DOP-C02 Practice Test 19 — 15 Questions

Question 1

A team uses AWS CodeBuild to run security scans on code before deployment. They want to ensure that if the security scan fails, the build is marked as FAILED and no further pipeline stages execute. What should they add to the buildspec?

Accepted Answer

Use the 'phases' section with a command that exits with a non-zero status on failure.. Option D is correct because the 'phases' section runs commands, and if a command exits with a non-zero status, the build fails. Option A is wrong because 'env' is for environment variables. Option B is wrong because 'artifacts' is for output. Option C is wrong because 'reports' is for test reports and does not cause build failure.

Answer

Use the 'artifacts' section to define failure conditions.

Answer

Use the 'env' section to set a variable that fails the build.

Answer

Use the 'reports' section to mark the build as failed if tests fail.

Question 2

A development team is using AWS CodeCommit as a source control repository. They want to automate code builds and run unit tests every time a developer pushes code to the 'develop' branch. Which AWS service should they use to trigger the build automatically?

Accepted Answer

Create an AWS CodePipeline with CodeCommit as source and CodeBuild as build stage, configured to start on source changes.. Option D is correct because AWS CodePipeline can be configured with a webhook on CodeCommit to trigger a build in CodeBuild on every push. Option A is wrong because CodeCommit itself does not run builds. Option B is wrong because CloudWatch Events can trigger based on API calls but is not the direct service for build automation. Option C is wrong because CodeDeploy is for deployment, not building.

Answer

Set up AWS CodeDeploy to run builds on code push.

Answer

Configure AWS CodeCommit to invoke AWS CodeBuild directly.

Answer

Use Amazon CloudWatch Events to detect a push to CodeCommit and trigger AWS CodeBuild.

Question 3

A company is using AWS CodeBuild to compile a Java application. The build takes over 30 minutes, causing timeouts. The team has already increased the build timeout to the maximum. Which action would MOST effectively reduce the build time?

Accepted Answer

Enable dependency caching in the buildspec file.. Option C is correct because caching dependencies can significantly reduce build time by avoiding re-downloading. Option A is wrong because increasing compute resources can help but may not be as effective as caching. Option B is wrong because parallel builds may introduce complexity and dependencies. Option D is wrong because using a smaller instance would increase build time.

Answer

Use a smaller instance type to reduce provisioning time.

Answer

Use a larger compute type in CodeBuild.

Answer

Split the build into multiple parallel CodeBuild projects.

Question 4

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must deploy to Amazon ECS using blue/green deployments. The team wants to automatically roll back if the new deployment fails health checks. Which combination of AWS services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with an ECS compute platform, configure a CloudWatch alarm for health checks, and enable automatic rollback.. Option D is correct because CodeDeploy with ECS supports blue/green deployments and automatic rollback on CloudWatch alarm. Option A is wrong because CodePipeline alone does not handle deployment rollback. Option B is wrong because CloudFormation does not natively support blue/green for ECS. Option C is wrong because Elastic Beanstalk is for web apps, not ECS.

Answer

Use AWS CloudFormation with a custom resource to perform blue/green deployment.

Answer

Use AWS Elastic Beanstalk with blue/green environment swapping.

Answer

Use AWS CodePipeline with ECS deployment action and manual approval for rollback.

Question 5

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences periodic spikes in response times. The CloudWatch metrics show high CPU and memory usage for the tasks during these spikes. What is the MOST effective approach to handle these spikes?

Accepted Answer

Configure target tracking scaling policies for the ECS service using CPU or memory utilization. Option D is correct because using Application Auto Scaling with target tracking based on CPU or memory utilization dynamically adjusts the task count. Option A is wrong because it does not address scaling; B is wrong because it does not scale automatically; C is wrong because it does not use metrics for scaling.

Answer

Use a larger Fargate task size to handle the spikes

Answer

Increase the CPU and memory limits for the ECS task definition

Answer

Set up a scheduled scaling action to add tasks during peak hours

Question 6

A company is using AWS CodeBuild to run integration tests. The tests require access to an Amazon RDS instance in a private subnet. The CodeBuild project is configured with a VPC ID, subnet IDs, and security group IDs. However, the tests fail with a connection timeout. What is the MOST likely cause?

Accepted Answer

The security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group.. Option D is correct because the security group must allow inbound traffic from the CodeBuild security group. Option A is wrong because the CodeBuild project has VPC configuration. Option B is wrong because NAT gateway is not needed for VPC-to-VPC communication within same VPC. Option C is wrong because internet access is not required.

Answer

The CodeBuild project does not have internet access to download packages.

Answer

The CodeBuild project is not associated with a VPC.

Answer

The RDS instance is not publicly accessible and requires a NAT gateway.

Question 7

A company has a CI/CD pipeline that deploys to Amazon ECS using AWS CodePipeline. The pipeline includes a manual approval step before deployment to production. The security team requires that all approvals be logged in AWS CloudTrail and that the approver's identity be verified. Which action should the DevOps engineer take to meet these requirements?

Accepted Answer

Ensure that the manual approval action is configured as a CodePipeline approval action; CloudTrail will log the 'Approval' event with the IAM user ARN.. Option C is correct because CodePipeline manual approval actions are already logged in CloudTrail with the approver's IAM user ARN. Option A is wrong because CloudWatch Logs do not capture approval actions. Option B is wrong because CloudTrail is sufficient. Option D is wrong because enabling CloudTrail is not needed if already enabled.

Answer

Create a custom CloudTrail trail specifically for CodePipeline API calls.

Answer

Enable CloudTrail Insights to detect unusual approval activity.

Answer

Configure the approval action to send a notification to an Amazon SNS topic, and log the SNS delivery to CloudWatch Logs.

Question 8

A company is using AWS CodePipeline with a deployment stage that uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that if the CloudFormation stack update fails, the pipeline automatically rolls back to the previous version of the stack. Which configuration should the DevOps engineer implement?

Accepted Answer

In the CodePipeline CloudFormation deployment action, set 'Stack failure behavior' to 'ROLLBACK'.. Option D is correct because CloudFormation deployment actions in CodePipeline can be configured with 'Stack failure behavior' set to 'ROLLBACK'. Option A is wrong because CloudFormation stack policy does not control rollback. Option B is wrong because change sets are for manual review. Option C is wrong because rollback triggers in CodeDeploy are for CodeDeploy, not CloudFormation.

Answer

Configure the CodeDeploy deployment group to automatically roll back on failure.

Answer

Configure a CloudFormation stack policy to prevent updates and force rollback.

Answer

Use CloudFormation change sets and manually execute them after review.

Question 9

A DevOps team is designing a CI/CD pipeline for a microservices application that runs on Amazon ECS. They need to implement automated canary deployments. Which TWO AWS services would be essential for this implementation?

Accepted Answer

AWS CodeDeploy. Options B and D are correct. AWS CodeDeploy supports canary deployments for ECS, and AWS CloudWatch provides metrics for monitoring. Option A is wrong because CodeBuild is for building, not deployment. Option C is wrong because CloudFormation can deploy but does not natively support canary. Option E is wrong because EC2 Auto Scaling is not directly used for canary.

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Answer

Amazon EC2 Auto Scaling

Question 10

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The team wants to automatically test the deployed application before promoting it to production. Which THREE steps should be included in the pipeline?

Accepted Answer

Add a stage that runs a performance or load test.. Options A, C, and D are correct. After deployment, an integration test stage validates the deployment. A manual approval stage allows review before promotion. Additional testing (e.g., load test) can be added. Option B is wrong because a separate deployment to a different environment is not necessary. Option E is wrong because rolling back is not a testing step.

Answer

Add a stage that automatically rolls back the deployment if tests fail.

Answer

Add a stage that deploys the application to a separate production environment.

Question 11

A company is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yaml includes commands to build and tag the image. However, the push to ECR fails with an authentication error. Which TWO actions should the DevOps engineer take to resolve this?

Accepted Answer

Add a command in the buildspec to run 'aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com'.. Options B and D are correct. The CodeBuild project must have an IAM role with permissions to push to ECR, and the buildspec must include the 'aws ecr get-login-password' command to authenticate. Option A is wrong because Docker login is not needed. Option C is wrong because ECR does not require a public repository. Option E is wrong because ECR lifecycle policies are not related.

Answer

Configure the ECR repository as public.

Answer

Create an ECR lifecycle policy to expire untagged images.

Answer

Run 'docker login' with ECR credentials in the buildspec.

Question 12

A DevOps team uses AWS CodePipeline with a multi-branch strategy. The pipeline should deploy to production only from the 'main' branch, but run unit tests for all branches. How should the team configure the pipeline?

Accepted Answer

Configure the pipeline source stage to trigger on all branches, use branch-specific logic in the test stage, and add a manual approval step for production deployment only when the branch is 'main'.. Option C is correct because CodePipeline can use branch filtering in the source stage to trigger on specific branches, and the test stage can be configured to run for all branches. Option A is wrong because a single pipeline cannot have dynamic branch-based stages without multiple pipelines. Option B is wrong because separate pipelines per branch would duplicate effort. Option D is wrong because Lambda triggers are not the standard way to implement branch-based logic; branch filtering is native.

Answer

Use an AWS Lambda function to check the branch name and invoke different CodePipeline executions for testing and deployment.

Answer

Create one pipeline with two source stages: one for 'main' and one for all other branches, each with its own test and deploy actions.

Answer

Create a separate pipeline for each branch, each with identical test and deploy stages.

Question 13

A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?

Accepted Answer

The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).. Option B is correct because CodeBuild must be configured with a security group that allows outbound traffic to the RDS security group on the database port. Option A is wrong because IAM permissions affect API calls, not network connectivity. Option C is wrong because subnet CIDR is not relevant for security group rules. Option D is wrong because CodeBuild can access resources in the same VPC if security groups allow.

Answer

CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.

Answer

The CodeBuild service role does not have rds:Connect permission.

Answer

The RDS instance is in a different subnet CIDR than CodeBuild's subnet.

Question 14

A team uses AWS CloudFormation to manage infrastructure. They want to reuse a common set of resources (e.g., VPC, subnets) across multiple stacks. Which CloudFormation feature should they use?

Accepted Answer

Nested stacks. Option A is correct because nested stacks allow reusing a common template. Option B is wrong because cross-stack references allow passing values but not reusing resource definitions. Option C is wrong because custom resources are for extending CloudFormation. Option D is wrong because StackSets deploy across accounts/regions.

Answer

Custom resources

Answer

StackSets

Answer

Cross-stack references

Question 15

A development team uses AWS CodeCommit for source control. They want to enforce that all commits include a JIRA issue key in the commit message. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function on every push to validate commit messages.. Option D is correct because CodeCommit can trigger a Lambda function on pushes to run custom validation. Option A is wrong because branch policies are for pull requests, not commit messages. Option B is wrong because CloudWatch Events can trigger Lambda, but direct trigger from CodeCommit is simpler. Option C is wrong because pre-commit hooks are client-side and not enforceable.

Answer

Use Amazon CloudWatch Events to detect new commits and invoke a Lambda function to validate the commit message.

Answer

Implement a pre-commit hook in each developer's local repository.

Answer

Configure a branch policy on the repository that requires commit message format.