1
AWS Certified DevOps Engineer –
Professional (DOP-C02) Practice
Exam 150 Advanced Multiple-
Choice Questions with Answers
and Rationales a well detailed
one written and
graded A+ upgraded
Domain 1: SDLC Automation (22%)
Question 1
A company uses AWS CodePipeline with a GitHub source action, CodeBuild build stage, and
CodeDeploy deployment stage. The DevOps team notices that the pipeline frequently fails
during the deployment stage because the CodeDeploy application revision contains
configuration files that are incompatible with the target environment. Which approach should
the team implement to detect these issues EARLIEST in the pipeline while minimizing additional
costs?
, 2
A. Add a manual approval step before the deployment stage and have an operator review the
revision
B. Implement a canary deployment strategy in CodeDeploy to test the revision on a small
percentage of instances
C. Add a test stage in CodePipeline that uses CodeBuild to run integration tests against a staging
environment
D. Configure CodeDeploy to perform a dry-run deployment that validates the revision without
actually deploying
- detailed answer 100% correct :- C
Rationale: Adding a test stage that runs integration tests against a staging environment catches
configuration incompatibilities before production deployment. This follows the shift-left testing
principle—detecting issues earlier in the pipeline reduces the cost of fixing them. Manual
approval (A) introduces human error and delay. Canary deployment (B) still exposes some
production traffic to a bad revision. CodeDeploy does not natively support dry-run deployments
for revision validation (D).
Question 2
A DevOps engineer is designing a CI/CD pipeline for a microservices application deployed on
Amazon ECS with Fargate. The organization requires that each microservice can be deployed
independently with zero downtime. The pipeline must also support automatic rollback if the
deployment fails health checks. Which combination of AWS services and deployment strategies
should the engineer use?
A. CodePipeline with CodeDeploy using the blue/green deployment strategy and an ECS
deployment controller
B. CodePipeline with CodeBuild and an ECS rolling update deployment with CloudWatch alarms
for rollback
C. CodePipeline with CodeDeploy using the canary deployment strategy and manual rollback
approval
D. CodePipeline with CodeBuild pushing to ECR, followed by an ECS service update with forced
new deployment
- detailed answer 100% correct :- A
Rationale: CodeDeploy's blue/green deployment strategy for ECS provides zero-downtime
deployments, independent service deployment, and automatic rollback based on CloudWatch
alarm thresholds. Rolling updates (B) don't provide the same traffic-shifting control. Canary
, 3
deployments (C) require manual rollback in this option, which is not optimal. Option D lacks
automated rollback capabilities.
Question 3
A company uses AWS CodeBuild for building container images. The build process takes 15
minutes, and the team wants to reduce this time. The buildspec.yml file currently installs
dependencies, runs tests, and builds the Docker image in a single build phase. Which
optimization would MOST effectively reduce build time?
A. Use a larger compute type for the CodeBuild project
B. Enable Docker layer caching in CodeBuild
C. Split the build into multiple CodeBuild projects running in parallel
D. Use an S3 cache for dependencies and enable build cache in CodeBuild
- detailed answer 100% correct :- B
Rationale: Docker layer caching in CodeBuild reuses cached layers from previous builds,
dramatically reducing build time when only application code changes. While larger compute (A)
helps, it doesn't address the root cause of repeated dependency installation. Parallel builds (C)
add complexity. S3 cache (D) is useful for dependencies but Docker layer caching is more
impactful for container builds.
Question 4
A DevOps engineer is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline must
deploy to multiple AWS accounts (dev, test, prod) with different configurations. What is the
MOST secure and maintainable approach to manage cross-account deployment permissions?
A. Create separate IAM users in each account with identical access keys and store them in
CodePipeline
B. Use AWS Organizations and create cross-account IAM roles with appropriate trust policies
C. Store temporary credentials in AWS Secrets Manager and rotate them daily
D. Use the same IAM role across all accounts with resource-based policies restricting access
- detailed answer 100% correct :- B
Rationale: Using IAM roles with cross-account trust relationships is the AWS best practice for
secure cross-account access. It follows the principle of least privilege, eliminates long-term
credentials, and is maintainable through AWS Organizations. Storing access keys (A) creates
, 4
security risks. Temporary credentials (C) add unnecessary complexity. A single role (D) violates
the principle of least privilege.
Question 5
A team uses AWS CodeDeploy with an in-place deployment strategy for an Auto Scaling group.
After a recent deployment, the application failed, requiring manual intervention to roll back.
The team wants to implement automatic rollback when the deployment fails. Which
CodeDeploy configuration should they use?
A. Configure the deployment group with a rollback trigger based on CloudWatch alarm
thresholds
B. Set the deployment configuration to use a canary deployment strategy with automatic
rollback
C. Configure the deployment group to automatically roll back when a deployment fails
D. Use AWS Systems Manager Automation to revert the deployment on failure
- detailed answer 100% correct :- C
Rationale: CodeDeploy deployment groups have a built-in "automatically roll back when a
deployment fails" option that reverts to the last successful deployment revision. CloudWatch
alarms (A) trigger rollbacks based on metrics after successful deployment, not deployment
failures. Canary (B) is a deployment strategy, not a rollback configuration. Systems Manager (D)
adds unnecessary complexity.
Question 6
A company wants to implement blue/green deployments for an application running on EC2
instances behind an Application Load Balancer. The DevOps engineer needs to ensure zero
downtime during the deployment. Which CodeDeploy deployment configuration should be
used?
A. CodeDeployDefault.AllAtOnce
B. CodeDeployDefault.HalfAtATime
C. CodeDeployDefault.OneAtATime
D. CodeDeployDefault.BlueGreen
- detailed answer 100% correct :- D
Rationale: CodeDeployDefault.BlueGreen is the deployment configuration specifically designed
for blue/green deployments with an ALB. It provisions the green environment, shifts traffic from
AWS Certified DevOps Engineer –
Professional (DOP-C02) Practice
Exam 150 Advanced Multiple-
Choice Questions with Answers
and Rationales a well detailed
one written and
graded A+ upgraded
Domain 1: SDLC Automation (22%)
Question 1
A company uses AWS CodePipeline with a GitHub source action, CodeBuild build stage, and
CodeDeploy deployment stage. The DevOps team notices that the pipeline frequently fails
during the deployment stage because the CodeDeploy application revision contains
configuration files that are incompatible with the target environment. Which approach should
the team implement to detect these issues EARLIEST in the pipeline while minimizing additional
costs?
, 2
A. Add a manual approval step before the deployment stage and have an operator review the
revision
B. Implement a canary deployment strategy in CodeDeploy to test the revision on a small
percentage of instances
C. Add a test stage in CodePipeline that uses CodeBuild to run integration tests against a staging
environment
D. Configure CodeDeploy to perform a dry-run deployment that validates the revision without
actually deploying
- detailed answer 100% correct :- C
Rationale: Adding a test stage that runs integration tests against a staging environment catches
configuration incompatibilities before production deployment. This follows the shift-left testing
principle—detecting issues earlier in the pipeline reduces the cost of fixing them. Manual
approval (A) introduces human error and delay. Canary deployment (B) still exposes some
production traffic to a bad revision. CodeDeploy does not natively support dry-run deployments
for revision validation (D).
Question 2
A DevOps engineer is designing a CI/CD pipeline for a microservices application deployed on
Amazon ECS with Fargate. The organization requires that each microservice can be deployed
independently with zero downtime. The pipeline must also support automatic rollback if the
deployment fails health checks. Which combination of AWS services and deployment strategies
should the engineer use?
A. CodePipeline with CodeDeploy using the blue/green deployment strategy and an ECS
deployment controller
B. CodePipeline with CodeBuild and an ECS rolling update deployment with CloudWatch alarms
for rollback
C. CodePipeline with CodeDeploy using the canary deployment strategy and manual rollback
approval
D. CodePipeline with CodeBuild pushing to ECR, followed by an ECS service update with forced
new deployment
- detailed answer 100% correct :- A
Rationale: CodeDeploy's blue/green deployment strategy for ECS provides zero-downtime
deployments, independent service deployment, and automatic rollback based on CloudWatch
alarm thresholds. Rolling updates (B) don't provide the same traffic-shifting control. Canary
, 3
deployments (C) require manual rollback in this option, which is not optimal. Option D lacks
automated rollback capabilities.
Question 3
A company uses AWS CodeBuild for building container images. The build process takes 15
minutes, and the team wants to reduce this time. The buildspec.yml file currently installs
dependencies, runs tests, and builds the Docker image in a single build phase. Which
optimization would MOST effectively reduce build time?
A. Use a larger compute type for the CodeBuild project
B. Enable Docker layer caching in CodeBuild
C. Split the build into multiple CodeBuild projects running in parallel
D. Use an S3 cache for dependencies and enable build cache in CodeBuild
- detailed answer 100% correct :- B
Rationale: Docker layer caching in CodeBuild reuses cached layers from previous builds,
dramatically reducing build time when only application code changes. While larger compute (A)
helps, it doesn't address the root cause of repeated dependency installation. Parallel builds (C)
add complexity. S3 cache (D) is useful for dependencies but Docker layer caching is more
impactful for container builds.
Question 4
A DevOps engineer is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline must
deploy to multiple AWS accounts (dev, test, prod) with different configurations. What is the
MOST secure and maintainable approach to manage cross-account deployment permissions?
A. Create separate IAM users in each account with identical access keys and store them in
CodePipeline
B. Use AWS Organizations and create cross-account IAM roles with appropriate trust policies
C. Store temporary credentials in AWS Secrets Manager and rotate them daily
D. Use the same IAM role across all accounts with resource-based policies restricting access
- detailed answer 100% correct :- B
Rationale: Using IAM roles with cross-account trust relationships is the AWS best practice for
secure cross-account access. It follows the principle of least privilege, eliminates long-term
credentials, and is maintainable through AWS Organizations. Storing access keys (A) creates
, 4
security risks. Temporary credentials (C) add unnecessary complexity. A single role (D) violates
the principle of least privilege.
Question 5
A team uses AWS CodeDeploy with an in-place deployment strategy for an Auto Scaling group.
After a recent deployment, the application failed, requiring manual intervention to roll back.
The team wants to implement automatic rollback when the deployment fails. Which
CodeDeploy configuration should they use?
A. Configure the deployment group with a rollback trigger based on CloudWatch alarm
thresholds
B. Set the deployment configuration to use a canary deployment strategy with automatic
rollback
C. Configure the deployment group to automatically roll back when a deployment fails
D. Use AWS Systems Manager Automation to revert the deployment on failure
- detailed answer 100% correct :- C
Rationale: CodeDeploy deployment groups have a built-in "automatically roll back when a
deployment fails" option that reverts to the last successful deployment revision. CloudWatch
alarms (A) trigger rollbacks based on metrics after successful deployment, not deployment
failures. Canary (B) is a deployment strategy, not a rollback configuration. Systems Manager (D)
adds unnecessary complexity.
Question 6
A company wants to implement blue/green deployments for an application running on EC2
instances behind an Application Load Balancer. The DevOps engineer needs to ensure zero
downtime during the deployment. Which CodeDeploy deployment configuration should be
used?
A. CodeDeployDefault.AllAtOnce
B. CodeDeployDefault.HalfAtATime
C. CodeDeployDefault.OneAtATime
D. CodeDeployDefault.BlueGreen
- detailed answer 100% correct :- D
Rationale: CodeDeployDefault.BlueGreen is the deployment configuration specifically designed
for blue/green deployments with an ALB. It provisions the green environment, shifts traffic from
