DOP-C02 Practice Test 9 — 10 Questions

Question 1

A security engineer is designing a secure VPC architecture for a web application. The application must be isolated from the internet and only accessible through a load balancer. Which TWO actions should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the EC2 instances in a private subnet with no internet gateway attachment.. Placing EC2 instances in a private subnet without an internet gateway ensures they have no direct path to the internet, meeting the isolation requirement. This forces all traffic to and from the instances to go through the load balancer, which is the only entry point for the application.

Answer

Attach an Internet Gateway to the VPC and route the private subnet to it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic on all ephemeral ports.

Answer

Set up an AWS Direct Connect connection for the instances to access the internet.

Question 2

A DevOps engineer is configuring a centralized logging solution using Amazon CloudWatch Logs. They need to ensure that logs from multiple AWS accounts are aggregated into a single CloudWatch Logs account. Which approach meets this requirement?

Accepted Answer

Create a subscription filter in each account that delivers log events to a CloudWatch Logs destination in the central account.. CloudWatch Logs supports cross-account subscription filters that can deliver log events to a CloudWatch Logs destination in a central account. The destination is a logical resource that points to a Kinesis Data Stream or Lambda function in the central account, and the source account creates a subscription filter that sends matching log events to that destination. This allows centralized aggregation without requiring each account to manage separate streaming infrastructure.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket, then use Amazon Athena to query.

Answer

Set up a cross-account destination using an Amazon Kinesis Data Streams stream in the central account and configure each account to send logs to that stream.

Answer

Configure each application to use the PutLogEvents API to send logs directly to the central account's log group.

Question 3

A DevOps engineer is creating a CodePipeline service role. The above IAM policy is attached to the role. The pipeline fails when trying to download artifacts from the S3 bucket. What is the issue?

Accepted Answer

The policy is missing s3:ListBucket permission on the bucket.. The pipeline fails because the IAM policy grants s3:GetObject on the object ARN but lacks s3:ListBucket on the bucket ARN. CodePipeline's S3 artifact download action first calls ListBucket to verify the bucket exists and the object key is accessible before performing the GetObject call. Without s3:ListBucket, the initial validation fails, causing the pipeline to error out even though GetObject is allowed.

Answer

The Resource for S3 actions should be the bucket ARN, not the object ARN.

Answer

The CodeDeploy actions require a specific resource ARN instead of '*'.

Answer

The Action list is missing s3:GetObjectVersion.

Question 4

A team uses AWS CodePipeline with multiple parallel actions in a stage. They notice that when one action fails, the entire stage fails and no further actions are attempted. They want the pipeline to continue with the remaining actions even if one fails, and then report the failure at the end. Which feature should they use?

Accepted Answer

Configure each action with 'On failure' set to 'CONTINUE'.. AWS CodePipeline allows you to set the 'On failure' property for each action to 'CONTINUE', which instructs the pipeline to proceed with subsequent actions even if that specific action fails. This ensures that all parallel actions in the stage are attempted, and the overall stage status reflects any failures at the end, rather than aborting immediately.

Answer

Configure each action with a 'RunOrder' of 1 and set 'On failure' to 'ABORT'.

Answer

Set the stage's 'On failure' to 'ROLLBACK'.

Answer

Use a custom Lambda function to catch failures and resume the pipeline.

Question 5

An IAM policy is attached to an S3 bucket to allow access from a specific VPC CIDR range. However, users from the VPC are receiving 'Access Denied' errors when trying to access objects in the bucket. What is the MOST likely reason?

Accepted Answer

The condition key 'aws:SourceIp' evaluates the public IP address, but the VPC uses private IP addresses. The 'aws:SourceIp' condition key evaluates the source IP address of the request as seen by AWS, which is always a public IP address. When requests originate from within a VPC (e.g., from an EC2 instance), the source IP seen by S3 is the public IP of the instance or its NAT device, not the VPC's private CIDR range. Since the policy specifies a private VPC CIDR range using 'aws:SourceIp', it never matches the public source IP, resulting in 'Access Denied' errors.

Answer

The users are assuming an IAM role that does not have permission to access S3

Answer

The policy should use 'aws:sourceVpce' instead of 'aws:SourceIp' to restrict access to a VPC endpoint

Answer

The bucket policy requires HTTPS and the requests are using HTTP

Question 6

A DevOps engineer is troubleshooting an AWS CodeDeploy deployment that fails during the 'BeforeInstall' lifecycle event. The deployment group uses an in-place deployment to an Auto Scaling group. The engineer reviews the logs on the instance and sees that the 'BeforeInstall' script exits with code 1. The script is a shell script that compiles application code. What is the most likely cause of the failure?

Accepted Answer

The script exited with a non-zero exit code. In AWS CodeDeploy, lifecycle event scripts must exit with a status code of 0 to indicate success. Any non-zero exit code, including 1, is interpreted as a failure, causing the deployment to abort. Since the 'BeforeInstall' script exits with code 1, the deployment fails regardless of the script's intent or content.

Answer

The script is not included in the 'files' section of the appspec.yml

Answer

The script requires dependencies that are not installed on the instance

Answer

The script is not owned by the root user

Question 7

A company runs a containerized microservices application on Amazon EKS. The application includes a critical service that processes real-time financial transactions. This service must be highly available and resilient to node failures. The current setup uses a Deployment with 3 replicas and a ClusterIP service. During a recent node failure, the application experienced a brief period of unavailability. Which action should the DevOps engineer take to improve resilience without changing the underlying infrastructure?

Accepted Answer

Configure a PodDisruptionBudget with a maxUnavailable of 1, and add pod anti-affinity rules to spread pods across different nodes.. A PodDisruptionBudget with maxUnavailable=1 ensures that at most one pod is unavailable during voluntary disruptions, while pod anti-affinity rules force the scheduler to distribute pods across different nodes. This combination prevents a single node failure from taking down all replicas, maintaining service availability without altering the underlying infrastructure.

Answer

Change the service type from ClusterIP to NodePort and configure an external load balancer.

Answer

Increase the number of replicas to 10 and use a node selector to schedule all pods on the largest instance type.

Answer

Enable HorizontalPodAutoscaler with a target CPU utilization of 50% to automatically scale the Deployment.

Question 8

A company uses AWS Elastic Beanstalk to deploy a web application. The operations team wants to ensure that the environment's configuration (e.g., instance type, scaling limits) is version-controlled and reproducible. Which practice should they adopt?

Accepted Answer

Use the Elastic Beanstalk saved configuration feature to download a configuration file and store it in version control.. Elastic Beanstalk's saved configuration feature allows you to download the environment's configuration as a YAML or JSON file, which can be stored in version control and used to recreate identical environments. This directly addresses the need for version-controlled, reproducible environment configuration without requiring additional infrastructure-as-code tools.

Answer

Manually recreate the environment from the Elastic Beanstalk console when needed.

Answer

Use AWS CloudFormation to define the environment and store the template in a Git repository.

Answer

Document the configuration in a wiki and apply it manually through the AWS Management Console.

Question 9

A DevOps team is troubleshooting a slow application. They enabled AWS X-Ray tracing and see that one of the downstream services has a high average response time. However, the traces show that the service itself is fast; the delay is in the network call from the upstream service. Which X-Ray feature should the team use to identify the root cause?

Accepted Answer

Examine the trace map to see the connection between services.. The trace map in AWS X-Ray provides a visual representation of the service graph, showing the connections and latency between services. Since the delay is in the network call from the upstream service to the downstream service, the trace map can highlight the specific edge where the high latency occurs, allowing the team to pinpoint whether the issue is due to network congestion, DNS resolution, or a slow HTTP connection. This is the most direct way to identify the root cause of the inter-service communication delay.

Answer

Add annotations to the traces for better filtering.

Answer

View the raw segments of the upstream service.

Answer

Adjust the sampling rules to capture more traces.

Question 10

A DevOps engineer is designing a CI/CD pipeline for an application that runs on Amazon ECS. The pipeline should automatically build a Docker image from source code, push it to Amazon ECR, and deploy it to the ECS service. The engineer wants to use AWS CodePipeline with Amazon ECR as a source. Which action provider should be used for the deploy stage?

Accepted Answer

Amazon ECS. Amazon ECS is the correct action provider for the deploy stage when using AWS CodePipeline because it directly integrates with ECS to update an existing ECS service with a new task definition. When Amazon ECR is configured as a source, CodePipeline detects image pushes, and the ECS deploy action automatically triggers a rolling update of the ECS service using the new image, without requiring additional deployment tools.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk