DOP-C02 Practice Test 10 — 10 Questions

Question 1

A company uses AWS CodeCommit for source control. Developers frequently push large binary files, causing the repository size to exceed the recommended limit. What is the most efficient way to manage this situation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Git LFS (Large File Storage) and configure it to store binaries in S3.. Git LFS (Large File Storage) replaces large binary files in the repository with lightweight text pointers, while the actual binary content is stored in an external storage backend such as Amazon S3. This keeps the CodeCommit repository small and within recommended limits, and developers continue to use standard Git commands without performance degradation.

Answer

Increase the repository size limit in CodeCommit settings.

Answer

Periodically run a script to remove large files from the commit history.

Answer

Use S3 directly for storing binaries and reference them in code.

Question 2

A DevOps team uses AWS CodePipeline with an S3 source action and CodeBuild as a build provider. The pipeline has a manual approval step before deployment. Recently, the team noticed that the pipeline automatically starts when a new object is uploaded to the S3 bucket, even if the object is not the source code. They want to ensure that the pipeline only triggers on changes to the source code directory. What is the MOST efficient solution?

Accepted Answer

Configure the S3 event notification to use a prefix filter that matches the source code directory.. S3 event notifications support prefix and suffix filters, allowing you to specify that only objects uploaded to a particular directory (e.g., 'source-code/') trigger the event. By configuring the S3 event notification with a prefix filter matching the source code directory, the pipeline will only start when a new object is uploaded to that specific path, ignoring uploads to other directories. This is the most efficient solution as it avoids unnecessary pipeline executions without adding extra components or manual intervention.

Answer

Use Amazon CloudWatch Events to create a custom rule that matches the source code path and triggers the pipeline.

Answer

Enable versioning on the S3 bucket and configure the pipeline to use the latest version.

Answer

Disable the S3 trigger and manually start the pipeline after each code commit.

Question 3

A DevOps team uses AWS CodePipeline to automate deployments. The pipeline has a Deploy stage that uses AWS CloudFormation to create or update a stack. Recently, a stack update failed because the template referenced an AMI that was deprecated. The team wants to automatically roll back the stack to the last known good state if a deployment fails. What should they do?

Accepted Answer

Configure the CloudFormation deployment action in CodePipeline with 'ActionMode' set to 'CREATE_UPDATE' and check the 'Rollback on failure' option.. The CloudFormation deployment action in CodePipeline supports a 'Rollback on failure' option when 'ActionMode' is set to 'CREATE_UPDATE'. When enabled, if the stack update fails, CloudFormation automatically rolls back the stack to the last known good state (the previously deployed stack). This directly addresses the team's requirement to revert to a stable state after a failed deployment due to a deprecated AMI.

Answer

Use the CodePipeline console to enable 'Automatic rollback' for the Deploy stage.

Answer

Set the stack's 'DisableRollback' parameter to 'true' in the template.

Answer

Add a stack policy to the CloudFormation stack that denies updates to the AMI parameter.

Question 4

A company uses AWS CloudFormation to manage infrastructure. A stack update fails with the error: 'UPDATE_ROLLBACK_IN_PROGRESS'. The DevOps engineer needs to investigate the cause. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Review the CloudFormation console to identify which resource failed.. Options C, D, and E are correct. Option C: Reviewing the CloudFormation console directly shows which resource failed, enabling targeted investigation. Option D: Using '--retain-resources' preserves resources that failed to delete during rollback, allowing further analysis. Option E: Stack events contain detailed error messages and status updates that pinpoint the failure cause. Option A is incorrect because change sets are used to preview changes before execution, not for troubleshooting failures. Option B is incorrect because 'describe-stack-resource' returns details for a specific resource but does not provide the overall failure context and is not a primary troubleshooting step.

Answer

Create a change set to see what changes were attempted.

Answer

Use the 'describe-stack-resource' AWS CLI command to get the resource status.

Question 5

A company uses AWS CodeBuild to run unit tests and package a Java application. The build process takes 15 minutes. The team wants to reduce build time by caching dependencies. Which approach should the engineer recommend?

Accepted Answer

Configure CodeBuild to use Amazon S3 for cache storage and specify the cache directory in buildspec.yml. CodeBuild natively supports Amazon S3 for cache storage, allowing you to persist dependency directories across builds. By specifying the cache type as S3 and the path to the dependency cache (e.g., /root/.m2 for Maven) in the buildspec.yml, subsequent builds can reuse previously downloaded dependencies, significantly reducing build time without additional infrastructure.

Answer

Store the compiled dependencies in a separate CodeCommit repository and clone it during the build

Answer

Mount an Amazon EFS file system to the build container and persist the cache across builds

Answer

Use an Application Load Balancer in front of a private artifact repository

Question 6

A company uses AWS CodeCommit and wants to enforce that all commits to the 'main' branch are signed with a GPG key. Which steps should the DevOps engineer take to enforce this?

Accepted Answer

Create an IAM policy that denies git push actions unless the commit is signed.. AWS CodeCommit integrates with IAM to evaluate policies at the time of a `git push`. By creating an IAM policy that uses the `codecommit:GitPush` action with a `ForAnyValue:StringLike` condition key `codecommit:References` set to `refs/heads/main` and a `Bool` condition on `codecommit:IsSigned` set to `true`, you can deny pushes that are not signed. This enforces GPG signature verification at the IAM authorization layer, blocking unsigned commits before they reach the repository.

Answer

Use the AWS CLI to verify commit signatures and reject pushes.

Answer

Enable CloudWatch Logs to monitor commits and trigger a Lambda to rollback.

Answer

Configure a pre-receive hook in CodeCommit to reject unsigned commits.

Question 7

A development team uses AWS CodeBuild to compile a Java application. The build fails during the 'Install' phase with an error: 'Error: JAVA_HOME is not set'. How should the team fix this?

Accepted Answer

Set the environment variable 'JAVA_HOME' in the buildspec file's 'env' section.. The error 'JAVA_HOME is not set' indicates that the build environment lacks the required environment variable pointing to the Java installation. In AWS CodeBuild, the buildspec file's 'env' section allows you to define environment variables, including 'JAVA_HOME', which can be set to the path of the Java runtime (e.g., '/usr/lib/jvm/java-11-openjdk-amd64'). This ensures the variable is available during the Install phase, resolving the error without altering the build image or adding installation steps.

Answer

Use the managed image 'aws/codebuild/standard:5.0' which has Java pre-installed.

Answer

Install Java in the pre_build phase using a command.

Answer

Use a custom Docker image that has Java pre-installed.

Question 8

Refer to the exhibit. A team uses this buildspec.yml file in AWS CodeBuild. After the build, they expect the artifacts to be placed in a folder structure, but all files are in the root of the output artifact. What is the reason?

Accepted Answer

The 'discard-paths' option is set to 'yes', which flattens the directory structure.. The `discard-paths` option in the `artifacts` section of a buildspec.yml file, when set to `yes`, explicitly flattens the directory structure. This means that even if the `files` glob pattern `**/*` matches files in subdirectories, they are all placed at the root of the output artifact, discarding their original relative paths. Without this setting (or when set to `no`), the directory hierarchy would be preserved.

Answer

The 'files' section only includes '**/*' which does not preserve paths.

Answer

The 'base-directory' is not specified, so CodeBuild uses the root of the build output.

Answer

The 'name' property is missing, causing artifacts to be stored without structure.

Question 9

An organization uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests in CodeBuild. Recently, the pipeline failed because the Test stage took longer than expected, causing a pipeline execution timeout. The pipeline has a default timeout of 7 days. What is the MOST efficient way to set a maximum execution time for the Test stage without affecting other stages?

Accepted Answer

Modify the CodeBuild project's build timeout (e.g., 1 hour) in the buildspec or project configuration.. The CodeBuild project's build timeout setting directly controls the maximum duration a build can run before it is stopped. By setting this timeout to 1 hour in the CodeBuild project configuration or buildspec, the Test stage will automatically fail if it exceeds that limit, without affecting the pipeline's overall timeout or other stages. This is the most efficient and targeted approach, as it leverages a native CodeBuild feature rather than adding external monitoring or changing pipeline-wide settings.

Answer

Create an AWS Lambda function that stops the pipeline if the Test stage exceeds 1 hour.

Answer

Set the pipeline execution timeout to 1 hour in the pipeline settings.

Answer

Use Amazon CloudWatch Events to detect when the Test stage runs for more than 1 hour and then stop the pipeline.

Question 10

An organization uses AWS CodePipeline to deploy a serverless application using AWS Lambda and Amazon API Gateway. The pipeline includes a manual approval action. The team wants to ensure that the approval email is sent to multiple approvers and that any one of them can approve or reject. How should the approval action be configured?

Accepted Answer

Create an Amazon SNS topic with multiple subscribers, and configure the approval action to use that SNS topic ARN.. AWS CodePipeline's manual approval action can be configured to send notifications through an Amazon SNS topic. By creating an SNS topic with multiple subscribers (e.g., email addresses), any one of the subscribers can receive the approval request and take action (approve or reject). This satisfies the requirement for multiple approvers where any single approver can act.

Answer

Specify multiple email addresses in the 'ApproverEmail' field of the approval action.

Answer

Set the 'Approvers' field in the approval action to a comma-separated list of IAM user ARNs.

Answer

Add multiple IAM users to the pipeline's service role.