DOP-C02 SDLC Automation Practice Questions

Question 1

A company uses AWS CodePipeline with a multi-branch strategy. A new feature branch triggers a pipeline that runs unit tests and deploys to a test environment. The deployment step uses AWS CodeDeploy with a deployment group configured for in-place deployment to Amazon EC2 instances. The deployment fails intermittently with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The instances are healthy and pass health checks. What is the most likely cause?

Accepted Answer

A previous deployment is still in progress or frozen in the CodeDeploy deployment group.. Option D is correct because CodeDeploy enforces a per-deployment-group concurrency limit of one deployment at a time. If a previous deployment is still in progress or in a 'frozen' state (e.g., due to a failed or stopped deployment that hasn't been explicitly rolled back or cleaned up), new deployments will fail with the 'too many individual instances failed' error even when instances are healthy. The error message is misleading because it reflects CodeDeploy's inability to proceed with the new deployment, not actual instance health issues.

Answer

The pipeline has a failed execution that is blocking subsequent executions.

Answer

The CodeDeploy agent on the instances is not running, causing the deployment to fail.

Answer

The pipeline is configured with a high frequency of changes, causing throttling from CodePipeline.

Question 2

A development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?

Accepted Answer

Configure CodeBuild to cache dependencies in an Amazon S3 bucket.. Caching dependencies in an Amazon S3 bucket allows CodeBuild to reuse previously downloaded Maven/Gradle dependencies across builds, eliminating the need to re-download them each time. Since the codebase and dependencies are stable, this directly reduces the build time by avoiding repeated network transfers of large artifact repositories.

Answer

Move the build process to a local developer machine to avoid CodeBuild overhead.

Answer

Reduce the number of unit tests executed in the build phase.

Answer

Increase the compute type of the build environment to a larger instance.

Question 3

A company uses AWS CodePipeline with multiple stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The build stage runs a series of tests, and if they pass, the pipeline proceeds to deploy. Recently, a developer committed a change that passed all tests but caused a production outage. The team wants to add an approval step before the deploy stage, but they also want to ensure that only changes from specific branches can be deployed. What is the MOST secure and maintainable way to enforce this?

Accepted Answer

Create a separate pipeline for each allowed branch, with the approval step only in the production pipeline.. Option C is correct because it enforces branch-based deployment at the pipeline level, ensuring that only changes from specific branches trigger the production pipeline with the approval step. This approach is secure and maintainable as it leverages AWS CodePipeline's native ability to trigger on branch events, avoiding custom logic or manual verification. By isolating production deployments to a dedicated pipeline, the team reduces the risk of unauthorized or untested code reaching production.

Answer

Use a Lambda function in the pipeline to check the branch name and fail if not allowed.

Answer

Add a manual approval step in the pipeline and rely on the approver to verify the branch.

Answer

Tag the source artifacts with the branch name and use a condition in CodePipeline to allow only specific tags.

Question 4

A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled JARs) to the repository, causing the repository size to grow rapidly and slowing down clone operations. The team wants to enforce a policy to reject pushes that contain files larger than 50 MB. Which approach should be used?

Accepted Answer

Configure a CodeCommit trigger that invokes an AWS Lambda function to validate file sizes and reject the push.. Option A is correct because AWS CodeCommit supports custom triggers that invoke AWS Lambda functions on repository events, including pushes. By configuring a trigger for the 'push' event, a Lambda function can inspect each file in the push payload, check its size against the 50 MB threshold, and programmatically reject the push by returning an error response. This approach enforces the policy at the repository level without requiring client-side changes.

Answer

Set up an Amazon CloudWatch Events rule to monitor repository size and alert when it exceeds a threshold.

Answer

Create an IAM policy that denies the `codecommit:GitPush` action if the file size exceeds 50 MB.

Answer

Use a pre-receive hook in the repository to reject large files by generating an S3 pre-signed URL.

Question 5

An organization uses AWS CodePipeline to orchestrate deployments to multiple environments (dev, test, prod). Each environment uses a different AWS account. The pipeline uses cross-account actions with IAM roles. Recently, the pipeline failed at the deploy stage for the prod account with the error 'Access Denied' when assuming the cross-account role. The role ARN is correct and the trust policy allows the pipeline's service role. What is the MOST likely cause?

Accepted Answer

The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.. The pipeline's service role must have an `sts:AssumeRole` permission on the cross-account role to perform the role assumption. Even if the trust policy on the cross-account role allows the pipeline's service role, the pipeline's service role itself needs an IAM policy granting `sts:AssumeRole` for the cross-account role ARN. Without this permission, the `AssumeRole` API call fails with 'Access Denied', which is the exact error described.

Answer

The EC2 instances in the prod account do not have an appropriate instance profile.

Answer

The cross-account role's permissions boundary denies the deploy action.

Answer

The pipeline's service role does not have permission to perform the deploy action in the prod account.

Question 6

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is Blue/Green. During a recent deployment, the new instances passed all health checks, but traffic was not routed to them. What is the most likely reason?

Accepted Answer

The target group associated with the Auto Scaling group is not properly configured to route traffic.. In a Blue/Green deployment with CodeDeploy and an Auto Scaling group, traffic routing is handled by a load balancer target group. If the target group is not properly configured to route traffic to the new instances (e.g., missing or incorrect listener rules, deregistration delay, or health check thresholds), the instances may pass health checks but never receive traffic. This is the most likely cause because the deployment succeeded in provisioning and validating the new instances, but the load balancer did not forward requests to them.

Answer

The deployment group is not configured to use a load balancer.

Answer

The Auto Scaling group's lifecycle hook failed to signal readiness.

Answer

The CodeDeploy agent on the new instances is not installed.

Question 7

A company uses AWS CodePipeline with a source stage from Amazon S3 and a deploy stage to AWS Elastic Beanstalk. The pipeline has been working for months, but recently the deploy stage started failing with the error 'The S3 object does not exist.' The source artifact is uploaded to the S3 bucket by an external system. Which TWO actions should be taken to resolve this issue? (Choose TWO.)

Accepted Answer

Ensure the external system does not overwrite the object after the pipeline execution starts.. Option A is correct because the deploy stage fails with 'The S3 object does not exist' when the external system overwrites the source artifact after the pipeline execution starts. CodePipeline references the object by its key at the time the pipeline is triggered; if the object is replaced (i.e., deleted and re-uploaded with the same key), the pipeline may attempt to download a version that no longer exists, especially if the S3 bucket is not versioned. Ensuring the external system does not overwrite the object during execution prevents this race condition.

Answer

Change the source stage to use AWS CodeCommit instead of S3.

Answer

Use server-side encryption with AWS KMS (SSE-KMS) on the S3 bucket.

Answer

Increase the timeout for the deploy stage in the pipeline.

Question 8

A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own code repository and build artifacts. The team wants to use AWS CodePipeline with multiple parallel actions to build and test all microservices simultaneously. They also want to ensure that if one microservice's build fails, the pipeline does not block other microservices. Which THREE steps should the team take? (Choose THREE.)

Accepted Answer

Use a parallel action group with separate build actions for each microservice.. Option A is correct because using a parallel action group with separate build actions for each microservice allows all microservices to be built simultaneously within a single pipeline. This design ensures that if one microservice's build fails, the other parallel actions continue unaffected, as CodePipeline treats each action in a parallel group independently.

Answer

Configure the pipeline to block subsequent stages if any build action fails.

Answer

Configure a single build action that sequentially builds all microservices.

Question 9

A large enterprise uses a multi-account AWS strategy with a centralized DevOps account. The DevOps account hosts an AWS CodePipeline that deploys a critical application to production account (111111111111) using AWS CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy). The deploy stage uses a cross-account role (arn:aws:iam::111111111111:role/CrossAccountDeployRole) to perform the deployment. The trust policy on that role allows the DevOps account's CodePipeline service role (arn:aws:iam::222222222222:role/CodePipelineServiceRole) to assume it. The pipeline has been working for months, but after a recent security audit, the security team tightened permissions. Now the deploy stage fails with the error: 'User: arn:aws:sts::222222222222:assumed-role/CodePipelineServiceRole/AWS-CodePipeline-xxx is not authorized to perform: codedeploy:CreateDeployment on resource: arn:aws:codedeploy:us-east-1:111111111111:deploymentgroup:MyApp/MyDG'. The DevOps team has verified that the CrossAccountDeployRole has a permissions policy that allows 'codedeploy:*' on all resources. The CodePipelineServiceRole has a permissions policy that allows 'sts:AssumeRole' on the CrossAccountDeployRole. What is the most likely cause and what action should be taken to resolve the issue?

Accepted Answer

Check the permissions boundary on CrossAccountDeployRole and add a boundary that allows CodeDeploy actions.. Option C is correct because the error indicates that the assumed role (CrossAccountDeployRole) is not authorized to perform codedeploy:CreateDeployment, despite having a permissions policy that allows codedeploy:* on all resources. This typically occurs when a permissions boundary is attached to the role that restricts the effective permissions, overriding the permissions policy. Adding a permissions boundary that allows CodeDeploy actions resolves the issue by ensuring the role's effective permissions include the necessary CodeDeploy operations.

Answer

Add 'sts:AssumeRole' to the permissions policy of CodePipelineServiceRole.

Answer

Create the deployment group in the production account again to reset permissions.

Answer

Update the trust policy of CrossAccountDeployRole to include the DevOps account ID.

Question 10

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. They have configured a CodeBuild project that triggers on pushes to the 'develop' branch. The build runs unit tests and packages the application. However, developers report that the pipeline fails intermittently with a 'BUILD_FAILED' status due to test failures, but the tests pass locally. What is the MOST likely cause of this discrepancy?

Accepted Answer

The CodeBuild project has different environment variables or dependency versions compared to the local environment.. Option D is correct because the most common cause of tests passing locally but failing in CodeBuild is environment inconsistency. CodeBuild runs in a managed environment with specific runtime versions, environment variables, and dependency caches that may differ from the developer's local machine. This discrepancy can lead to test failures due to different library versions, missing environment variables, or platform-specific behaviors.

Answer

The CodeBuild project is configured with a VPC that restricts access to external dependency repositories.

Answer

The CodePipeline has a timeout setting that causes the build to be terminated before tests complete.

Answer

The CodePipeline is configured with a branch filter that only triggers on the 'main' branch.

SDLC Automation

DOP-C02 SDLC Automation — Key Topics

Where candidates lose marks on SDLC Automation