AWS Certified DevOps Engineer Professional DOP-C02 Practice Questions with Explanations

157 questions · Cloud Computing · by Study Foxy

Study these questions free

Questions

  1. A pipeline in a tools account deploys to a prod account, but the deploy stage can't read artifacts from the artifact bucket. What is the most likely cause?

    • The bucket uses the default AWS managed KMS key
    • The prod account has too many IAM users
    • The pipeline uses the V2 type with pipeline-level variables
    • The build stage runs inside a VPC

  2. A pipeline should start only when a Git tag matching v* is pushed. Which feature fits?

    • V2 pipeline triggers with tag filters
    • A daily schedule on the source stage
    • A manual approval action at the start
    • CodeBuild batch builds with matrix runs

  3. A release must wait for a QA lead's sign-off before production. What should be added?

    • A manual approval action
    • A CodeBuild test report group
    • An EventBridge Scheduler rule
    • A CloudFormation stack policy

  4. A pipeline must deploy the same artifact to us-east-1 and eu-west-1. What does CodePipeline support?

    • Cross-Region actions with an artifact bucket in each Region
    • Only one Region per pipeline, ever
    • Copying artifacts by email between teams
    • Rebuilding the code separately in each Region

  5. CodeBuild needs a database password during tests without storing it in buildspec.yml. What should be used?

    • Secrets Manager references
    • A plain-text env variable in buildspec
    • A comment in the source code
    • An S3 object with public read access

  6. CodeBuild jobs spend most of their time downloading the same dependencies. What reduces build time?

    • Enable dependency caching
    • Use a larger artifact bucket
    • Add a manual approval step
    • Split the repo into two

  7. A CodeBuild project must run integration tests against an RDS database in a private subnet. What must be configured?

    • VPC settings on the CodeBuild project
    • A public IP on the RDS instance
    • An internet gateway route added for the RDS subnet
    • A larger build compute type

  8. Which service stores and shares internal npm and Maven packages and proxies public registries?

    • AWS CodeArtifact
    • Amazon ECR
    • AWS CodeDeploy
    • Amazon S3 Glacier

  9. Teams in other Regions need low-latency pulls of container images built in us-east-1. What should be configured?

    • ECR cross-Region replication
    • ECR lifecycle policies on the source repository
    • ECR tag immutability
    • An S3 lifecycle rule

  10. A pipeline must fail if a container image has critical vulnerabilities. Where should the check go?

    • A pre-deploy scan gate
    • After production deployment only
    • In a monthly manual review
    • Inside the CloudFormation Outputs

  11. Which are valid source providers or triggers for CodePipeline? (Select TWO.)

    • A GitHub repository through CodeConnections
    • An S3 object version change
    • An SNS email subscription
    • An EBS snapshot completion

  12. Unit test results from CodeBuild should be visible as pass/fail trends per build. Which feature fits?

    • CodeBuild test reports
    • CloudTrail event history
    • AWS Config timelines
    • S3 Inventory reports

  13. After each deployment, a team wants a scripted check of the login flow running every 5 minutes. Which feature fits?

    • CloudWatch Synthetics canaries
    • CloudWatch Logs Insights scheduled queries
    • AWS X-Ray sampling rules
    • AWS Config rules

  14. Integration tests should run against a fresh environment that is torn down afterward. What enables this in a pipeline?

    • A temporary IaC test stack
    • Testing directly in production
    • Reusing a shared dev server forever
    • Skipping tests on weekends

  15. A deployment should run a Lambda validation function before shifting any traffic to a new Lambda version. Which CodeDeploy hook fits?

    • BeforeAllowTraffic
    • AfterInstall
    • ApplicationStart with a validation script
    • BeforeInstall

  16. Which test type checks that independent components work correctly together?

    • Integration testing
    • Unit testing
    • Static code analysis with linters
    • Linting

  17. Security scanning of code and dependencies should happen early in the pipeline, before deployment.

    True or false

  18. Which file tells CodeBuild what to install, build, and output?

    • buildspec.yml
    • appspec.yml
    • template.yaml
    • Dockerfile.lock

  19. Release images must never be overwritten after they are tagged. What should be enabled in ECR?

    • Tag immutability
    • Pull-through cache
    • Lifecycle policies
    • Replication

  20. Old, untagged images in ECR should be deleted automatically. What should be used?

    • An ECR lifecycle policy
    • An S3 lifecycle rule
    • A CodeBuild post_build step
    • An IAM permissions boundary

  21. A team wants to build a hardened AMI on a schedule and distribute it to many accounts. Which service fits?

    • EC2 Image Builder
    • AWS CodeArtifact with upstream repositories
    • AWS DataSync
    • Amazon ECR

  22. Lambda functions must be deployed with dependencies packaged once and reused across many functions. Which feature fits?

    • Lambda layers
    • Lambda aliases
    • Lambda destinations
    • Reserved concurrency

  23. During an in-place CodeDeploy deployment to EC2, which hook runs after the new files are copied but before the app starts?

    • AfterInstall
    • BeforeAllowTraffic
    • ValidateService
    • ApplicationStop

  24. An ECS service rolling update keeps launching tasks that fail health checks. What stops the deployment and rolls back automatically?

    • The ECS deployment circuit breaker
    • A longer health check grace period only
    • Increasing the desired count
    • Disabling the load balancer

  25. An ECS blue/green deployment needs a way to test the new task set before shifting production traffic. What does CodeDeploy use?

    • A test listener on the load balancer
    • A second VPC for testing
    • A Route 53 failover record for the new task set
    • A NAT gateway per task set

  26. A deployment to 20 EC2 instances must update one instance at a time to limit risk. Which CodeDeploy config fits?

    • CodeDeployDefault.OneAtATime
    • CodeDeployDefault.AllAtOnce
    • CodeDeployDefault.HalfAtATime
    • A canary config for Lambda

  27. Elastic Beanstalk must deploy without reducing capacity and roll back quickly if new instances fail. Which policy fits?

    • Immutable
    • All at once
    • Rolling
    • Rolling with batch size 100%

  28. Elastic Beanstalk must allow an instant switch back to the old version after release. Which approach fits?

    • Blue/green with a URL swap
    • Rolling updates with small batches
    • All-at-once deployment
    • Editing instances by hand

  29. Lambda traffic must shift 10% to a new version for 10 minutes before full cutover. Which setting fits?

    • Canary10Percent10Minutes
    • Linear10PercentEvery1Minute
    • AllAtOnce
    • OneAtATime

  30. A new feature should be turned on gradually for users without redeploying code, with automatic rollback on alarms. Which service fits?

    • AWS AppConfig feature flags
    • CloudFormation change sets per release
    • CodeArtifact upstreams
    • ECR replication

  31. Which strategy keeps two identical environments and switches traffic between them?

    • Blue/green
    • Rolling
    • Canary with one host
    • In-place

  32. A CodeDeploy EC2 blue/green deployment fails. What happens to the original instances by default during the deployment?

    • They keep serving until the new fleet is ready
    • They're terminated before the new fleet starts
    • They're stopped and their volumes deleted
    • They're moved to a different Region

  33. A SAM template should deploy Lambda gradually and roll back on errors. Which properties fit?

    • AutoPublishAlias with a DeploymentPreference
    • Layers with a larger memory size
    • Events with a schedule expression
    • ReservedConcurrentExecutions only

  34. An in-place CodeDeploy deployment to EC2 always launches a new set of instances.

    True or false

  35. An Auto Scaling group in CloudFormation must replace instances in batches when its launch template changes. Which attribute fits?

    • An UpdatePolicy
    • DeletionPolicy with Retain
    • A stack policy denying updates
    • A WaitCondition with no handle

  36. A stack must wait until instances finish bootstrapping before reporting success. What should be used?

    • CreationPolicy with cfn-signal
    • DeletionPolicy set to Snapshot on the instances
    • Outputs with Export
    • A stack policy

  37. Configuration changes in CloudFormation metadata must be applied to running instances automatically. Which helper does this?

    • cfn-hup
    • cfn-signal
    • cfn-lint
    • cfn-guard

  38. A template must call a third-party API during stack creation. Which feature fits?

    • A Lambda-backed custom resource
    • A nested stack with parameters
    • A stack policy
    • A change set

  39. A team wants to reuse a standard VPC pattern across many templates as one resource type. Which feature fits?

    • CloudFormation modules
    • Stack policies
    • Drift detection
    • Termination protection

  40. Templates should be checked against company rules, such as requiring encryption, in the pipeline before deployment. Which tool fits?

    • CloudFormation Guard
    • CloudFormation drift detection
    • AWS Trusted Advisor
    • Amazon Inspector

  41. Critical production resources in a stack must never be replaced by an update. What should be used?

    • A stack policy
    • A larger instance type
    • A CreationPolicy
    • An Export on outputs

  42. A team writes infrastructure in TypeScript and wants reusable high-level constructs. Which tool fits?

    • AWS CDK
    • AWS SAM CLI only
    • AWS Config
    • AWS OpsWorks

  43. Someone edited a security group by hand. How can the team find all differences from the template?

    • Run drift detection on the stack
    • Run a change set with no changes
    • Recreate the stack in a new Region
    • Check CodeBuild logs

  44. A CloudFormation template can transform its content at deploy time by using a macro.

    True or false

  45. Every new account in an OU must automatically get a baseline stack. Which feature fits?

    • Service-managed StackSets
    • Self-managed StackSets without targets
    • Nested stacks in the management account
    • A manual change set per account

  46. A team uses Terraform and wants Control Tower account provisioning with customizations in a pipeline. Which option fits?

    • Account Factory for Terraform
    • AWS RAM
    • AWS Service Catalog AppRegistry
    • CloudFormation Guard

  47. Developers need self-service access to approved, preconfigured stacks without broad IAM rights. Which service fits?

    • AWS Service Catalog
    • AWS RAM
    • AWS Artifact
    • IAM Identity Center permission sets only

  48. A central networking account must share subnets with application accounts. Which service fits?

    • AWS RAM
    • VPC peering
    • AWS Config aggregators
    • StackSets

  49. Admins must delegate GuardDuty and Security Hub management to a security account. What is this feature called?

    • A delegated administrator
    • A service-linked role
    • A permissions boundary
    • A cross-account trust policy

  50. Which IAM setup lets a pipeline in a tools account deploy into other accounts?

    • Target-account roles trusting tools
    • IAM users with keys in every account
    • The root user of each account
    • A shared password across accounts

Showing 50 of 157. Open the quiz to study them all.