DOP-C02 Practice Test 16 — 15 Questions

Question 1

A DevOps team is designing a CI/CD pipeline for a microservices application. Each service is stored in a separate repository. The team wants to build and test only the services that changed in a given commit. Which AWS solution is MOST efficient and cost-effective?

Accepted Answer

Use AWS CodeBuild with a webhook that triggers builds only for repositories where files changed, using buildspec filters.. Option C is correct because AWS CodeBuild can use webhook events and filter by changed files to trigger builds only for affected services. Option A is incorrect because building all services wastes resources. Option B is incorrect because Lambda functions add unnecessary complexity. Option D is incorrect because it is not a native integration.

Answer

Use AWS CodeCommit triggers with Amazon SNS to send notifications and then manually trigger builds.

Answer

Use AWS CodePipeline with a single pipeline that builds all services on every commit.

Answer

Use Amazon EventBridge to detect repository changes and trigger AWS Lambda functions that determine which services changed.

Question 2

A developer wants to automate the creation of a new Amazon ECS service whenever a new Docker image is pushed to Amazon ECR. Which AWS service should be used to orchestrate this workflow?

Accepted Answer

Amazon EventBridge. Option A is correct because Amazon EventBridge can listen for ECR image push events and trigger a target (e.g., Lambda) to create the ECS service. Option B is incorrect because CloudWatch Logs is for log storage. Option C is incorrect because Step Functions is for state machines, not direct event triggers. Option D is incorrect because S3 is for object storage.

Answer

AWS Step Functions

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Question 3

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to deploy a CloudFormation stack set to all accounts in the organization. Which IAM permissions are REQUIRED for the stack set execution role?

Accepted Answer

iam:PassRole. Option B is correct because the stack set execution role must be able to pass the stack set's administrative role to CloudFormation in each target account. Option A is incorrect because 'cloudformation:CreateStackSet' is needed for the admin role, not the execution role. Option C is incorrect because 'iam:*' is overly permissive. Option D is incorrect because 'sts:AssumeRole' is needed but not sufficient on its own.

Answer

sts:AssumeRole

Answer

cloudformation:CreateStackSet

Answer

iam:*

Question 4

A developer wants to automatically deploy a new version of an AWS Lambda function whenever code is pushed to a specific branch in AWS CodeCommit. Which combination of services should be used?

Accepted Answer

AWS CodeCommit, Amazon EventBridge, AWS CodePipeline. Option A is correct because CodeCommit triggers an EventBridge event, which can invoke a pipeline or Lambda. Option B is incorrect because S3 is not needed. Option C is incorrect because CodeBuild alone does not deploy. Option D is incorrect because CloudWatch Logs is for monitoring.

Answer

AWS CodeCommit, Amazon S3, AWS Lambda

Answer

AWS CodeCommit, AWS CodeBuild

Answer

AWS CodeCommit, Amazon CloudWatch Logs

Question 5

A company uses AWS CodeDeploy with a blue/green deployment strategy for an Amazon EC2 Auto Scaling group. During deployment, the new instances are failing health checks and the deployment is rolling back. What is the MOST likely cause?

Accepted Answer

The new instances are not passing the configured health check grace period.. Option C is correct because failing health checks indicate the new instances are not ready. Option A is incorrect because CodeDeploy agent not running would cause a different error. Option B is incorrect because blue/green typically uses an ELB. Option D is incorrect because the deployment group already targets the ASG.

Answer

The application is not registered with an Elastic Load Balancer.

Answer

The deployment group is not configured to use an Auto Scaling group.

Answer

The CodeDeploy agent is not installed on the new instances.

Question 6

A team uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The deployment fails with an error: 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used in the deploy stage does not have permission to assume the CloudFormation execution role.. Option B is correct because 'sam deploy' requires valid AWS credentials; if the IAM role used by CodePipeline has insufficient permissions, it cannot assume the deployment role. Option A is incorrect because the build stage succeeded. Option C is incorrect because the template is already built. Option D is incorrect because the error points to credentials, not a missing parameter.

Answer

The build stage did not produce the correct output artifact.

Answer

The SAM template has a syntax error.

Answer

The 'sam deploy' command is missing the '--capabilities' parameter.

Question 7

A company wants to enforce that all infrastructure changes go through a CI/CD pipeline. Which AWS service can be used to prevent direct changes to production resources?

Accepted Answer

AWS Config. Option D is correct because AWS Config rules can detect changes and trigger remediation. Option A is incorrect because IAM alone does not prevent changes. Option B is incorrect because CloudTrail is for auditing. Option C is incorrect because Service Catalog is for pre-approved products.

Answer

AWS Service Catalog

Answer

AWS IAM

Answer

AWS CloudTrail

Question 8

A DevOps engineer is troubleshooting a failed CodePipeline execution. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. The build stage succeeds, but the deploy stage fails with 'No deployments found for the specified deployment group.' Which TWO actions should the engineer take to resolve this?

Accepted Answer

Confirm that the CodeDeploy deployment group exists in the same AWS Region as the pipeline.. Options A and D are correct. The error suggests the pipeline cannot find the deployment group, often due to incorrect configuration or region mismatch. Checking the deploy stage configuration ensures the deployment group name is correct. Verifying the deployment group exists confirms it's not deleted. Option B is unnecessary if the build succeeded. Option C is unrelated. Option E is about IAM, but the error message is about missing deployment group.

Answer

Update the IAM role for CodePipeline to allow it to list deployment groups.

Answer

Check the CodeBuild build logs for errors.

Answer

Ensure the CodeCommit repository has a valid commit.

Question 9

A company uses AWS CodeBuild to run security scans on code. The scan requires access to a private Amazon ECR repository for downloading scanning tools. The CodeBuild project is configured with a VPC and uses an IAM role. However, the build fails with 'Error: unable to pull image from registry.' Which TWO steps should be taken to resolve this?

Accepted Answer

Add 'ecr:GetDownloadUrlForLayer' and 'ecr:BatchGetImage' permissions to the CodeBuild service role.. Options A and C are correct. The error suggests the build environment cannot authenticate or reach ECR. Adding ECR permissions to the IAM role allows pulling images. Configuring VPC endpoints allows the build to reach ECR privately without NAT. Option B is unnecessary if the build already has a VPC. Option D is for public access, but the repository is private. Option E is about KMS, not related.

Answer

Change the ECR repository policy to allow public access.

Answer

Remove the VPC configuration from the CodeBuild project so it can access the public internet.

Answer

Grant 'kms:Decrypt' permissions for the KMS key used by ECR.

Question 10

A company wants to implement a CI/CD pipeline for an application that runs on Amazon ECS with Fargate. The pipeline should build a Docker image, push it to Amazon ECR, and deploy a new task definition to ECS. Which THREE AWS services are required to build this pipeline?

Accepted Answer

AWS CodeDeploy. Options A, B, and D are correct. CodeBuild builds the Docker image and pushes it to ECR. CodePipeline orchestrates the stages. CodeDeploy (or ECS directly) deploys the new task definition. Option C is not a deployment service. Option E is not needed because ECR is used.

Answer

Amazon S3

Answer

AWS CodeCommit

Question 11

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda. They want to automatically deploy the latest version of the Lambda function to production after running integration tests. The source code is in AWS CodeCommit. Which pipeline configuration should they use?

Accepted Answer

CodeCommit -> CodeBuild (test) -> CodeDeploy (Lambda deployment) -> Lambda.. The best practice is to use CodePipeline with CodeBuild for testing and CodeDeploy for Lambda deployment. Option B is correct.

Answer

CodeCommit -> CodeBuild (test) -> Lambda (deploy via update-function-code).

Answer

CodeCommit -> Lambda (deploy via S3 trigger) -> CodeBuild (test) -> production.

Answer

CodeCommit -> CodeBuild (test and deploy) -> Lambda via AWS CLI in buildspec.

Question 12

Refer to the exhibit. A CodePipeline service role has this IAM policy attached. The pipeline's deploy stage uses CodeDeploy to perform an ECS blue/green deployment. The deployment fails with an access denied error. What is the MOST likely missing permission?

Accepted Answer

ecs:UpdateService. Option C is correct because ECS blue/green deployments require the 'ecs:UpdateService' permission to update the service with the new task definition. The policy only allows 'ecs:DescribeServices'. Option A is not needed for blue/green. Option B is needed but already allowed. Option D is not a standard action.

Answer

ecs:RegisterTaskDefinition

Answer

codedeploy:CreateDeployment

Answer

ecs:CreateService

Question 13

Refer to the exhibit. A developer runs this buildspec in CodeBuild to deploy a CDK application. The build succeeds, but the CDK stack is not deployed. What is the MOST likely reason?

Accepted Answer

The CDK application has not been bootstrapped in the target account.. Option A is correct because CDK synth outputs to 'cdk.out' by default, but the artifacts specify 'cdk.out' as base-directory, so the deploy command runs in the build environment, not from the artifacts. However, the issue is that 'cdk deploy' runs in the build phase but the artifacts are collected after; but actually the deploy should happen in post_build. The more likely reason is that the CDK stack requires bootstrapping. Option B is incorrect because the runtime is sufficient. Option C is incorrect because the commands are valid. Option D is incorrect because the permissions might be missing, but the error would be different.

Answer

The 'npx cdk deploy' command should be in the build phase, not post_build.

Answer

The Node.js runtime version 14 is incompatible with the CDK version.

Answer

The IAM role for CodeBuild does not have permission to create CloudFormation stacks.

Question 14

A developer is using AWS CodeCommit as a source repository for a CodePipeline. They want to automatically start the pipeline when changes are pushed to the main branch. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that triggers the pipeline on CodeCommit 'push to main' events.. CodePipeline can use Amazon CloudWatch Events (EventBridge) to detect changes in CodeCommit and start the pipeline. Option A is correct.

Answer

Add a Lambda function that is invoked by CodeCommit triggers, which then starts the pipeline.

Answer

Configure the pipeline to poll the CodeCommit repository every 5 minutes.

Answer

Use a webhook from CodeCommit to the pipeline.

Question 15

Refer to the exhibit. A DevOps engineer sees this output when listing pipelines. The pipeline 'my-app-pipeline' has execution mode set to 'QUEUED'. The team reports that when multiple commits are pushed simultaneously, only the latest commit is deployed, and earlier ones are skipped. How should the pipeline execution mode be changed to ensure all commits are deployed?

Accepted Answer

Change the execution mode to 'PARALLEL'.. Option B is correct because 'PARALLEL' execution mode allows multiple pipeline executions to run concurrently, one per commit. Option A is incorrect because 'SUPERSEDED' would replace the current execution with a new one. Option C is incorrect because 'SERIAL' would queue them but run one at a time, potentially still skipping if a newer one supersedes. Option D is incorrect because V2 pipelines support only 'QUEUED' and 'SUPERSEDED', not 'PARALLEL'.

Answer

Change the execution mode to 'SUPERSEDED'.

Answer

Upgrade the pipeline to V2 type which supports 'QUEUED' mode.

Answer

Change the execution mode to 'SERIAL'.