances failed deployment, which is most commonly caused by the AWS CodeDeploy agent not running or not being installed on the EC2 instances. For an in-place deployment on Amazon Linux 2, the CodeDeploy agent must be installed and actively running to receive and execute deployment commands from the CodeDeploy service. If the agent is missing or stopped, the instance cannot participate in the deployment, leading to the 'too many individual instances failed' error.

Answer

Check the security group rules for the EC2 instances.

Answer

Check the application's port availability.

Answer

Verify that the IAM instance profile associated with the instances has the correct permissions.

Question 3

A company uses AWS CloudFormation to manage infrastructure. They have a nested stack that creates an ECS cluster. The parent stack fails with the error: 'The following resource(s) failed to create: [ECSCluster]'. Which TWO are possible causes? (Choose TWO.)

Accepted Answer

The parent stack's IAM role does not have permission to create the nested stack's resources. The parent stack's IAM role must have sufficient permissions to create all resources defined in the nested stack, including the ECS cluster. If the role lacks the necessary ECS actions (e.g., ecs:CreateCluster), CloudFormation will fail with the generic 'failed to create' error for the nested stack resource.

Answer

The parent stack is referencing an output from the nested stack that does not exist

Answer

The nested stack is in a different AWS region from the parent stack

Answer

The nested stack's name is not unique among all stacks in the account

Question 4

A company is using Amazon CloudWatch Synthetics canaries to monitor its web application endpoints. The canaries are failing intermittently with timeout errors. The DevOps team needs to troubleshoot the root cause. Which THREE actions should they take? (Select THREE.)

Accepted Answer

Increase the canary timeout configuration to allow more time for the endpoint to respond.. Options B, D, and E are correct. B: Increasing the canary timeout configuration can resolve timeout errors if the endpoint is slow but still functional. D: Reviewing VPC Flow Logs helps identify network issues such as dropped or denied requests that could cause timeouts. E: Examining canary logs in CloudWatch Logs provides detailed error messages and execution traces to pinpoint the failure cause. Option A is incorrect because CloudTrail records API calls, not canary execution details; canary logs are in CloudWatch Logs. Option C is incorrect because canaries run in AWS Lambda, not on EC2 instances, so EC2 CPU utilization is irrelevant.

Answer

Use AWS CloudTrail to review Canary API calls.

Answer

Check the EC2 instance CPU utilization in the VPC where the canaries run.

Question 5

Which TWO steps are required to set up a cross-account CI/CD pipeline where the source stage is in Account A (CodeCommit) and the deploy stage is in Account B (ECS)? (Choose 2.)

Accepted Answer

Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action.. For a cross-account CI/CD pipeline where the source stage (CodeCommit) is in Account A and the deploy stage (ECS) is in Account B, only two steps are required: 1) Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action (Option A). 2) Update the CodePipeline service role in Account A to include a trust policy that allows assuming the role in Account B (Option C). You do not need a KMS key in Account B; if the artifact bucket in Account A is encrypted with a customer-managed AWS KMS key, the key is in Account A and its policy must grant Account B's role kms:Decrypt, but that is not one of the required setup steps in the options. Option D is incorrect because the CodeCommit repository is in Account A, not Account B. Option E is incorrect because the pipeline artifact bucket should reside in Account A, not Account B.

Answer

Configure an AWS KMS key in Account B and share it with Account A for encrypting artifacts.

Answer

Create a resource-based policy on the CodeCommit repository in Account B that grants access to the CodePipeline service role in Account A.

Answer

Create an S3 bucket in Account B to store the artifacts and grant cross-account access.

Question 6

A DevOps team is designing a solution to encrypt data at rest for an Amazon RDS for MySQL database. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Use AWS KMS to create a customer managed key and assign it to the RDS instance. To encrypt data at rest for Amazon RDS for MySQL, encryption must be enabled when creating the DB instance (Option D) and a customer managed key from AWS KMS can be used (Option C). Option A is incorrect because you cannot enable encryption on an existing unencrypted RDS instance; it must be done at creation time. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest. Option E is incorrect because storing database files in an encrypted S3 bucket does not encrypt the RDS instance; RDS encryption is managed by AWS KMS and is enabled at the instance level.

Answer

Enable encryption after creating the RDS instance by modifying the instance

Answer

Enable SSL/TLS for the RDS instance

Answer

Store the database files in an encrypted S3 bucket

Question 7

A company uses AWS CodeBuild to build and test code. The build jobs need to access a private S3 bucket to download dependencies. Which THREE steps are required to securely grant access?

Accepted Answer

Configure the S3 bucket policy to allow access from the CodeBuild service principal. To grant CodeBuild access to an S3 bucket, you need an IAM role that allows the required actions, attach it to the CodeBuild project, and also ensure the bucket policy allows the role. KMS key is not required if SSE-S3 is used. VPC endpoint is optional.

Answer

Set up a VPC endpoint for S3

Answer

Create a KMS key and grant CodeBuild access to it

Question 8

A DevOps engineer is troubleshooting a production issue where an application's response time has increased. The application is deployed on Amazon ECS with Fargate. The engineer wants to identify which microservice is causing the latency. Which AWS service should be used?

Accepted Answer

AWS X-Ray to trace requests and analyze service latency.. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, allowing the engineer to pinpoint which service is introducing latency. By analyzing trace segments and subsegments, X-Ray can break down response times for each component in the application, directly addressing the need to identify the specific microservice causing the delay.

Answer

Amazon CloudWatch Synthetics canary to monitor the application endpoint.

Answer

Amazon CloudWatch Logs Insights to query application logs for errors.

Answer

Amazon CloudWatch ServiceLens to visualize service maps and traces.

Question 9

A company runs a critical e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group across three Availability Zones. The instances run a Java application that connects to an Amazon RDS Multi-AZ MySQL database. The application also uses Amazon ElastiCache for Redis for session caching. The company recently experienced a severe outage where the ALB's 5xx error rate spiked to 100% for 45 minutes. The root cause was a combination of a slow-running query on the RDS primary instance and a subsequent failover that caused the application to lose connections to the database. The failover happened because the slow query caused the primary to become unresponsive, triggering a Multi-AZ failover. During the failover, the application's connection pool exhausted, and new connections failed. The application logs show a high rate of 'java.sql.SQLTimeoutException' and 'com.mysql.cj.exceptions.CJCommunicationsException'. The DevOps team needs to implement a long-term solution that minimizes the impact of similar incidents. The solution must be cost-effective and require minimal application changes. Which combination of actions should the DevOps team take?

Accepted Answer

Implement Amazon RDS Proxy to manage database connections and add read replicas to offload read traffic.. Amazon RDS Proxy is the correct solution because it efficiently manages database connection pooling, reducing the likelihood of connection exhaustion during failovers. By maintaining a warm connection pool and automatically reconnecting to the new primary after a Multi-AZ failover, RDS Proxy minimizes application-side connection timeouts and errors like SQLTimeoutException and CJCommunicationsException. Adding read replicas offloads read traffic, reducing the load on the primary and mitigating the risk of slow queries causing unresponsiveness. This combination requires minimal application changes and is cost-effective compared to scaling the primary instance.

Answer

Use an Auto Scaling policy for EC2 based on RDS connection count and implement a read replica for the primary.

Answer

Configure Multi-AZ RDS with a synchronous standby and use Amazon RDS for MySQL with enhanced monitoring.

Answer

Increase the instance size of the RDS primary and enable Performance Insights to identify slow queries.

Question 10

A DevOps team wants to enforce that all EC2 instances launched in an AWS account have a specific tag 'Environment' with value 'Production' or 'Development'. The team uses AWS CloudFormation to provision resources. Which approach should the team use to enforce tagging compliance at launch?

Accepted Answer

Use an AWS Config rule with an auto-remediation action that applies the required tag to non-compliant resources.. AWS Config rules can evaluate EC2 instances for the presence of the 'Environment' tag with allowed values and, when combined with an auto-remediation action (e.g., using AWS Systems Manager Automation), can automatically apply the missing tag to non-compliant resources. This enforces tagging compliance at launch and throughout the resource lifecycle, even if the instance was launched without the tag. The auto-remediation action can be triggered as soon as the Config rule detects non-compliance, ensuring the tag is applied shortly after launch.

Answer

Configure a CloudFormation stack policy that denies stack updates if the tag is missing.

Answer

Add an IAM policy that denies ec2:RunInstances unless the request includes the required tag.

Answer

Create an AWS Service Catalog portfolio with a tag option constraint that requires the tag.