DOP-C02 Timed Practice Test 2 — 10 Questions

Question 1

A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?

10 minute time limit — choose an answer to begin.

Accepted Answer

CloudFormation Change Sets. CloudFormation Change Sets allow the DevOps team to preview how proposed changes to a stack will impact running resources before they are executed. This enables a review-and-approval workflow because the change set can be created, reviewed, and then executed only after approval, satisfying the requirement for a change management process.

Answer

CloudFormation StackSets

Answer

CloudFormation Stack Policies

Answer

CloudFormation Drift Detection

Question 2

A company uses AWS CloudFormation to manage a production environment. The DevOps team wants to implement a change management process where any changes to the stack must be reviewed before execution. Which feature should the team use?

10 minute time limit — choose an answer to begin.

Accepted Answer

Check the CloudFormation stack events for a detailed status message from the DBInstance resource.. The first step when a CloudFormation stack creation fails is to check the stack events in the CloudFormation console or via the AWS CLI. Each resource creation attempt generates a status message that includes a detailed reason for the failure, such as insufficient capacity, incorrect parameter values, or network configuration issues. For an RDS DBInstance, the event message will provide the specific error (e.g., 'DB instance class not supported in this Availability Zone'), enabling targeted troubleshooting without guesswork.

Answer

Increase the stack creation timeout to allow more time for the database to be created.

Answer

Verify that the VPC has at least two public subnets in different Availability Zones.

Answer

Use the Amazon RDS console to check if a DB instance with the same identifier already exists.

Question 3

A security engineer reviews the CloudTrail log entry above and notices that a security group was modified to allow SSH access from anywhere. The engineer wants to ensure that such changes are automatically detected and remediated in the future. What should the engineer do?

Accepted Answer

Create an AWS Config rule that checks security group rules and triggers an AWS Systems Manager Automation document to revoke the ingress rule.. AWS Config can continuously evaluate security group rules against a custom or managed rule (e.g., restricted-ssh) and, upon detecting a noncompliant rule allowing 0.0.0.0/0 on port 22, trigger an AWS Systems Manager Automation document that automatically revokes the offending ingress rule. This provides both detection and remediation without manual intervention, meeting the requirement for automated detection and remediation.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter that alerts on AuthorizeSecurityGroupIngress events with 0.0.0.0/0.

Answer

Create an IAM policy that denies the ec2:AuthorizeSecurityGroupIngress action if the source IP is 0.0.0.0/0.

Answer

Enable Amazon GuardDuty to detect and block such changes in real time.

Question 4

A DevOps engineer is writing an AWS CloudFormation template to create a VPC with public and private subnets. The engineer wants to ensure that the private subnets can access the internet through a NAT gateway. Which resources must be included in the template? (Choose TWO.)

Accepted Answer

AWS::EC2::RouteTable. A is correct because an AWS::EC2::RouteTable resource is required to define the routing rules for the private subnets. Specifically, you must create a route table for the private subnets and add a default route (0.0.0.0/0) that points to the NAT gateway, enabling outbound internet traffic from instances in the private subnets while blocking inbound traffic from the internet.

Answer

AWS::EC2::VPNGateway

Answer

AWS::EC2::InternetGateway

Answer

AWS::EC2::VPCEndpoint

Question 5

A DevOps team uses AWS CodeBuild to compile code and run unit tests. The team notices that builds are failing with a timeout error after 60 minutes. What is the most likely cause and solution?

Accepted Answer

The build timeout limit is exceeded; increase the timeout in CodeBuild project settings.. The default build timeout for AWS CodeBuild is 60 minutes. When a build runs longer than this limit, it fails with a timeout error. The correct solution is to increase the timeout value in the CodeBuild project settings, which can be set up to a maximum of 8 hours (480 minutes) for on-demand compute environments.

Answer

The buildspec has syntax errors; validate the YAML.

Answer

The build environment is too small; increase compute type.

Answer

The source code repository is too large; use shallow clone.

Question 6

A company has a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build stage runs unit tests and produces a JUnit report. The pipeline includes a test action that publishes results to an S3 bucket. Recently, the pipeline started failing with the error: 'The action could not be started because the artifact bucket policy is misconfigured.' What is the most likely cause?

Accepted Answer

The artifact bucket's bucket policy does not grant the necessary permissions to the CodePipeline service role.. AWS CodePipeline requires the artifact bucket's bucket policy to grant the CodePipeline service role (or the pipeline's assumed role) permissions to perform actions like s3:GetObject, s3:PutObject, and s3:GetBucketVersioning. When the bucket policy is misconfigured—for example, missing a principal or action—the pipeline's test action cannot start, resulting in the specific error message. This is a common IAM/permissions issue rather than a regional or encryption key problem.

Answer

The S3 bucket has Amazon S3 Transfer Acceleration enabled, which is not supported by CodePipeline.

Answer

The KMS key used to encrypt the bucket objects has been rotated, causing the pipeline to lose access.

Answer

The artifact bucket is in a different AWS Region than the pipeline, and cross-region replication is not enabled.

Question 7

A company is using AWS CodePipeline for CI/CD with CloudFormation as the deployment action. The pipeline fails intermittently with the error 'Rate exceeded' when creating or updating stacks. What is the most likely cause and solution?

Accepted Answer

The CloudFormation API rate limit is being hit; request a limit increase from AWS Support.. The 'Rate exceeded' error is a standard AWS API throttling error, indicating that CloudFormation API requests are being made faster than the account-level or region-level rate limit allows. CodePipeline can trigger multiple concurrent stack operations, especially during parallel stage executions or frequent commits, which can exceed the default CloudFormation API rate limit (e.g., 0.5 requests per second per account per region for CreateStack/UpdateStack). Requesting a limit increase from AWS Support is the correct solution to accommodate higher throughput.

Answer

The stack has a stack policy that prevents updates; modify the stack policy.

Answer

The IAM role used by CloudFormation does not have sufficient permissions; update the role policy.

Answer

The pipeline is exceeding the CodePipeline execution frequency limit; reduce the number of pipeline executions.

Question 8

A company uses AWS CodeBuild to compile a Java application. The build specification includes a pre-build phase to download dependencies. Which file defines the commands for each build phase?

Accepted Answer

buildspec.yml. In AWS CodeBuild, the build specification file named 'buildspec.yml' defines the commands that CodeBuild runs during each phase of the build process, including the pre-build phase for downloading dependencies. This YAML file is placed in the root of the source code or specified in the build project configuration, and it contains structured sections for install, pre_build, build, and post_build phases. Option B is correct because buildspec.yml is the standard file that CodeBuild uses to orchestrate build commands.

Answer

pipeline.json

Answer

config.xml

Answer

appspec.yml

Question 9

A DevOps team receives a CloudWatch alarm that an RDS DB instance's CPU utilization has exceeded 90% for 5 minutes. The application is experiencing latency. What is the best immediate step to mitigate the issue?

Accepted Answer

Modify the RDS instance to a larger instance class.. When an RDS instance's CPU utilization exceeds 90% for 5 minutes and the application is experiencing latency, the immediate step is to scale up the instance to a larger class to provide more CPU capacity. This directly addresses the resource bottleneck without requiring time-consuming analysis or architectural changes, making it the fastest mitigation for an ongoing incident.

Answer

Analyze slow query logs and optimize queries.

Answer

Enable Multi-AZ deployment for failover.

Answer

Add a read replica to offload read traffic.

Question 10

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting attacks. Which AWS service should be integrated with the ALB?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS traffic. It uses managed rule groups to block common attack patterns like SQL injection (e.g., detecting malicious SQL keywords in query strings) and cross-site scripting (e.g., identifying script tags in user input). This makes it the correct choice for protecting web applications at Layer 7.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty