DOP-C02 Practice Test 9 — 10 Questions

Question 1

An organization uses AWS CloudFormation to manage infrastructure. During an incident, a stack update fails with 'UPDATE_ROLLBACK_FAILED' status. The engineer needs to bring the stack to a consistent state without losing data. What is the BEST approach?

Accepted Answer

Use the 'ContinueUpdateRollback' API to skip the resource that caused the failure.. The 'ContinueUpdateRollback' API is the best approach because it allows the stack to resume the rollback process, skipping the resource that caused the failure, and bringing the stack to a consistent 'UPDATE_ROLLBACK_COMPLETE' state without manual intervention or data loss. This API is specifically designed for the 'UPDATE_ROLLBACK_FAILED' status, enabling you to skip resources that cannot be rolled back (e.g., due to a non-reversible change) while preserving the rest of the stack's state.

Answer

Create a new stack from the same template and migrate resources.

Answer

Manually correct the resource configuration that caused the failure, then perform a stack update.

Answer

Delete the stack and then recreate it from the same template.

Question 2

A company uses AWS CloudFormation to manage infrastructure. They need to implement a CI/CD pipeline that automatically updates CloudFormation stacks when changes are pushed to a CodeCommit repository. The pipeline must use change sets to review changes before execution. Which pipeline configuration meets these requirements?

Accepted Answer

Use a CloudFormation action with action mode 'CHANGE_SET_REPLACEMENT' and then a separate action with mode 'CHANGE_SET_EXECUTE' after an approval step.. Option B is correct because CodePipeline's CloudFormation deployment action supports a 'CHANGE_SET_REPLACEMENT' mode that creates or replaces a change set without executing it, followed by a 'CHANGE_SET_EXECUTE' action that applies the change set after an approval step. This two-step approach allows teams to review infrastructure changes before they are applied, meeting the requirement to use change sets for review before execution.

Answer

Use a CloudFormation action in CodePipeline with action mode 'CREATE_UPDATE' and include a manual approval step before the action.

Answer

Use an AWS Lambda function to create a change set and trigger a manual approval via SNS.

Answer

Use a CloudFormation action with action mode 'CREATE_UPDATE' and set the 'Review' flag to true.

Question 3

Which AWS service is primarily used to automate the building, testing, and deployment of code changes to AWS infrastructure based on a defined release process?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the building, testing, and deployment of code changes through a defined release process. It integrates with source control (e.g., CodeCommit, GitHub), build services (e.g., CodeBuild), and deployment services (e.g., CodeDeploy) to automate the entire pipeline from commit to production.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 4

A DevOps team is designing a deployment pipeline for a microservices application on Amazon ECS using AWS CodePipeline. They want to implement a canary deployment strategy where a small percentage of traffic is routed to the new version before fully promoting it. Which AWS service or feature should they use to achieve this?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment. AWS CodeDeploy with ECS blue/green deployment is the correct choice because it natively supports canary traffic shifting for Amazon ECS services. When integrated with AWS CodePipeline, CodeDeploy can route a small percentage of traffic (e.g., 10%) to the new task set, monitor it with CloudWatch alarms, and then automatically shift the remaining traffic after a specified interval. This is the only option that directly provides the canary deployment lifecycle within the ECS and CodePipeline context.

Answer

Amazon ECS Service Auto Scaling

Answer

Amazon Route 53 weighted routing

Answer

AWS App Mesh with traffic shifting

Question 5

A DevOps engineer is troubleshooting an Amazon RDS for PostgreSQL instance that is running out of storage. The engineer wants to resolve the issue without downtime. Which TWO actions can achieve this? (Choose two.)

Accepted Answer

Enable storage auto scaling on the DB instance.. Option B is correct because enabling storage auto scaling on an Amazon RDS for PostgreSQL instance allows the database to automatically increase its allocated storage when it detects that available storage is running low, preventing out-of-storage errors without requiring manual intervention or downtime. Option E is correct because modifying the DB instance to increase the allocated storage size is a dynamic operation that can be performed without downtime, as Amazon RDS supports online storage scaling for PostgreSQL instances, allowing the change to take effect while the database remains available.

Answer

Create a read replica and promote it to primary.

Answer

Delete old automated snapshots to free up storage.

Answer

Scale up the DB instance to a larger instance class.

Question 6

A DevOps team observes that an Amazon CloudFront distribution is returning HTTP 504 errors for a small percentage of requests. The origin is an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The team has already checked the ALB's access logs and found that the ALB returns 200 OK for all requests. What should the team investigate NEXT?

Accepted Answer

Check the ALB's idle timeout settings and compare with CloudFront origin timeout.. The ALB returns 200 OK for all requests, so the origin itself is not failing. However, HTTP 504 errors from CloudFront typically indicate that the origin (ALB) is not responding within CloudFront's timeout window. The ALB's idle timeout (default 60 seconds) can cause the ALB to close idle connections, while CloudFront's origin timeout (default 30 seconds) is separate. If the ALB's idle timeout is shorter than the time CloudFront waits for a response, the ALB may close the connection before CloudFront receives the full response, leading to a 504. Option D directly addresses this mismatch.

Answer

Check the ALB target group health check settings and ensure instances are healthy.

Answer

Examine the request headers in CloudFront logs to identify unusual patterns.

Answer

Review the CloudFront cache hit ratio and optimize caching strategies.

Question 7

A company uses AWS CodeDeploy for deploying applications to an Auto Scaling group of Amazon EC2 instances. The deployment is failing with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which two actions should the DevOps engineer take to troubleshoot and resolve the issue? (Choose two.)

Accepted Answer

Check the CodeDeploy agent logs on the failed instances to identify script errors or missing dependencies.. Option A is correct because the CodeDeploy agent logs on each EC2 instance contain detailed error messages about script failures, missing dependencies, or permission issues that cause the deployment to fail. Checking these logs is the first step in diagnosing why individual instances are failing, as the agent executes the AppSpec lifecycle hooks and reports back to the CodeDeploy service.

Answer

Increase the size of the Auto Scaling group to ensure more instances are available.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce' to bypass the error.

Answer

Redeploy the application using a different revision.

Question 8

A DevOps engineer is investigating an incident where an EC2 instance became unreachable. The engineer checks the AWS Management Console and finds the instance is running, but the status check shows '2/2 checks passed' and the system log shows no errors. What should the engineer do NEXT to diagnose the connectivity issue?

Accepted Answer

Check the security group and network ACL rules to ensure inbound traffic is allowed.. Since the instance is running, status checks pass, and the system log shows no errors, the issue is not with the operating system or underlying hardware. The most likely cause is a network-layer restriction, such as security group or network ACL rules blocking inbound traffic. Checking these rules is the correct next step because they control traffic at the instance and subnet levels, respectively, and misconfigurations here are a common cause of unreachability despite healthy instance status.

Answer

Review the CloudWatch metrics for CPU utilization and network throughput.

Answer

Reboot the instance to reset the network interface.

Answer

Stop and start the instance to move it to new underlying hardware.

Question 9

A company uses AWS Organizations with multiple accounts. The security team notices that an IAM user in the production account has been making changes to security group rules that are not compliant with the company's policy. The team wants to automatically revoke any non-compliant security group rules and notify the security team. What is the MOST efficient way to achieve this?

Accepted Answer

Use an AWS Config managed rule to detect non-compliant security group rules, and configure an automatic remediation action with AWS Systems Manager Automation.. Option D is correct because AWS Config managed rules can continuously evaluate security group rules against a desired policy (e.g., disallowing SSH from 0.0.0.0/0). When a non-compliant change is detected, AWS Config can trigger an automatic remediation action using an AWS Systems Manager Automation document that revokes the offending rule. This provides both detection and automated correction without manual intervention, making it the most efficient solution.

Answer

Create a CloudWatch alarm on the SecurityGroupEvent metric to notify the security team.

Answer

Apply a Service Control Policy (SCP) that denies changes to security groups in the production account.

Answer

Set up a CloudTrail trail that logs security group modifications and use Amazon Detective to analyze the changes.

Question 10

A company has an AWS Lambda function that processes S3 events. The function is invoked multiple times for the same S3 object, causing duplicate processing. The engineer suspects the issue is related to retries from the S3 event notification or Lambda's built-in retry behavior. What is the MOST effective way to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store a record of processed S3 object keys and check for existence before processing.. Option B is correct because storing processed S3 object keys in a DynamoDB table and checking for existence before processing ensures idempotency at the application level. This approach directly handles duplicate invocations caused by S3 event retries or Lambda's built-in retry behavior, as the function can conditionally skip processing if the key already exists in DynamoDB. It provides a durable, consistent, and scalable mechanism to prevent duplicate processing regardless of how many times the function is invoked for the same object.

Answer

Modify the S3 bucket event notification configuration to use a prefix filter that excludes duplicate objects.

Answer

Set the Lambda function's ReservedConcurrency to 1 to prevent concurrent executions.

Answer

Use an Amazon SQS FIFO queue as the event source and enable content-based deduplication.