DOP-C02 Practice Test 18 — 15 Questions

Question 1

A DevOps engineer is creating a CodePipeline service role. The above IAM policy is attached to the role. The pipeline fails when trying to download artifacts from the S3 bucket. What is the issue?

Accepted Answer

The policy is missing s3:ListBucket permission on the bucket.. The policy allows s3:GetObject on the bucket, but it does not allow s3:ListBucket. CodePipeline needs to list objects in the bucket to find the artifact. Option C is correct.

Answer

The Resource for S3 actions should be the bucket ARN, not the object ARN.

Answer

The CodeDeploy actions require a specific resource ARN instead of '*'.

Answer

The Action list is missing s3:GetObjectVersion.

Question 2

A company is migrating from Jenkins to AWS CodeBuild. They have hundreds of Jenkins jobs that run on a schedule. Some jobs take hours and must not overlap. What is the most efficient way to migrate these jobs to CodeBuild while ensuring no overlapping builds?

Accepted Answer

Use Amazon CloudWatch Events to trigger a Lambda function that checks the build status before starting a new build.. Option C is correct because you can use a CloudWatch Events rule scheduled to trigger a Lambda function that checks if a previous build is running (using the CodeBuild API) before starting a new one. Option A is wrong because buildspec does not control scheduling or concurrency. Option B is wrong because different projects can run concurrently, but the issue is within the same job. Option D is wrong because there is no built-in queue for same project; you must implement it.

Answer

Create a buildspec file that includes a sleep command to stagger start times.

Answer

Configure the CodeBuild project with a concurrent build limit of 1.

Answer

Set up a separate CodeBuild project for each job and use a custom retry policy.

Question 3

A team uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a deployment stage that uses AWS CodeDeploy to copy files to an S3 bucket. However, the deployment fails because the S3 bucket is not configured for static website hosting. What is the MOST likely cause of the failure?

Accepted Answer

The S3 bucket does not have static website hosting enabled.. Option A is correct because CodeDeploy for S3 does not require bucket policy changes; the failure is due to missing static website hosting configuration. Option B is wrong because IAM roles should be fine. Option C is wrong because CodeDeploy does not need the bucket to be public. Option D is wrong because S3 is not a deployment target for CodeDeploy? Actually CodeDeploy can deploy to EC2/On-premises/Lambda, not directly to S3. The question assumes CodeDeploy is used incorrectly. But the best answer is A as per typical issues.

Answer

The IAM role for CodeDeploy does not have permissions to write to the S3 bucket.

Answer

The S3 bucket is not configured as a public bucket.

Answer

AWS CodeDeploy cannot deploy to S3 buckets.

Question 4

A DevOps engineer is reviewing the CodePipeline structure above. The pipeline fails during the Deploy stage with an error: 'The deployment group could not be found.' What is the most likely cause?

Accepted Answer

The pipeline is configured as a single-region pipeline, but the Deploy action is in a different region.. The pipeline stages are in different regions: Build in us-east-1, Deploy in us-west-2. CodePipeline does not support cross-region actions unless cross-region action is configured with proper artifact storage. The default pipeline runs in a single region. Option B is correct.

Answer

The source artifact is not accessible from us-west-2.

Answer

The CodeDeploy application does not exist in us-west-2.

Answer

The CodeBuild project is not configured to output artifacts.

Question 5

An IAM policy is attached to a user. The user is trying to push a commit to the 'main' branch of the 'MyRepo' repository. The push is denied. What is the most likely reason?

Accepted Answer

The condition key 'codecommit:References' is not correctly formatted for an array value.. Option B is correct because the condition uses StringEquals with an array, but the condition key 'codecommit:References' expects a single value when using StringEquals; the policy should use 'ForAllValues:StringEquals' or 'ForAnyValue:StringEquals' for array matching. Option A is wrong because the actions are allowed for the main branch reference. Option C is wrong because the condition restricts to main branch, not other branches. Option D is wrong because the resource ARN matches the repository.

Answer

The user does not have permission to push to any branch.

Answer

The policy does not allow the 'codecommit:GitPush' action for the main branch.

Answer

The resource ARN is incorrect.

Question 6

A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own CodeCommit repository and must be built and deployed independently. The team wants to minimize manual configuration and ensure that adding a new microservice automatically creates the corresponding pipeline stages. Which approach should the team use?

Accepted Answer

Define a CloudFormation template that creates a pipeline for a given repository and invoke it automatically when a new repository is created using EventBridge and Lambda.. Option D is correct because AWS CloudFormation can define the pipeline infrastructure as code, and using nested stacks or a template that parameterizes the repository name allows for easy replication. Option A is wrong because manually updating a single pipeline is error-prone and not scalable. Option B is wrong because creating separate pipelines manually defeats automation. Option C is wrong because the AWS CDK can define infrastructure but requires separate stacks per service unless using loops or constructs.

Answer

Create a separate AWS CodePipeline for each microservice manually using the AWS Management Console.

Answer

Use the AWS Cloud Development Kit (CDK) to define a pipeline that dynamically discovers repositories.

Answer

Use a single AWS CodePipeline with multiple stages, each triggered by a different branch of the same repository.

Question 7

An organization has a AWS CodePipeline that deploys a critical application. The pipeline uses a manual approval step before deploying to production. The team wants to ensure that only authorized users can approve the deployment, and that the approval action is logged for compliance. Which combination of actions should the team take? (Select TWO.)

Accepted Answer

Configure the approval action to invoke an AWS Lambda function that validates the approver's IAM role tags.. Options A and C are correct. Option A: Configuring the Lambda function for approval to check IAM tags ensures only users with specific tags (e.g., 'role=approver') can call the approval API. Option C: Using CloudTrail to log approval actions meets compliance logging requirements. Option B is wrong because SNS does not provide fine-grained authorization. Option D is wrong because CloudWatch Logs can log but CloudTrail is the correct service for API logging. Option E is wrong because CodeCommit is not involved in approval authorization.

Answer

Use Amazon Simple Notification Service (SNS) to send approval notifications and allow any subscriber to approve.

Answer

Use AWS CodeCommit to manage approval permissions via repository policies.

Answer

Store approval logs in Amazon CloudWatch Logs for real-time monitoring.

Question 8

A development team uses AWS CodeBuild to run unit tests on every commit to the develop branch. The tests take a long time because they download dependencies each time. What should the team do to reduce build time?

Accepted Answer

Enable the local cache feature in CodeBuild.. Option B is correct because enabling the local cache in CodeBuild allows dependencies to be cached across builds, reducing download time. Option A is wrong because increasing compute resources may help but not as effectively as caching. Option C is wrong because parallel builds do not reduce a single build's time. Option D is wrong because Amazon EFS adds network latency; local instance store is better.

Answer

Store dependencies in Amazon Elastic File System (EFS) and mount it during builds.

Answer

Increase the compute type of the build environment.

Answer

Use multiple builds in parallel for the same commit.

Question 9

A company wants to ensure that all code changes are reviewed before being merged to the main branch in AWS CodeCommit. Which feature should be enabled?

Accepted Answer

Create an approval rule template and associate it with the main branch.. Option D is correct because CodeCommit supports approval rule templates that can require pull request approvals. Option A is wrong because branches are not protected by default; approval rules are needed. Option B is wrong because Lambda triggers can be used but are not the built-in solution. Option C is wrong because CloudWatch Events can send notifications but not block merges.

Answer

Configure a Lambda function to validate commits and block pushes.

Answer

Enable branch protection rules on the repository.

Answer

Use CloudWatch Events to notify when a push occurs.

Question 10

A developer is troubleshooting a failed CodeBuild build. The build is triggered by a pull request from a forked repository. The buildspec includes a command to fetch pull request references. What is the most likely cause of the failure?

Accepted Answer

The CodeBuild project is not configured to allow pull requests from forked repositories.. Option B is correct because by default, CodeBuild does not fetch pull request references from forked repositories for security reasons. The build project must be configured to allow pull request builds from forked repositories. Option A is wrong because the error is about fetching, not about file not found. Option C is wrong because the buildspec is being executed, so it is valid. Option D is wrong because the error is about fetching, not about insufficient permissions.

Answer

The IAM role for CodeBuild does not have permission to read from the repository.

Answer

The buildspec file is not present in the source code.

Answer

The buildspec contains invalid syntax.

Question 11

A CloudFormation stack is created with the template above and the parameter Environment set to 'dev'. Later, the stack is deleted. What happens to the S3 bucket?

Accepted Answer

The bucket is deleted.. Option B is correct because the condition 'IsProd' is false when Environment is 'dev', so the DeletionPolicy evaluates to 'Delete', meaning the bucket will be deleted when the stack is deleted. Option A is wrong because the DeletionPolicy is set to Delete. Option C is wrong because the condition is evaluated at stack creation and deletion. Option D is wrong because the bucket is deleted.

Answer

The bucket is retained only if it contains objects.

Answer

The bucket is retained.

Answer

The bucket is deleted but the objects are retained.

Question 12

A development team uses AWS CodeCommit as a Git repository. They want to automatically trigger a build in AWS CodeBuild when a pull request is created or updated. Which configuration should the team use?

Accepted Answer

Create a CodeCommit trigger that invokes CodeBuild on 'Pull Request Created' and 'Pull Request Updated' events.. Option A is correct because CodeCommit can trigger CodeBuild via a repository trigger. Option B is wrong because CodePipeline does not directly trigger on pull requests. Option C is wrong because CloudWatch Events can trigger on pull request events but CodeBuild can be invoked directly via triggers. Option D is wrong because SNS cannot trigger CodeBuild directly.

Answer

Use Amazon SNS to notify CodeBuild when a pull request is created.

Answer

Use Amazon CloudWatch Events to detect CodeCommit pull request events and invoke CodeBuild.

Answer

Configure CodePipeline with a source action on CodeCommit and a build action, and set the pipeline to start on source changes.

Question 13

A DevOps engineer is setting up a CI/CD pipeline for a Node.js application. The application must be built, tested, and deployed to an Amazon ECS cluster. The team wants to use AWS CodeBuild to run unit tests and package the application as a Docker image, and AWS CodePipeline to orchestrate the workflow. Which artifact type should CodeBuild output to be used by a subsequent CodePipeline action?

Accepted Answer

A Docker image pushed to Amazon ECR.. Option D is correct because CodeBuild can output a Docker image to Amazon ECR, and CodePipeline can use that image in a deploy action. Option A is wrong because the buildspec does not produce an artifact; it builds a Docker image. Option B is wrong because the image is pushed to ECR, not stored in S3 directly. Option C is wrong because the image is stored in ECR, not S3.

Answer

A zip file containing the application source code.

Answer

A tarball stored in Amazon S3.

Answer

A JSON file with the image details.

Question 14

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage that runs 'npm install' and 'npm test'. The team notices that the build stage often fails due to network timeouts when downloading npm packages. Which action would MOST reliably resolve this issue?

Accepted Answer

Configure the CodeBuild project to use a VPC with a NAT gateway to the internet.. Option B is correct because using a VPC with a NAT gateway ensures consistent outbound internet access for CodeBuild. Option A is wrong because npm packages are not cached by default. Option C is wrong because increasing timeout may not resolve timeouts. Option D is wrong because using a custom image does not fix network issues.

Answer

Use a custom Docker image that includes pre-installed npm packages.

Answer

Enable local dependency caching in the buildspec file.

Answer

Increase the build timeout to the maximum value.

Question 15

A company uses AWS CodePipeline with a GitHub source action. They want to automatically start the pipeline when a pull request is merged to the main branch. However, the pipeline also starts on every push to any branch. How can they limit the pipeline to only trigger on push events to the main branch?

Accepted Answer

Configure the source action's 'Branch' field to 'main' and set 'PollForSourceChanges' to false, and use a webhook with filters.. Option A is correct because the GitHub source action supports configuring branch and event filters, such as 'push' and 'pull_request' with specific branches. Option B is wrong because the webhook is managed by CodePipeline; you can configure filters within the pipeline definition. Option C is wrong because the source action can filter on branch without a Lambda. Option D is wrong because CodePipeline does not have a branch filter condition; it's configured in the source action.

Answer

Use a Lambda function as a source action instead of GitHub.

Answer

Create a GitHub webhook manually and point it to a Lambda function that starts the pipeline only for main branch pushes.

Answer

Add a condition in the pipeline's first stage to check the branch name.

DOP-C02 Practice Test 18 — 15 Questions

Exhibit

DOP-C02 Practice Test 18 — 15 Questions

Exhibit