DOP-C02 Mock Exam 84 — 25 Questions

Question 1

A DevOps engineer uses AWS CloudFormation to manage infrastructure. The stack creation fails with the error: 'Circular dependency between resources'. The template includes an EC2 instance, an Elastic IP, and an internet gateway. The instance is associated with the Elastic IP, and the Elastic IP uses the internet gateway for the VPC. Which resource relationship is MOST likely causing the circular dependency?

Accepted Answer

The EC2 instance depends on the Elastic IP, and the Elastic IP depends on the EC2 instance.. Option C is correct because the circular dependency arises when the EC2 instance depends on the Elastic IP (via an Association resource) and the Elastic IP depends on the EC2 instance (via the InstanceId property). CloudFormation cannot resolve the creation order when two resources each require the other to exist first. This is a classic circular dependency in CloudFormation templates when using an AWS::EC2::EIP with an InstanceId that references the EC2 instance, while the instance itself has a DependsOn or a reference to the Elastic IP.

Answer

The security group depends on the EC2 instance, and the EC2 instance depends on the security group.

Answer

The Elastic IP depends on the internet gateway, and the internet gateway depends on the Elastic IP.

Answer

The internet gateway depends on the VPC, and the VPC depends on the internet gateway.

Question 2

A company uses AWS CloudFormation to deploy infrastructure. The DevOps team wants to receive notifications when a stack creation fails due to a resource limit exceeded error. Which approach should be used?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack, and subscribe an email endpoint.. Option B is correct because CloudFormation natively supports sending stack events (including creation failures) to an SNS topic. By configuring an SNS topic as a notification option in the stack creation request, the DevOps team can subscribe an email endpoint to receive real-time notifications when a resource limit exceeded error occurs, without needing additional services or custom logic.

Answer

Create an Amazon EventBridge rule that matches CloudFormation resource limit exceeded events and sends to SQS.

Answer

Use AWS Config to detect when a stack is in a failed state.

Answer

Enable CloudTrail and create a CloudWatch alarm on the CreateStack API call.

Question 3

A CloudFormation template snippet is shown. An engineer attempts to create a stack with this template and receives an error: 'Bucket my-unique-bucket-name already exists'. What is the most likely cause?

Accepted Answer

The S3 bucket name 'my-unique-bucket-name' is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts and regions. The error 'Bucket my-unique-bucket-name already exists' indicates that the name is already taken by another AWS account, not that the bucket already exists in the current account. CloudFormation cannot create the bucket because the name is not available in the global S3 namespace.

Answer

The bucket policy has a syntax error that prevents the bucket from being created.

Answer

The versioning configuration is incompatible with the bucket policy.

Answer

The bucket policy references the bucket name incorrectly, causing a circular dependency.

Question 4

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails because the new instances cannot connect to the database. The previous deployment succeeded. The DevOps engineer checks the CodeDeploy deployment configuration and finds that the deployment uses the 'CodeDeployDefault.AllAtOnce' configuration. What is the MOST likely cause of the failure?

Accepted Answer

The deployment replaced all instances at once, causing a temporary loss of connectivity if the new application version has incompatible changes.. The 'CodeDeployDefault.AllAtOnce' deployment configuration causes CodeDeploy to attempt to deploy the new application revision to all instances in the Auto Scaling group simultaneously. If the new application version contains incompatible changes—such as a database schema mismatch, altered connection strings, or missing environment variables—all instances will fail at the same time, resulting in a complete loss of connectivity to the database. This contrasts with a rolling or canary deployment, which would limit the blast radius by updating only a subset of instances at a time.

Answer

The load balancer health check is misconfigured, causing new instances to be deregistered.

Answer

The deployment group is not configured to handle traffic routing, causing a routing loop.

Answer

The security group for the Auto Scaling group was updated during deployment, blocking database access.

Question 5

A company is running a batch processing job on Amazon EMR that writes results to an Amazon S3 bucket. The job runs daily and takes about 2 hours. The DevOps team wants to be alerted if the job fails or takes longer than 3 hours. Which solution is the MOST cost-effective and operationally efficient?

Accepted Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function when the EMR cluster changes to 'TERMINATED' state, then check the job duration and send an alert if it exceeded 3 hours.. Option B is correct because it uses CloudWatch Events to detect the EMR cluster's 'TERMINATED' state, which triggers a Lambda function that can check the job duration against the 3-hour threshold and send an alert via SNS if needed. This approach is cost-effective (no polling, event-driven) and operationally efficient, as it decouples monitoring from the job itself and handles both failure and timeout scenarios without modifying the EMR job code.

Answer

Configure Amazon Simple Notification Service (SNS) directly from the EMR job to send notifications on completion.

Answer

Create a CloudWatch alarm on the EMR cluster's EC2 instance CPUUtilization metric to detect abnormal runtime.

Answer

Use Amazon CloudWatch Logs to monitor the job's log stream and create a metric filter for 'FAILED' messages.

Question 6

A DevOps engineer needs to set up a monitoring solution for an application running on Amazon EKS. The application emits custom metrics that need to be stored in Amazon CloudWatch and visualized on a dashboard. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Configure the CloudWatch agent to emit custom metrics to CloudWatch.. Option A is correct because the CloudWatch agent can be configured to emit custom application metrics to Amazon CloudWatch, which is the required destination for storing the metrics. The agent uses the CloudWatch PutMetricData API to send these metrics, enabling centralized monitoring and alerting within CloudWatch.

Answer

Use CloudWatch Logs Insights to analyze the custom metrics.

Answer

Use Amazon Managed Service for Prometheus to scrape the metrics.

Question 7

A DevOps team uses AWS OpsWorks for configuration management. They want to run a custom recipe on all instances in a layer during the setup lifecycle event. What should they do?

Accepted Answer

Assign the custom recipe to the Setup lifecycle event in the layer's Recipes settings.. In AWS OpsWorks, lifecycle events (Setup, Configure, Deploy, Undeploy, Shutdown) are predefined hooks that run Chef recipes on instances. To run a custom recipe during the Setup event on all instances in a layer, you must assign that recipe to the Setup lifecycle event in the layer's Recipes settings. This ensures the recipe executes automatically when an instance enters the online state after bootstrapping.

Answer

Add the recipe commands to the instance's user data.

Answer

Store the recipe in an S3 bucket and reference it in the stack configuration.

Answer

Define a custom lifecycle event in the stack settings.

Question 8

A company uses AWS Elastic Beanstalk to deploy a web application. The application requires environment-specific configuration values (database URL, API keys) that must be stored securely and rotated automatically. The team uses AWS Secrets Manager. Which configuration management strategy should the team implement to securely inject secrets into the Elastic Beanstalk environment?

Accepted Answer

Use an Elastic Beanstalk platform hook script that retrieves secrets from Secrets Manager and sets them as environment variables.. Option C is correct because Elastic Beanstalk platform hooks allow custom scripts to run during deployment, enabling retrieval of secrets from AWS Secrets Manager and setting them as environment variables before the application starts. This approach keeps secrets out of the environment configuration and supports automatic rotation by having the script fetch the latest secret value on each deployment.

Answer

Store the secrets in the Elastic Beanstalk environment configuration as plain text under 'aws:elasticbeanstalk:application:environment'.

Answer

Configure Secrets Manager to automatically push secrets to Elastic Beanstalk environment properties.

Answer

Use AWS CloudFormation dynamic references to inject secrets into the Elastic Beanstalk environment.

Question 9

A DevOps team wants to enforce that all EC2 instances launched in an AWS account have a specific tag 'Environment' with value 'Production' or 'Development'. The team uses AWS CloudFormation to provision resources. Which approach should the team use to enforce tagging compliance at launch?

Accepted Answer

Use an AWS Config rule with an auto-remediation action that applies the required tag to non-compliant resources.. Option D is correct because AWS Config rules can evaluate EC2 instances for the presence of the 'Environment' tag with allowed values and, when combined with an auto-remediation action (e.g., using AWS Systems Manager Automation), can automatically apply the missing tag to non-compliant resources. This enforces tagging compliance at launch and throughout the resource lifecycle, even if the instance was launched without the tag. The auto-remediation action can be triggered as soon as the Config rule detects non-compliance, ensuring the tag is applied shortly after launch.

Answer

Configure a CloudFormation stack policy that denies stack updates if the tag is missing.

Answer

Add an IAM policy that denies ec2:RunInstances unless the request includes the required tag.

Answer

Create an AWS Service Catalog portfolio with a tag option constraint that requires the tag.

Question 10

A DevOps engineer is responsible for managing infrastructure as code for multiple microservices. The team uses AWS CloudFormation and wants to reuse common resource definitions across multiple stacks. Which approach should the engineer use to promote reusability and reduce code duplication?

Accepted Answer

Develop CloudFormation modules that encapsulate common resource configurations and publish them in a registry.. Option D is correct because AWS CloudFormation modules allow you to encapsulate common resource configurations into reusable, versioned components that can be published in the CloudFormation registry. This promotes reusability and reduces code duplication across multiple stacks without the overhead of managing nested stack templates or manual copying.

Answer

Create nested stacks that include the common resources and pass parameters as needed.

Answer

Store the common resource definitions in an AWS CodeCommit repository and copy them into each template.

Answer

Use cross-stack references by exporting outputs from a central stack and importing them in other stacks.

Question 11

A DevOps engineer is creating a CloudFormation template to deploy a VPC with public and private subnets. The template uses the 'AWS::EC2::VPC' resource and two 'AWS::EC2::Subnet' resources. The engineer wants to ensure that the subnets are created in different Availability Zones. What is the best approach?

Accepted Answer

Use Fn::GetAZs function with Fn::Select to pick different AZs from the region's AZ list.. Option A is correct because Fn::GetAZs returns a list of all Availability Zones in the region, and Fn::Select allows you to pick specific indices from that list, ensuring each subnet is assigned a different AZ. This approach is dynamic and region-agnostic, so the template works across regions without hardcoding AZ names. It also avoids the risk of using the same AZ for both subnets, which would violate the requirement for high availability.

Answer

Use the CidrBlock property to define different AZs.

Answer

Use Fn::GetAZs function with a count of 2 to automatically assign different AZs.

Answer

Hardcode the Availability Zone names in the template.

Question 12

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The operations team wants to analyze application access logs and error rates. They need to identify the top IP addresses making requests, as well as the distribution of HTTP status codes over time. Which THREE steps should the team take to achieve this? (Select THREE.)

Accepted Answer

Enable access logs on the Application Load Balancer and store them in an Amazon S3 bucket.. Enabling access logs on the Application Load Balancer and storing them in an S3 bucket captures detailed HTTP request data, including client IPs, request paths, and HTTP status codes. This raw log data is essential for analyzing top IP addresses and status code distributions over time.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Enable VPC Flow Logs to capture IP traffic data.

Question 13

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to enforce a policy that prevents creating S3 buckets with public read access. They plan to use AWS CloudFormation StackSets to deploy a stack across all accounts. What is the BEST way to enforce this policy?

Accepted Answer

Create a service control policy (SCP) in the root organizational unit that denies the s3:PutBucketPublicAccessBlock action.. Option C is correct because a service control policy (SCP) applied at the root organizational unit in AWS Organizations can centrally deny the s3:PutBucketPublicAccessBlock action across all accounts, effectively preventing any user or role from disabling the bucket-level public access block settings. This approach works even if an IAM principal has full administrative permissions, as SCPs act as a guardrail that cannot be overridden by account-level policies. It enforces the policy at the organization level without requiring per-account configuration or modifying individual IAM users.

Answer

Use AWS CloudFormation Guard to validate templates before deployment and reject those with public access.

Answer

Create an IAM policy that denies s3:PutBucketAcl and attach it to all IAM users.

Answer

Create an S3 bucket policy in each account that denies public read access.

Question 14

Which THREE actions are best practices for managing secrets in AWS CloudFormation templates? (Choose three.)

Accepted Answer

Use AWS CloudFormation parameters with the NoEcho property set to true.. Option A is correct because setting the NoEcho property to true on a CloudFormation parameter prevents the parameter value from being returned in API calls or displayed in the console, which is a basic mechanism for masking secrets. However, this alone does not encrypt the value at rest or in transit, and the value is still passed as plaintext in the template, so it is considered a best practice only when combined with other secure methods like dynamic references.

Answer

Encrypt the CloudFormation template file with AWS KMS.

Answer

Store secrets as plaintext in the template parameters.

Question 15

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team needs to deploy a stack that includes a Lambda function and an S3 bucket. The Lambda function's code is stored in the S3 bucket. How can the team ensure that the Lambda function is created after the S3 bucket and the code is uploaded?

Accepted Answer

Use the DependsOn attribute on the Lambda function to depend on the S3 bucket.. Option D is correct because the DependsOn attribute explicitly instructs CloudFormation to create the S3 bucket before the Lambda function. Even though CloudFormation automatically determines resource dependencies for certain intrinsic functions, it does not infer dependencies based on code uploads. Using DependsOn ensures the bucket exists and the code is uploaded before the Lambda function is created, preventing a deployment failure when the Lambda references code that is not yet available.

Answer

Upload the code to the S3 bucket before creating the stack.

Answer

Use the Fn::GetAtt intrinsic function to retrieve the bucket name.

Answer

Define the S3 bucket resource before the Lambda function resource in the template.

Question 16

Which TWO tools can be used to manage configuration drift detection for AWS resources? (Choose two.)

Accepted Answer

AWS Config. AWS Config continuously monitors and records AWS resource configurations and can detect changes against desired baselines, enabling drift detection through rules and compliance checks. AWS CloudFormation Drift Detection directly compares the current state of a stack's resources with the expected template-defined state to identify configuration drift. Both tools provide native mechanisms to detect when resources deviate from their intended configuration.

Answer

AWS Systems Manager Inventory

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 17

A company is using AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets have encryption enabled. They need a preventive control that applies to all current and future accounts. Which approach should they use?

Accepted Answer

Use a service control policy (SCP) in the Organizations root to deny PutBucketEncryption actions when encryption settings do not include AES256 or aws:kms.. A service control policy (SCP) applied at the Organizations root can deny the creation or modification of S3 buckets that do not have encryption enabled, specifically requiring AES256 or aws:kms. This is a preventive control that applies to all current and future accounts in the organization, as SCPs are inherited by all accounts and cannot be overridden by IAM policies within those accounts.

Answer

Use AWS Config rules to detect unencrypted buckets and automatically apply encryption using a remediation action.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts when non-compliant buckets are created.

Answer

Create an IAM policy in each account that denies PutBucketEncryption unless encryption is enabled.

Question 18

A company uses AWS CloudFormation to deploy infrastructure. They want to enforce mandatory tags on all resources created by CloudFormation. Which TWO approaches can achieve this? (Choose TWO.)

Accepted Answer

Use CloudFormation stack tags that propagate to all resources in the stack.. Option A is correct because CloudFormation stack tags propagate to all resources that support tagging within the stack. When you specify tags at the stack level, CloudFormation automatically applies them to each resource it creates, ensuring mandatory tags are enforced without additional configuration.

Answer

Create an AWS Config rule to automatically tag resources after creation.

Answer

Add an IAM policy that denies cloudformation:CreateStack unless the template includes the required tags.

Answer

Enable AWS CloudTrail to log all API calls and monitor for untagged resources.

Question 19

A company runs a containerized application on Amazon ECS with Fargate. The application experiences intermittent failures due to resource exhaustion. The company wants to improve resilience by automatically replacing unhealthy tasks and scaling based on demand. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Configure ECS service auto scaling with a target tracking policy based on CPU utilization.. Option D is correct because ECS service auto scaling with a target tracking policy based on CPU utilization automatically adjusts the desired count of tasks to match demand, preventing resource exhaustion by scaling out when CPU is high and scaling in when low. This directly addresses the intermittent failures caused by resource exhaustion by ensuring sufficient task capacity during load spikes.

Answer

Enable cluster auto scaling to add more Fargate capacity.

Answer

Use an Auto Scaling group to manage the number of tasks.

Answer

Define a health check command in the task definition to restart unhealthy containers.

Question 20

A DevOps team wants to manage EC2 instance configurations using AWS Systems Manager. Which THREE capabilities of Systems Manager can be used to ensure instances are in a desired state? (Choose THREE.)

Accepted Answer

Run Command. Run Command (A) is correct because it allows you to remotely and securely execute scripts or commands across EC2 instances without needing SSH or RDP, using an SSM document (SSM Document) that defines the desired configuration actions. This capability directly enforces a desired state by running idempotent scripts on demand or on a schedule.

Answer

OpsCenter

Answer

Parameter Store