DOP-C02 Mock Exam 94 — 25 Questions

Question 1

A company uses AWS CodePipeline to automate builds and deployments. The pipeline has a source stage (Amazon S3) and a build stage (AWS CodeBuild). The build stage is failing with the error: 'Error: Unable to download artifact from S3: Access Denied'. The artifacts are stored in an S3 bucket that is encrypted with AWS KMS. The CodeBuild service role has permissions to read from the S3 bucket and use the KMS key. The team checks that the S3 bucket policy and the KMS key policy allow the CodeBuild role. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant 'kms:Decrypt' permission to the CodeBuild service role.. Option A is correct because CodeBuild needs permissions to decrypt the artifact; if the KMS key policy does not grant 'kms:Decrypt' to the CodeBuild role, access will be denied. Option B is wrong because bucket versioning is not required. Option C is wrong because the artifact bucket is separate from the pipeline bucket. Option D is wrong because CodePipeline service role is not used by CodeBuild to download artifacts.

Answer

The S3 bucket does not have versioning enabled, so CodeBuild cannot retrieve the artifact.

Answer

The CodePipeline service role does not have permission to pass the artifact to CodeBuild.

Answer

The artifact is stored in the same S3 bucket used by CodePipeline for its artifacts, causing a conflict.

Question 2

A company is using AWS OpsWorks for configuration management. They have a stack with a PHP application layer and a MySQL layer. The DevOps team needs to update the PHP version across all instances. They create a custom Chef recipe that updates the PHP package and add it to the lifecycle events. After running the 'Setup' lifecycle event on the layer, the instances are updated but the application stops working because the new PHP version is incompatible with some custom PHP extensions. The team needs to roll back the PHP version to the previous one quickly and minimize downtime. The instances are in an Auto Scaling group with a desired count of 4. What should the team do?

Accepted Answer

Re-run the old 'Setup' recipe that installs the previous PHP version on the layer.. Option D is correct because OpsWorks supports rollback by running a previous setup recipe. Option A is wrong because it would cause downtime during re-provisioning. Option B is wrong because it takes time and may not restore the exact state. Option C is wrong because replacing instances is slow and may cause data loss.

Answer

Create a new AMI with the old PHP version, launch new instances, and terminate the old ones.

Answer

Use the OpsWorks 'Rollback' feature to revert the stack to a previous state.

Answer

Manually SSH into each instance and downgrade the PHP package, then restart the web server.

Question 3

A company uses AWS CloudFormation to deploy its infrastructure. They have a production stack that includes an RDS PostgreSQL instance with a read replica. The stack update to modify the DB instance class fails with the error: 'The parameter group cannot be changed during a read replica update.' The DevOps engineer needs to update the DB instance class while minimizing downtime and without losing the read replica. The current configuration: the RDS instance is using a custom parameter group. The read replica is using the same parameter group. The update changes the DBInstanceClass property from db.r5.large to db.r5.xlarge. What should the engineer do to successfully update the stack?

Accepted Answer

Remove the read replica from the stack, update the master instance, then add the read replica back. Option B is correct because the error indicates that the parameter group cannot be changed during a read replica update. To update the instance class, the engineer should first remove the read replica from the stack (or delete it), update the master instance, and then recreate the read replica. Option A is wrong because creating a new parameter group does not resolve the conflict. Option C is wrong because modifying the replica first would also fail. Option D is wrong because the update cannot be done in-place due to the read replica.

Answer

Update the read replica first to the new instance class, then update the master instance

Answer

Use the AWS Management Console to modify the DB instance class directly, bypassing CloudFormation

Answer

Create a new parameter group for the master instance and associate it before the update

Question 4

A gaming company uses AWS Elastic Beanstalk to deploy a web application. The operations team needs to update environment configuration variables (e.g., database URL) without causing downtime. They want to change the value of an environment property. What is the CORRECT way to apply this change?

Accepted Answer

Update the environment properties in the Elastic Beanstalk console; the platform will perform a rolling update.. Elastic Beanstalk supports rolling updates for environment configuration changes (B). Updating via the console or CLI triggers a rolling update. Option A (terminate) causes downtime; C (SQS) is not relevant; D (immutable) also causes replacement.

Answer

Terminate the environment and create a new one with the updated configuration.

Answer

Use an immutable update by deploying a new version with the changes.

Answer

Use AWS Lambda to directly modify the environment configuration without redeploying.

Question 5

A company uses AWS OpsWorks for Chef Automate. They have a stack that includes a PHP application layer. The application requires a custom PHP configuration file. The DevOps engineer creates a custom Chef cookbook with a recipe that deploys the configuration file. The recipe is assigned to the layer's Setup lifecycle event. The engineer notices that the configuration file is not being created on new instances when they are added to the layer. The cookbook is stored in a private S3 bucket. The engineer has verified that the cookbook is correctly associated with the stack. What should the engineer do to fix the issue?

Accepted Answer

Ensure that the instance profile has permissions to read from the S3 bucket where the cookbook is stored. Option C is correct because OpsWorks requires that the cookbook be installed on the instance before the lifecycle event runs. The cookbook is in a private S3 bucket, so the instance needs permission to access it. The engineer should ensure that the stack's custom cookbooks source is configured with the correct S3 bucket and that the instance profile has permissions to read from the bucket. Option A is wrong because the recipe is assigned to the correct lifecycle event. Option B is wrong because the cookbook version is not the issue. Option D is wrong because the recipe is in the cookbook.

Answer

Assign the recipe to the Configure lifecycle event instead of Setup

Answer

Verify that the recipe is included in the cookbook's default.rb file

Answer

Update the cookbook version to the latest

Question 6

A company runs a critical web application on AWS using an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application is deployed using AWS CodeDeploy with a blue/green deployment configuration. The DevOps team is responsible for configuration management using AWS Systems Manager State Manager. They have set up a State Manager association to ensure that the instances have a specific security configuration (e.g., firewall rules). Recently, after a new deployment, the team noticed that the security configuration is missing on some new instances. The old instances still have the correct configuration. The association is configured to apply the configuration only at instance launch (using the AWS-RunShellScript document). The team suspects that the new instances are not being targeted by the association. Upon investigation, they find that the association is set to target instances based on tags, and the new instances do have the required tags. However, the association status shows 'Success' for the old instances but no status for the new instances. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The State Manager association was created before the new instances were launched, and the association is not configured to automatically apply to new instances. The association needs to be updated or scheduled to run periodically.. Option A is correct because State Manager associations are created at a specific time and target instances that exist at that time. New instances launched after the association creation will not automatically be targeted unless the association is configured with a schedule or the 'Apply only at next update' option. The association is set to run only at launch, but the association itself must be applied to the instance at launch time. If the association was created before the new instances, it won't apply to them unless it is updated. Option B is wrong because the association can target instances by tags; tagging is not the issue. Option C is wrong because the problem is not about the script failing; the association is not running on new instances. Option D is wrong because the S3 bucket policy would affect the ability to store logs, but the association status would show error, not missing status.

Answer

The new instances have a different tag than the one specified in the association.

Answer

The association is trying to download a script from an S3 bucket, but the bucket policy denies access to new instances.

Answer

The AWS-RunShellScript document failed to execute on the new instances due to a missing IAM role.

Question 7

A company uses AWS CloudFormation to manage its infrastructure. The DevOps team has a template that creates an Amazon RDS DB instance and an EC2 instance that runs a web application. The EC2 instance needs to connect to the RDS instance using the database endpoint and password. The team currently passes the endpoint and password as CloudFormation parameters, which are then stored in the EC2 instance's user data. However, security audit has flagged this as a security risk because the password is visible in the user data. The team wants to securely pass the database credentials to the EC2 instance without exposing them in the template or user data. The EC2 instance has an IAM role that allows it to read from AWS Secrets Manager. Which solution should the team implement?

Accepted Answer

Store the password in AWS Secrets Manager, use a dynamic reference to pass it to the EC2 instance's IAM role, and have the application retrieve it from Secrets Manager at runtime.. Option D is correct. By storing the password in Secrets Manager and using a dynamic reference in CloudFormation, the password is never exposed in the template or user data. The EC2 instance can retrieve the password from Secrets Manager at runtime using its IAM role. Option A is wrong because storing the password in Parameter Store is also possible but Secrets Manager is more secure and supports rotation. Option B is wrong because encrypting the user data is still risky as the encryption key might be exposed. Option C is wrong because the password would still be in the template.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString and have the EC2 instance retrieve it using the AWS CLI.

Answer

Encrypt the user data using AWS KMS and decrypt it on the EC2 instance at boot time.

Answer

Use CloudFormation's Fn::GetAtt to retrieve the password from the RDS instance and pass it to the EC2 instance via user data.

Question 8

A company is using AWS OpsWorks for configuration management of their application stack. The stack includes a PHP application layer and a MySQL database layer. The DevOps team wants to automate the deployment of a new PHP version across all instances in the PHP layer. The team has created a custom Chef recipe that updates PHP. They want to run this recipe on all instances in the PHP layer in a rolling update fashion to avoid downtime. Which OpsWorks feature should they use?

Accepted Answer

Use the OpsWorks 'Run Command' feature to execute the recipe on the PHP layer with rolling update settings.. Option C is correct. OpsWorks allows you to run a custom Chef recipe on a layer using the 'Run Command' feature, and you can specify a rolling update by setting the 'Batch size' and 'Install on all instances' options. Option A is wrong because Setup runs at boot, not on demand. Option B is wrong because automatic updates are not a feature. Option D is wrong because lifecycle events are for automatic execution, not on-demand rolling updates.

Answer

Create a custom Chef cookbook and enable automatic updates in OpsWorks.

Answer

Add the recipe to the Setup lifecycle event for the PHP layer.

Answer

Modify the PHP layer's lifecycle configuration to include the recipe in the Configure event.

Question 9

A company uses AWS CodeCommit to store infrastructure as code templates. The DevOps team has set up an AWS CodePipeline that automatically deploys a CloudFormation stack when changes are pushed to the main branch. The pipeline includes a deployment action that uses the CloudFormation create/update stack action. Recently, a developer pushed a change that caused the CloudFormation stack update to fail because the change would have deleted a critical resource. The pipeline did not catch this issue, and the stack update failed midway, leaving the stack in a partially updated state. The team wants to implement a safety mechanism to prevent such issues in the future. Which solution should they implement?

Accepted Answer

Add a CloudFormation change set action in the pipeline with a manual approval step to review the changes before executing the stack update.. Option B is correct. Adding a change set approval step allows the team to review the changes before applying them. Option A is wrong because a manual approval on the source is too early. Option C is wrong because stack policies protect resources but do not prevent the update from starting; they can prevent deletion but the update may still proceed. Option D is wrong because the 'Test' stage is for testing, not for reviewing changes to infrastructure.

Answer

Create a stack policy that denies deletion of critical resources, and include the policy in the CloudFormation template.

Answer

Add a manual approval step before the deployment action to review the code change.

Answer

Add a 'Test' stage in the pipeline that deploys the stack to a test environment first.

Question 10

A company uses Terraform to manage a multi-account AWS environment. The Terraform state files are stored in an S3 bucket with DynamoDB locking. Recently, a DevOps engineer ran 'terraform apply' from a CI/CD pipeline, and it failed with the error: 'Error acquiring the state lock. Lock ID: "abc123". Possible causes: Another process has the lock; or a previous process crashed.' The engineer checks DynamoDB and sees that the lock item exists but there is no active Terraform process. The engineer needs to proceed with the deployment urgently. What should the engineer do?

Accepted Answer

Use the 'terraform force-unlock' command with the lock ID to remove the lock.. Option C is correct because force-unlock removes the lock item, allowing the pipeline to proceed. Option A is wrong because waiting may be futile if no process holds the lock. Option B is wrong because deleting the state file would cause data loss. Option D is wrong because manual editing of state is risky and unnecessary.

Answer

Wait for the lock to expire automatically.

Answer

Delete the state file from S3 and recreate it from the last backup.

Answer

Manually delete the lock item from DynamoDB using the AWS Console.

Question 11

A company runs a production e-commerce platform on AWS. The architecture includes an Application Load Balancer (ALB) distributing traffic across EC2 instances in an Auto Scaling group. The application uses a custom configuration stored in an S3 bucket. The DevOps team uses AWS CodeDeploy to deploy application updates. Recently, a deployment failed because new instances launched by the Auto Scaling group did not have the latest configuration from S3. The team had manually updated the configuration in S3 but the deployment did not pull the new version. The team wants to ensure that all instances always have the latest configuration at launch. Current setup: The Auto Scaling group uses a launch template that specifies an IAM instance profile with permissions to read from S3. The user data script runs at launch to download configuration from S3. However, the user data script is static and does not account for configuration updates. The team wants a solution that automatically applies configuration changes to both existing and new instances without manual intervention.

Accepted Answer

Use AWS Systems Manager State Manager to associate a document that runs on all instances to fetch the latest configuration from S3 on a schedule and at instance startup.. Option B is correct because AWS Systems Manager State Manager can enforce configuration on instances, pull the latest config from S3, and apply it to both existing and new instances. Option A is incorrect because updating the user data script in the launch template only affects new instances, not existing ones. Option C is incorrect because CodeDeploy does not run at instance launch unless triggered by a lifecycle hook, and it requires additional setup. Option D is incorrect because AWS Config is for compliance, not for pushing configurations.

Answer

Use AWS Config with a custom rule to detect instances that do not have the latest configuration and trigger a Lambda function to update them.

Answer

Update the launch template with a new user data script that always fetches the latest configuration from S3. Then, update the Auto Scaling group to use the new launch template version.

Answer

Configure AWS CodeDeploy to deploy the configuration to all instances whenever the S3 object is updated, using an S3 event notification.

Question 12

A financial services company uses AWS CloudFormation to deploy a three-tier web application. The stack includes an Amazon RDS for PostgreSQL database. The database master password is stored in AWS Secrets Manager, and the CloudFormation template uses a dynamic reference to retrieve it during stack creation. The team recently rotated the database password in Secrets Manager. When they attempt to update the stack to change other parameters, the update fails with the error: 'Value of property MasterUserPassword must be a string.' The team is using the following template snippet for the password: 'MasterUserPassword': '{{resolve:secretsmanager:MySecret:SecretString:password}}'. The stack was originally created with AWS CloudFormation. What is the most likely cause of the failure?

Accepted Answer

Dynamic references in CloudFormation are only resolved at stack creation, not during updates. The team must use a different method to reference the rotated password.. Option A is correct because dynamic references are only resolved during stack creation and not during updates. To update the password, the team must use a different approach. Option B is incorrect because Secrets Manager rotation does not invalidate the secret immediately. Option C is incorrect because the template syntax is correct. Option D is incorrect because Secrets Manager is not region-bound in this context.

Answer

The secret was rotated before the stack was created, causing a mismatch.

Answer

The template syntax is incorrect; it should use '{{resolve:secretsmanager:MySecret:SecretString:password}}' with different quotes.

Answer

The secret is in a different region than the stack.

Question 13

An organization uses AWS CodeCommit to store CloudFormation templates. They have a requirement that all templates must pass a series of validation checks before being merged to the main branch. The checks include syntax validation, IAM policy linting, and compliance rules. The DevOps team wants to implement this validation using AWS services with minimal operational overhead. They already use AWS CodePipeline for CI/CD. What should the team do?

Accepted Answer

Set up a CodePipeline that is triggered by pull request creation, with a CodeBuild stage to run validation checks, and configure a branch policy to require the pipeline to succeed before merging.. Option D is correct because CodePipeline with CodeBuild can run validation checks on pull requests using a branch policy. Option A is wrong because it requires managing Lambda functions. Option B is wrong because it doesn't integrate with pull request workflow. Option C is wrong because CloudFormation alone cannot enforce pre-merge validation.

Answer

Configure a CloudFormation stack to automatically validate templates and send notifications.

Answer

Create a Lambda function that triggers on CodeCommit events and runs validation.

Answer

Use AWS CloudFormation Guard as a pre-commit hook on local machines.

Question 14

A company uses AWS OpsWorks for configuration management of a fleet of EC2 instances running a legacy application. The operations team needs to deploy a new version of the application across all instances without causing downtime. The application runs on each instance and requires a rolling update. Which approach should the team use?

Accepted Answer

Use the OpsWorks Deploy command to trigger a rolling update across the stack.. OpsWorks provides rolling updates via the Deploy command (A), which updates instances in batches. Option B (Layers) does not manage updates; C (Auto Scaling) is for scaling, not updates; D (CodeDeploy) is a separate service but OpsWorks is the current tool.

Answer

Use AWS CodeDeploy to perform a blue/green deployment on the existing instances.

Answer

Create a new Auto Scaling group with the updated AMI and terminate old instances.

Answer

Manually update each instance by adding a new layer and reassigning instances.

Question 15

A company manages a fleet of EC2 instances using AWS Systems Manager State Manager. They have a State Manager association that ensures a specific software package is installed on all instances. Recently, they noticed that some instances are reporting the association as 'Success' even though the software is not installed. The association uses a custom document that runs a script to install the package. The engineer checks the association execution history and sees that the script exited with code 0 on those instances. What is the most likely cause?

Accepted Answer

The script does not check the exit code of the installation command and always returns 0.. Option B is correct because the script may exit with code 0 even if installation fails, making State Manager think it succeeded. Option A is wrong because compliance reporting is not the issue. Option C is wrong because the association is running. Option D is wrong because the script ran.

Answer

The association is not targeting those instances.

Answer

The instances are not configured to send compliance data to Systems Manager.

Answer

The instances do not have the SSM Agent installed.

Question 16

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline has a Source stage (GitHub), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The deployment fails intermittently with the error: 'Bucket does not allow ACLs'. The S3 bucket is configured to use the 'bucket-owner-enforced' setting for Object Ownership. The team wants to resolve the failure while maintaining security best practices. What should the team do?

Accepted Answer

Update the CodeDeploy deployment action to use a bucket policy and disable ACLs.. When Object Ownership is set to bucket-owner-enforced, ACLs are disabled (C). The CodeDeploy action must be configured to use bucket policies instead of ACLs. Option A (remove setting) weakens security; B (public) is insecure; D (CodeBuild) is not the issue.

Answer

Make the S3 bucket publicly accessible to allow CodeDeploy to write objects.

Answer

Add a step in CodeBuild to copy the artifacts to the S3 bucket using the AWS CLI.

Answer

Change the Object Ownership setting to 'ObjectWriter' to enable ACLs.

Question 17

A company runs a critical microservices application on Amazon EKS with multiple services. They use an ingress controller (ALB Ingress Controller) to route traffic to services. They notice that when a pod fails, new requests are still sent to the failed pod for a few seconds, causing errors. The health check interval is set to 5 seconds. They want to minimize the time during which failed pods receive traffic. They also need to ensure that during rolling updates, traffic is not sent to pods that are terminating. Which solution should they implement?

Accepted Answer

Configure readiness probes on the pods and set the ALB ingress controller to use the readiness probe endpoint.. Option D is correct because readiness probes detect when a pod is not ready to serve traffic and remove it from the service endpoints quickly. The ALB ingress controller respects readiness probes. Option A is incorrect because liveness probes restart pods but do not remove them from service immediately. Option B is incorrect because increasing the health check interval would make the situation worse. Option C is incorrect because pod anti-affinity affects scheduling, not traffic routing.

Answer

Define liveness probes for all pods with a low failure threshold.

Answer

Use pod anti-affinity to spread pods across nodes.

Answer

Decrease the health check interval on the ALB target group to 2 seconds.

Question 18

A company runs a production application on Amazon ECS with Fargate, fronted by an Application Load Balancer (ALB). The application experiences periodic latency spikes and occasional 502 errors. The ECS service is configured with a desired count of 2 tasks, and the ALB health check is set to /health with a 30-second interval and 2 consecutive failures threshold. The team uses CloudWatch Container Insights and has noticed that CPU and memory utilization of tasks remain below 50%. However, the ALB TargetGroup's HealthyHostCount metric occasionally drops to 0 for a few minutes before recovering. The deployment strategy is rolling update with a minimum healthy percent of 50% and maximum percent of 200%. The team recently updated the task definition to increase memory and CPU, but the issue persists. What is the MOST likely cause of the problem?

Accepted Answer

The ALB health check is too aggressive, causing tasks to be marked unhealthy during brief initialization or deployment.. Option B is correct because the health check interval (30 seconds) and failure threshold (2) mean it takes up to 60 seconds to mark a task unhealthy. During deployments, the rolling update may temporarily have only 1 healthy task (minimum 50% of 2 = 1), and if that task becomes unhealthy, HealthyHostCount drops to 0. Option A is wrong because CPU and memory are below 50%, so resource limits are not the issue. Option C is wrong because a target group with 2 tasks and 2 AZs is fine; the problem is not AZ-specific. Option D is wrong because ECS service-linked role does not affect health checks.

Answer

The ECS service role lacks permissions to register targets with the ALB.

Answer

The ALB target group is configured with only one Availability Zone, causing loss of all targets when that AZ fails.

Answer

The task's CPU or memory limits are set too low, causing the container to be throttled.

Question 19

Your company runs a multi-tier web application on AWS. The web tier consists of EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group across three Availability Zones. The application tier runs on a separate Auto Scaling group of EC2 instances that process requests from the web tier. The database tier uses an Amazon RDS for PostgreSQL Multi-AZ deployment. All application servers write logs to Amazon CloudWatch Logs. Recently, the operations team reported that during peak hours, the web tier experiences intermittent 503 errors. The ALB access logs show that the errors occur when the target group's healthy host count drops to zero momentarily. The Auto Scaling group's minimum and desired capacity is 6, with a maximum of 12. The scaling policy is based on average CPU utilization, with a target of 60%. The health check grace period is 300 seconds. The application health check endpoint returns a 200 status when healthy. The DevOps engineer suspects that the scaling policy is too slow to react to traffic spikes. The engineer wants to implement a more proactive scaling approach. Which solution should the engineer implement?

Accepted Answer

Implement a predictive scaling policy combined with dynamic scaling to proactively adjust capacity based on forecasted traffic.. Option D is correct because using a predictive scaling policy combined with dynamic scaling provides a proactive approach that anticipates traffic patterns and adjusts capacity in advance. Option A (increasing health check grace period) does not help with scaling speed. Option B (step scaling with a lower cooldown) is reactive and may still cause dips. Option C (scheduled scaling) works only if traffic patterns are predictable and doesn't handle spikes well.

Answer

Implement a scheduled scaling policy that increases capacity 30 minutes before the expected peak.

Answer

Increase the health check grace period to 600 seconds to give new instances more time to become healthy.

Answer

Switch to a step scaling policy with a lower cooldown period and a greater scaling adjustment.

Question 20

A financial services company runs a critical application on Amazon ECS with Fargate launch type. The application consists of three microservices: Service A (frontend), Service B (processing), and Service C (database access). Services communicate via REST APIs. The application stores data in Amazon Aurora PostgreSQL Serverless v2. The company has a disaster recovery (DR) requirement: RTO of 30 minutes and RPO of 15 minutes. The primary region is us-east-1 and the DR region is us-west-2. The DevOps team has configured cross-region replication for the Aurora database using an Aurora Global Database. The ECS services are deployed with a service-linked role for Fargate. The team wants to automate the failover process to meet the RTO. Which solution should the team implement?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the ECS services and supporting resources in the DR region. Configure an Aurora Global Database for cross-region replication. Use Amazon Route 53 with health checks and failover routing to automatically redirect traffic to the DR region when the primary region health check fails.. Option A is correct because using CloudFormation StackSets to deploy the infrastructure in both regions and using Route 53 with health checks and failover routing allows automated failover with DNS propagation. The Aurora Global Database provides managed replication. Option B (snapshot restore) is too slow. Option C (manual runbooks) won't meet RTO. Option D (ECS Service Auto Scaling across regions) is not directly possible with Fargate cross-region.

Answer

Take daily snapshots of the Aurora database and copy them to the DR region. In the event of a disaster, restore the snapshot and use AWS CloudFormation to launch the ECS services.

Answer

Use AWS Backup to schedule cross-region backups of the Aurora database every 15 minutes. In the event of a disaster, restore the latest backup and use Elastic Beanstalk to deploy the application in the DR region.

Answer

Configure AWS Global Accelerator with an endpoint group in each region. Use AWS Lambda to periodically check the health of the primary region and update the DNS records manually to point to the DR region.