Free AWS Certified DevOps Engineer - Professional (DOP-C02) Practice Questions

Sample DOP-C02 Practice Questions

Browse all 10 free AWS Certified DevOps Engineer - Professional practice questions below.

1. A company is implementing a CI/CD pipeline for a containerized application deployed on Amazon ECS. The application requires zero-downtime deployments with the ability to gradually shift traffic to the new version while monitoring for errors. If issues are detected, traffic should automatically roll back to the previous version. Which deployment configuration best meets these requirements?

   • Configure AWS CodeDeploy with CodeDeployDefault.ECSCanary10Percent5Minutes deployment configuration, enable automatic rollback, and configure CloudWatch alarms for error rate monitoring.
   • Configure AWS CodeDeploy with CodeDeployDefault.ECSLinear10PercentEvery1Minutes and manually monitor the deployment through the console.
   • Configure AWS CodeDeploy with CodeDeployDefault.ECSAllAtOnce deployment configuration and enable automatic rollback on deployment failure.
   • Configure rolling updates in the ECS service definition with minimum healthy percent of 50% and maximum percent of 200%.

2. A DevOps engineer needs to implement a multi-stage CI/CD pipeline using AWS CodePipeline for a microservices application. The pipeline must include source, build, test, and deploy stages. The build stage should compile code for multiple services in parallel to reduce build time. How should the engineer configure the build stage?

   • Create separate build stages in CodePipeline for each microservice to ensure isolation.
   • Create a single CodeBuild project with compute type set to BUILD_GENERAL1_2XLARGE to speed up compilation.
   • Create a single CodeBuild project with a buildspec.yml that uses batch build mode to compile all services sequentially.
   • Create separate CodeBuild projects for each microservice and add them as parallel actions within the same build stage in CodePipeline.

3. A company uses AWS CloudFormation to manage infrastructure across multiple AWS accounts and regions. The security team requires that all CloudFormation stacks be monitored for configuration drift and that any drift be automatically remediated within 1 hour. Which solution meets these requirements with the LEAST operational overhead?

   • Use CloudFormation StackSets with drift detection enabled and configure manual approval workflow for drift remediation.
   • Enable AWS Config rule cloudformation-stack-drift-detection-check across all accounts using AWS Organizations, create an EventBridge rule to trigger a Lambda function when drift is detected, and have the function execute a stack update to remediate drift.
   • Create a scheduled Lambda function that runs every hour in each account to check drift status using the DetectStackDrift API and sends notifications to the operations team.
   • Deploy CloudWatch alarms in each account that trigger when CloudFormation stacks report drift status and configure SNS notifications to the development team.

4. A company is migrating from a monolithic application to microservices on Amazon EKS. The DevOps team needs to implement a deployment strategy that allows testing new versions with a small percentage of production traffic before full rollout. The solution must work with their existing Kubernetes deployments and not require changes to application code. Which approach should the team use?

   • Configure Application Load Balancer with weighted target groups pointing to different EKS service endpoints.
   • Implement AWS App Mesh with virtual services and virtual routers to configure weighted routing between deployment versions.
   • Use Kubernetes Horizontal Pod Autoscaler to gradually increase replicas of the new version while decreasing old version replicas.
   • Use Kubernetes native rolling updates with maxSurge and maxUnavailable parameters configured for gradual rollout.

5. A DevOps team manages sensitive database credentials and API keys for applications running on Amazon EC2 instances and AWS Lambda functions. The team needs to implement a centralized secrets management solution that supports automatic rotation of credentials, audit logging of access, and integration with IAM for access control. Which solution BEST meets these requirements?

   • Store secrets in AWS Systems Manager Parameter Store SecureString parameters with KMS encryption and create Lambda functions to rotate credentials on a schedule.
   • Store secrets in AWS Secrets Manager with automatic rotation enabled, use resource-based policies for cross-account access, and enable CloudTrail logging for Secrets Manager API calls.
   • Use HashiCorp Vault deployed on EC2 instances with integration to AWS IAM for authentication and custom rotation scripts.
   • Store secrets in Amazon S3 with server-side encryption using KMS, configure S3 bucket policies for access control, and enable S3 access logging.

6. A company is migrating their CI/CD pipeline from Jenkins to AWS native services. Their current pipeline includes stages for code checkout, static code analysis, unit tests, integration tests, security scanning, and deployment. The team wants to maintain the same workflow while leveraging managed services. Which AWS services should be used for each stage?

   • GitHub Actions for the entire pipeline with AWS credentials stored in GitHub Secrets for deployment.
   • CodeCommit or CodeStar Connections for source, CodeBuild for all build and test stages including static analysis, CodeDeploy for deployment, orchestrated by CodePipeline.
   • CodeCommit for source, separate EC2 instances for each build and test stage, CloudFormation for deployment.
   • S3 for source artifacts, Lambda functions for each test stage, Step Functions for deployment orchestration.

7. A DevOps team needs to implement a solution where developers can deploy feature branches to isolated environments for testing. Each feature branch should get its own set of resources including API Gateway, Lambda functions, and DynamoDB tables. The resources should be automatically cleaned up when the branch is deleted. Which approach implements this efficiently?

   • Create feature flag toggles in a central configuration store and deploy all feature code to the production environment behind flags.
   • Use a single shared environment with resource naming conventions that include the branch name, and manually delete resources when branches are merged.
   • Create a CodePipeline for each feature branch that deploys a CloudFormation stack with resources named using the branch name. Use EventBridge with GitHub/CodeCommit branch deletion events to trigger a Lambda that deletes the stack.
   • Provision a fixed pool of test environments and assign branches to available environments using a scheduling system.

8. A company uses AWS CDK for infrastructure deployment. They want to ensure all CDK stacks pass security checks before deployment. The checks should verify that S3 buckets have encryption enabled, Lambda functions have appropriate timeouts, and IAM policies follow least privilege. Which approach implements this validation in the CI/CD pipeline?

   • Use TypeScript/Python type checking in CDK code to enforce security properties at compile time.
   • Configure AWS Config rules that detect non-compliant resources and automatically remediate them after deployment.
   • Deploy CDK stacks to a sandbox account first, run security scans on the created resources, then promote to production if scans pass.
   • Run cdk synth to generate CloudFormation templates, then use cfn-nag or cfn-guard to validate the templates against security rules before deployment.

9. A company runs a microservices architecture on Amazon EKS. They need to implement a deployment strategy where new versions are gradually rolled out, and if error rates increase beyond a threshold, the deployment automatically stops and rolls back. The solution should work without external tools. Which Kubernetes-native feature combined with AWS services provides this capability?

   • Configure Kubernetes HorizontalPodAutoscaler to scale down new version pods when metrics exceed thresholds.
   • Configure Kubernetes Deployment with maxSurge and maxUnavailable for rolling updates, combined with readinessProbes. Monitor pods using CloudWatch Container Insights and trigger rollback with kubectl rollout undo when alarms fire.
   • Use AWS App Mesh with canary virtual nodes that split traffic between versions, with CloudWatch alarms triggering automated rollback through App Mesh routing changes.
   • Use Kubernetes native canary deployments by deploying both versions simultaneously with label-based service selectors.

10. A DevOps engineer is troubleshooting a Lambda function that occasionally times out. The function processes messages from SQS and calls an external API. The engineer needs to identify whether the timeout is caused by the external API, database queries, or internal processing. Which observability approach provides the most detailed insight?

    • Enable Lambda function enhanced monitoring to view CPU and memory utilization during execution.
    • Enable CloudWatch Logs and search for timeout error messages in the log output.
    • Create CloudWatch custom metrics that record execution time and analyze the average duration over time.
    • Enable AWS X-Ray tracing for the Lambda function, instrument the code with X-Ray SDK to create subsegments for API calls and database operations, and analyze the trace timeline.