DOP-C02 Practice Test 17 — 15 Questions

Question 1

A company uses AWS CodePipeline with an S3 source action and a CodeBuild project. The pipeline fails intermittently during the build stage with an error indicating that the source code archive is corrupt. Which action should the DevOps engineer take to resolve this issue?

Accepted Answer

Enable versioning on the S3 bucket and use versioned objects in the pipeline.. Enabling versioning on the S3 bucket ensures that object versions are preserved, preventing corruption from overwrites. Option D is correct because using S3 source with versioning guarantees that the pipeline always retrieves the correct version.

Answer

Increase the timeout for the CodeBuild project.

Answer

Configure the pipeline to use AWS CodeCommit as the source instead of S3.

Answer

Add a manual approval step before the build stage.

Question 2

A DevOps team is implementing a CI/CD pipeline for a microservices architecture on AWS ECS. They want to ensure zero-downtime deployments and automatic rollback if health checks fail. Which combination of services should they use?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment and CloudWatch alarms for automatic rollback.. CodeDeploy with ECS blue/green deployment and CloudWatch alarms for rollback provides zero-downtime and automatic rollback. Option B is correct.

Answer

AWS CodePipeline with ECS rolling update and manual rollback.

Answer

AWS Elastic Beanstalk with rolling deployment and enhanced health reporting.

Answer

AWS CloudFormation with ECS service update and SNS notification on failure.

Question 3

A developer wants to automatically run unit tests when a pull request is created in AWS CodeCommit. Which AWS service should be used to trigger the tests?

Accepted Answer

Amazon EventBridge rule for CodeCommit pull request state changes targeting AWS Lambda.. CodeCommit can trigger Amazon EventBridge events on pull request creation, which can invoke a Lambda function to run tests. Option C is correct.

Answer

AWS CodePipeline with source polling.

Answer

AWS CodeBuild with webhooks from CodeCommit.

Answer

AWS CloudWatch Logs subscription filter for repository logs.

Question 4

Which THREE practices help ensure the security of a CI/CD pipeline that deploys to production? (Choose three.)

Accepted Answer

Integrate static code analysis and vulnerability scanning into the pipeline.. A: Encryption of artifacts in transit and at rest protects sensitive data. B: Scanning for vulnerabilities in dependencies and code helps prevent insecure deployments. D: Using least privilege IAM roles minimizes risk. C is wrong because storing credentials in the source repository is insecure. E is wrong because manual approval alone does not ensure security; automated checks are also needed.

Answer

Require manual approval for all deployments to production.

Answer

Store deployment credentials in the source repository for traceability.

Question 5

During a deployment using AWS CodeDeploy, the deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment group is configured with a minimum healthy instances of 75%. What could be the cause?

Accepted Answer

More than 25% of the instances failed the deployment.. Option A is correct because the error indicates too many instances failed or are unhealthy. The minimum healthy instances setting of 75% means at least 75% of instances must remain healthy; if more than 25% fail, the deployment fails. Option B is wrong because IAM permissions would cause a different error. Option C is wrong because that error would be about failing to reach instances. Option D is wrong because CodeDeploy agent timeout would show a specific error.

Answer

The deployment configuration timeout is too short.

Answer

The CodeDeploy service role does not have sufficient permissions.

Answer

The instances are not running the CodeDeploy agent.

Question 6

A company is using AWS CodePipeline to deploy a static website to Amazon S3. The pipeline includes a CodeBuild step that minifies JavaScript files. Recently, the build step started failing with an error: 'Error: ENOENT: no such file or directory, open 'index.js''. What is the most likely cause?

Accepted Answer

The CodeBuild project's working directory is not set to the source directory.. The error suggests that the working directory in CodeBuild is not set to the source directory where index.js resides. Option D is correct.

Answer

The source code was not uploaded to S3 correctly.

Answer

The S3 bucket policy is blocking access to the source code.

Answer

The buildspec.yml file is missing the 'phases' section.

Question 7

A team uses AWS CodePipeline with multiple parallel actions in a stage. They notice that when one action fails, the entire stage fails and no further actions are attempted. They want the pipeline to continue with the remaining actions even if one fails, and then report the failure at the end. Which feature should they use?

Accepted Answer

Configure each action with 'On failure' set to 'CONTINUE'.. CodePipeline supports a 'RunOrder' but also a 'Failure mode' per action. However, to allow continuation, they need to set the 'On failure' for the stage to 'ROLLBACK' or 'FAIL'. Actually, the correct approach is to use a custom action or set the 'RunOrder' such that actions are independent. The best practice is to use 'FAILURE' mode as 'CONTINUE' is not available; instead, they should set the stage's 'On failure' to 'FAIL' and use a separate stage for error handling. But the question asks for a specific feature: 'Retry on failure' with a maximum count. Option C is correct because setting retry allows the pipeline to continue after a transient failure, but for permanent failure, they need to use 'Failure mode' per action. Actually, CodePipeline now supports 'On failure' for actions: 'ABORT' or 'CONTINUE'. So using 'CONTINUE' on failure for the action will let the pipeline continue. Option C is correct.

Answer

Configure each action with a 'RunOrder' of 1 and set 'On failure' to 'ABORT'.

Answer

Set the stage's 'On failure' to 'ROLLBACK'.

Answer

Use a custom Lambda function to catch failures and resume the pipeline.

Question 8

A company uses AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yml includes a 'post_build' phase command to tag the image. The build fails with 'unauthorized: authentication required'. What must be done to resolve this?

Accepted Answer

Add 'ecr:InitiateLayerUpload' and 'ecr:CompleteLayerUpload' permissions to the CodeBuild service role.. CodeBuild needs permission to push to ECR. The IAM role must have appropriate ECR permissions. Option A is correct.

Answer

Use the 'docker login' command with AWS CLI in the build phase.

Answer

Install the AWS CLI in the CodeBuild build environment.

Answer

Create a new IAM user with ECR permissions and store the keys in CodeBuild environment variables.

Question 9

A company is using AWS CodeCommit for source control and wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created against the main branch. Which AWS service should be used to connect CodeCommit events to CodeBuild?

Accepted Answer

Amazon EventBridge. Option C is correct because Amazon EventBridge can capture CodeCommit repository events (like pull request creation) and route them to targets such as CodeBuild projects. Option A is wrong because AWS CodePipeline is a CI/CD orchestration service, not a direct event trigger. Option B is wrong because Amazon SNS is a notification service, not a build trigger. Option D is wrong because AWS Lambda can be used as an intermediary but is not the direct connection; EventBridge is the correct native integration.

Answer

AWS CodePipeline

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 10

A company has a multi-account AWS environment with separate accounts for development, staging, and production. They want to implement a CI/CD pipeline that deploys to each account sequentially after manual approvals. Which setup allows cross-account deployment with CodePipeline?

Accepted Answer

Create an IAM role in the target account with permissions for the pipeline service role to assume, and use that role in the deployment action.. Cross-account deployment requires an IAM role in the target account that the pipeline can assume. Option D is correct.

Answer

Create separate pipelines in each account and trigger them via SNS from a master pipeline.

Answer

Use CodePipeline with cross-account actions by specifying the target account ID and region.

Answer

Use a single pipeline in the management account with different stages for each account.

Question 11

Which TWO actions are best practices when designing a CI/CD pipeline for a containerized application on Amazon ECS? (Choose two.)

Accepted Answer

Separate the build stage from the deploy stage in the pipeline.. Using separate build and deploy stages (C) is a best practice for separation of concerns. Using a blue/green deployment strategy (D) ensures zero-downtime. A is wrong because building the image inside the deployment stage conflates steps. B is wrong because running a full integration test suite in every commit slows down the pipeline; tests should be optimized. E is wrong because rolling update may cause downtime; blue/green is preferred for zero-downtime.

Answer

Run a full integration test suite on every commit to the repository.

Answer

Build the Docker image in the deploy stage to ensure consistency.

Answer

Use a rolling update with a fixed number of tasks for deployment.

Question 12

A company is implementing a blue/green deployment strategy for an application running on Amazon ECS with AWS Fargate. The team wants to use AWS CodeDeploy to orchestrate the deployment. What is the minimum IAM permissions needed for CodeDeploy to register the new task set and shift traffic?

Accepted Answer

ecs:RegisterTaskDefinition, ecs:UpdateService, elasticloadbalancing:RegisterTargets. Option C provides the minimum required actions: ecs:RegisterTaskDefinition to create the new task definition, ecs:UpdateService to modify the service, and elasticloadbalancing:RegisterTargets to register the new task set with the target group. Option A is incomplete because it lacks ecs:UpdateService. Option B is wrong because it includes ecs:CreateService which is not needed. Option D is wrong because it includes iam:PassRole which is not needed by CodeDeploy directly.

Answer

ecs:RegisterTaskDefinition, elasticloadbalancing:RegisterTargets

Answer

ecs:RegisterTaskDefinition, ecs:UpdateService, iam:PassRole

Answer

ecs:CreateService, ecs:UpdateService, elasticloadbalancing:RegisterInstancesWithLoadBalancer

Question 13

Which THREE steps are required to set up a cross-account CodePipeline that deploys to an EC2 instance in a target account? (Choose three.)

Accepted Answer

Create an IAM role in the target account with permissions to deploy to EC2.. A: The pipeline needs an IAM role to assume in the target account. C: The target account must trust the pipeline account to allow role assumption. D: The pipeline service role must have permission to assume the target role. B is not required because the pipeline can be in the source account. E is not required because the pipeline uses the assumed role, not the target account's pipeline.

Answer

Configure the pipeline to use the target account's default KMS key for artifacts.

Answer

Create a CodePipeline in the target account.

Question 14

A team uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests against a staging environment. Occasionally, the tests fail due to environment issues, not code issues. The team wants to automatically retry the Test stage up to two times if it fails, but not the Deploy stage. How can this be achieved?

Accepted Answer

Configure the Retry setting in the Test stage's action configuration.. Option B is correct because CodePipeline allows configuring retry on a per-stage basis in the pipeline structure. Option A is wrong because there is no global retry setting. Option C is wrong because Step Functions would add complexity and is not native. Option D is wrong because CloudWatch Events can trigger retries but not in a simple way; the native retry is simpler.

Answer

Create a CloudWatch Events rule that triggers a Lambda function to retry the failed stage.

Answer

Enable the 'Retry on failure' option in the CodePipeline pipeline settings.

Answer

Use AWS Step Functions to orchestrate the pipeline and implement retries.

Question 15

Which TWO are valid use cases for using AWS CodeArtifact in a CI/CD pipeline? (Choose two.)

Accepted Answer

Caching dependencies from public repositories to improve build speed and reliability.. A: CodeArtifact can store npm packages for use in CodeBuild. C: It can proxy public registries to reduce external dependencies. B is wrong because CodeArtifact stores artifacts, not source code. D is wrong because Docker images are stored in ECR, not CodeArtifact (which supports npm, Maven, PyPI, etc.). E is wrong because CodeArtifact does not host static websites.

Answer

Storing Docker images that are used by ECS tasks.

Answer

Storing source code archives for use in deployment stages.

Answer

Hosting static website assets for deployment to S3.