AWS DevOps Engineer Professional - DOP-C02 Practice Exam

1. 1.A CodePipeline pipeline in a tooling account must deploy CloudFormation stacks into separate development, staging, and production accounts. What is the correct way to grant the pipeline access?

   • AThe AdministratorAccess policy on the pipeline role in the tooling account
   • BIAM users with access keys created in each target account
   • CA separate independent pipeline running inside each target account
   • DA cross-account deployment role in each target account assumed by the pipeline roleCorrect answer

   Why

   Create a deployment role in each target account with a trust policy allowing the tooling account's pipeline role to assume it, and reference that role in the CloudFormation deploy action. Creating IAM users with access keys in each target account reintroduces long-lived credentials, granting the pipeline role administrator in the tooling account does not cross the account boundary, and running a separate pipeline per account loses the single promotion path.

2. 2.A CodeBuild project in a tooling account must decrypt pipeline artifacts stored in an S3 bucket that is also read by deploy actions in three other accounts. What must be configured on the artifact encryption key?

   • AThe default AWS managed key for Amazon S3
   • BA customer managed KMS key whose key policy grants all participating account rolesCorrect answer
   • CAn IAM policy in each account allowing kms:Decrypt
   • DNo encryption on the artifact bucket

   Why

   Use a customer managed KMS key whose key policy grants the roles in all participating accounts permission to encrypt and decrypt, since the default AWS managed S3 key cannot be shared across accounts. Making the bucket public is unacceptable, disabling encryption removes a required control, and an IAM policy alone cannot grant use of a key whose key policy does not allow the principal.

3. 3.A CodeBuild project needs a database password at build time. The value must never appear in the buildspec, the build logs, or the project configuration. What should be used?

   • AA CodePipeline parameter passed to the build action
   • BA secrets-manager or parameter-store environment variable referenceCorrect answer
   • CA plaintext environment variable on the CodeBuild project
   • DA hardcoded value in the buildspec file

   Why

   Reference the value from AWS Secrets Manager or a Systems Manager Parameter Store SecureString using the secrets-manager or parameter-store environment variable type, which resolves at runtime and is masked in logs. A plaintext environment variable is visible in the project configuration, hardcoding it in the buildspec commits it to source, and passing it as a pipeline parameter exposes it in the execution history.

4. 4.A team must run unit tests on every pull request and block the merge if they fail, without deploying anything. What should be configured?

   • AA CodeBuild project triggered on pull request events reporting status backCorrect answer
   • BA full CodePipeline execution triggered on every pull request
   • CA nightly scheduled CodeBuild run over the main branch
   • DA test stage that runs after the merge to the main branch

   Why

   Trigger a CodeBuild project on the pull request event from the source repository and report the build status back so the merge is blocked on failure. A full CodePipeline execution on every pull request deploys artifacts the requirement excludes, running tests only after merge lets failures land on the main branch, and a nightly test run detects failures far too late.

5. 5.A pipeline deploys to an Amazon ECS service and must shift traffic to the new task set gradually, with automatic rollback if a CloudWatch alarm fires during the shift. What should be configured?

   • ADeleting and recreating the ECS service with the new task definition
   • BThe default ECS rolling update deployment type
   • CCodeDeploy blue/green for ECS with canary shifting and rollback alarmsCorrect answer
   • DDeploying the new task definition and comparing metrics manually

   Why

   Use CodeDeploy blue/green deployment for ECS with a canary or linear traffic-shifting configuration and alarms configured to trigger automatic rollback. The ECS rolling update replaces tasks in place without weighted traffic shifting or alarm-based rollback, recreating the service causes an outage, and a manual comparison cannot roll back automatically.

Practice all 65 questions

Frequently asked questions