AWS DevOps Engineer Professional - DOP-C02

1. 1.A CodePipeline pipeline in a tooling account must deploy CloudFormation stacks into separate development, staging, and production accounts. What is the correct way to grant the pipeline access?

   • AA cross-account deployment role in each target account assumed by the pipeline roleCorrect answer
   • BIAM users with access keys created in each target account
   • CThe AdministratorAccess policy on the pipeline role in the tooling account
   • DA separate independent pipeline running inside each target account

   Why

   Create a deployment role in each target account with a trust policy allowing the tooling account's pipeline role to assume it, and reference that role in the CloudFormation deploy action. Creating IAM users with access keys in each target account reintroduces long-lived credentials, granting the pipeline role administrator in the tooling account does not cross the account boundary, and running a separate pipeline per account loses the single promotion path.

2. 2.A CodeBuild project in a tooling account must decrypt pipeline artifacts stored in an S3 bucket that is also read by deploy actions in three other accounts. What must be configured on the artifact encryption key?

   • AA customer managed KMS key whose key policy grants all participating account rolesCorrect answer
   • BThe default AWS managed key for Amazon S3
   • CNo encryption on the artifact bucket
   • DAn IAM policy in each account allowing kms:Decrypt

   Why

   Use a customer managed KMS key whose key policy grants the roles in all participating accounts permission to encrypt and decrypt, since the default AWS managed S3 key cannot be shared across accounts. Making the bucket public is unacceptable, disabling encryption removes a required control, and an IAM policy alone cannot grant use of a key whose key policy does not allow the principal.

3. 3.A CodeBuild project needs a database password at build time. The value must never appear in the buildspec, the build logs, or the project configuration. What should be used?

   • AA secrets-manager or parameter-store environment variable referenceCorrect answer
   • BA plaintext environment variable on the CodeBuild project
   • CA hardcoded value in the buildspec file
   • DA CodePipeline parameter passed to the build action

   Why

   Reference the value from AWS Secrets Manager or a Systems Manager Parameter Store SecureString using the secrets-manager or parameter-store environment variable type, which resolves at runtime and is masked in logs. A plaintext environment variable is visible in the project configuration, hardcoding it in the buildspec commits it to source, and passing it as a pipeline parameter exposes it in the execution history.

4. 4.A team must run unit tests on every pull request and block the merge if they fail, without deploying anything. What should be configured?

   • AA CodeBuild project triggered on pull request events reporting status backCorrect answer
   • BA full CodePipeline execution triggered on every pull request
   • CA test stage that runs after the merge to the main branch
   • DA nightly scheduled CodeBuild run over the main branch

   Why

   Trigger a CodeBuild project on the pull request event from the source repository and report the build status back so the merge is blocked on failure. A full CodePipeline execution on every pull request deploys artifacts the requirement excludes, running tests only after merge lets failures land on the main branch, and a nightly test run detects failures far too late.

5. 5.A pipeline deploys to an Amazon ECS service and must shift traffic to the new task set gradually, with automatic rollback if a CloudWatch alarm fires during the shift. What should be configured?

   • ACodeDeploy blue/green for ECS with canary shifting and rollback alarmsCorrect answer
   • BThe default ECS rolling update deployment type
   • CDeleting and recreating the ECS service with the new task definition
   • DDeploying the new task definition and comparing metrics manually

   Why

   Use CodeDeploy blue/green deployment for ECS with a canary or linear traffic-shifting configuration and alarms configured to trigger automatic rollback. The ECS rolling update replaces tasks in place without weighted traffic shifting or alarm-based rollback, recreating the service causes an outage, and a manual comparison cannot roll back automatically.

Practice all 65 questions

Frequently asked questions