DOP-C02 Practice Test 25 — 15 Questions

Question 1

A DevOps team is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a Source stage using CodeCommit, a Build stage using CodeBuild, and a Deploy stage using CloudFormation. The team wants to add manual approval before the Deploy stage for production deployments. How should this be configured?

Accepted Answer

Add an Approval stage to the pipeline with SNS topic for notification.. Option A is correct because CodePipeline has a built-in Approval action type. Option B is wrong because SNS notifications do not block the pipeline. Option C is wrong because Lambda cannot pause the pipeline. Option D is wrong because a separate approval pipeline adds complexity.

Answer

Configure a CloudWatch event to send an email on build success.

Answer

Use a Lambda function to approve based on build status.

Answer

Create a separate pipeline for production and trigger it manually.

Question 2

A DevOps team uses AWS CodePipeline to deploy a microservices application. The pipeline includes a CodeBuild project that runs unit tests. Recently, builds have been failing intermittently due to test timeouts. The team wants to improve the reliability of the pipeline without increasing the build timeout. Which action should the team take?

Accepted Answer

Configure the CodeBuild project to run tests in parallel by using separate build environments or test splits.. Option A correctly identifies that running tests in parallel reduces overall build time and helps avoid timeouts without increasing the timeout limit. Option B increases timeout but does not address intermittent failures. Option C addresses flaky tests but does not directly solve timeout issues. Option D moves testing to CodeDeploy, which is not designed for unit testing.

Answer

Increase the build timeout to the maximum allowed value of 8 hours.

Answer

Use AWS CodeDeploy to run the unit tests on EC2 instances with more CPU and memory.

Answer

Modify the unit tests to be non-flaky by adding retries for network calls.

Question 3

An organization uses AWS CodePipeline to deploy a web application. The pipeline includes a test stage that runs integration tests using AWS CodeBuild. The tests are flaky and sometimes fail due to external dependencies. The team wants to automatically retry failed tests before marking the stage as failed. How should this be achieved?

Accepted Answer

Configure the CodeBuild project to automatically retry the build on failure.. Option B is correct because the CodeBuild retry feature can automatically retry the build on failure. Option A is wrong because a separate pipeline adds complexity. Option C is wrong because a manual approval doesn't retry tests. Option D is wrong because CloudWatch Events can trigger a retry, but it requires custom logic; the built-in retry is simpler.

Answer

Add a manual approval step after the test stage.

Answer

Use Amazon CloudWatch Events to listen for test failures and trigger a new pipeline execution.

Answer

Create a second pipeline that triggers only on test failures.

Question 4

An organization uses AWS CloudFormation to manage infrastructure across multiple accounts using AWS Organizations. They want to enforce that all S3 buckets are encrypted with SSE-S3. A DevOps engineer creates a service control policy (SCP) to deny the creation of any S3 bucket without encryption. However, CloudFormation stack creation fails with an access denied error even when the template includes encryption. What is the most likely cause?

Accepted Answer

The SCP is incorrectly scoped to the management account instead of the member accounts.. Option A is correct because SCPs apply globally to all principals in the account, and if the SCP denies the s3:PutBucketPublicAccessBlock action (required for bucket creation) or the specific encryption deny condition is too broad, it can block legitimate requests. Option B is unlikely because CloudFormation uses the role's permissions, not the user's directly. Option C is incorrect because SSE-S3 is server-side encryption. Option D is incorrect because CloudFormation does not require a separate SCP.

Answer

The CloudFormation template specifies SSE-KMS encryption, which is not allowed by the SCP.

Answer

The SCP is denying the s3:PutBucketPublicAccessBlock action, which is required for all bucket creation requests.

Answer

The CloudFormation service role does not have permissions to create buckets in the target account.

Question 5

A company uses AWS CodeCommit for source control. Developers frequently push large binary files, causing the repository size to exceed the recommended limit. What is the most efficient way to manage this situation?

Accepted Answer

Use Git LFS (Large File Storage) and configure it to store binaries in S3.. Option A is best practice: use Git LFS to handle large files without bloating the repository. Option B is temporary. Option C is not efficient. Option D is not a good practice.

Answer

Increase the repository size limit in CodeCommit settings.

Answer

Periodically run a script to remove large files from the commit history.

Answer

Use S3 directly for storing binaries and reference them in code.

Question 6

A DevOps engineer is tasked with automating the deployment of a microservices architecture. Each service is packaged as a Docker container. The team wants to use AWS CodePipeline and AWS CodeBuild to build Docker images and push them to Amazon ECR, then deploy to Amazon ECS. What should the CodeBuild buildspec file include to push the image to ECR?

Accepted Answer

Docker build and docker push commands with AWS CLI to authenticate to ECR.. Option C is correct because standard Docker commands are used to build and push images. Option A is wrong because CodeDeploy is not used for pushing images. Option B is wrong because CodeBuild does not natively call ECS. Option D is wrong because there is no built-in ECR push action in CodeBuild; you must use docker push.

Answer

A call to the AWS CodeDeploy API to push the image.

Answer

An invocation of the AWS ECS RunTask API.

Answer

A buildspec phase with 'ecr-push' action.

Question 7

A company is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from GitHub, a build stage using AWS CodeBuild, and a deploy stage using AWS Elastic Beanstalk. The team wants to ensure that the pipeline only proceeds if the code quality checks pass and unit tests are successful. Which TWO actions should be taken?

Accepted Answer

Add a test stage in the pipeline with a CodeBuild action that runs code quality and unit tests.. Correct answers are A and C. A: Adding a test stage with CodeBuild allows running tests. C: CodeBuild can run both code quality checks and unit tests. B is wrong because S3 is not a stage type for testing. D is wrong because a manual approval does not run tests. E is wrong because CloudFormation is for infrastructure, not testing.

Answer

Add a manual approval step before the deploy stage.

Answer

Configure the source stage to use an S3 bucket and add a test action.

Answer

Use AWS CloudFormation to create a test environment and run tests.

Question 8

A company uses AWS CodePipeline to automate deployments. The pipeline consists of Source, Build, and Deploy stages. The Build stage uses CodeBuild, and the Deploy stage uses CodeDeploy. Recently, the pipeline failed at the Deploy stage with an error: 'The deployment group does not exist'. Which TWO actions should the team take to resolve this issue?

Accepted Answer

Verify that the deployment group name specified in the pipeline's Deploy stage matches the actual deployment group name in CodeDeploy.. Options A and D are correct: the deployment group name must match exactly, and the pipeline must be in the same region. Option B is not required. Option C is not a common cause. Option E is not related.

Answer

Increase the timeout for the Deploy stage to allow more time for the deployment group to be created.

Answer

Ensure that the CodeBuild project has permissions to access the CodeDeploy deployment group.

Answer

Check that the CodeDeploy application exists in the same AWS account as the pipeline.

Question 9

An organization uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that minifies assets), and a deploy stage (S3 deployment). The team wants to add a stage for running security vulnerability scans on the code. Which TWO options are viable?

Accepted Answer

Add a custom action in the pipeline that invokes a third-party scanning service via AWS Lambda.. Correct answers are B and D. B: CodeBuild can run security scans as part of the build. D: Third-party tools can be integrated via CodePipeline custom actions. A is wrong because S3 cannot run scans. C is wrong because Inspector is for EC2 instances, not code. E is wrong because Shield is for DDoS protection.

Answer

Enable AWS Shield Advanced to scan for vulnerabilities.

Answer

Use Amazon Inspector to scan the source code.

Answer

Add an S3 event notification to trigger a Lambda function that scans the S3 bucket.

Question 10

A DevOps team uses AWS OpsWorks for Chef Automate to manage configuration. They want to ensure that all EC2 instances automatically register with OpsWorks and are assigned to the correct layer. Which THREE steps are required? (Choose THREE.)

Accepted Answer

Install the AWS OpsWorks agent on each EC2 instance.. Options A, C, and E are correct: install agent, register stack, assign layer. Option B is not required. Option D is for other services.

Answer

Configure the instance's user data to run the Chef client.

Answer

Attach an IAM role with the AmazonEC2RoleforOpsWorks policy to the EC2 instance.

Question 11

A company is using AWS CodeBuild to compile and test code. The buildspec.yml file includes a pre_build phase that installs dependencies and a build phase that runs the compilation. The tests are run in the post_build phase. The team wants to improve the security of the build process by ensuring that sensitive information such as database passwords is not exposed in the build logs. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Use AWS Systems Manager Parameter Store to store the secrets and reference them in the buildspec using the 'parameter-store' field.. Options B and D are correct. Using AWS Systems Manager Parameter Store or AWS Secrets Manager to store secrets and referencing them in the buildspec using parameter-store or secrets-manager prevents secrets from being printed in logs. Option A is wrong because environment variables in plain text can be logged. Option C is wrong because build logs are accessible to authorized users, but the issue is exposure in plain text. Option E is wrong because encryption at rest does not prevent secrets from being logged in plain text.

Answer

Restrict access to the build logs by using IAM policies to only allow specific users to view them.

Answer

Enable encryption at rest for the CodeBuild project's S3 logs.

Answer

Store the secrets as plain-text environment variables in the CodeBuild project.

Question 12

A company uses AWS CloudFormation to create a stack with a Lambda function that uses a VPC. The stack creation fails with 'CREATE_FAILED: The provided execution role does not have permissions to call ec2:CreateNetworkInterface on the resource'. What is the likely cause?

Accepted Answer

The Lambda execution role is missing the ec2:CreateNetworkInterface permission.. Option C is correct: Lambda needs permissions to create elastic network interfaces. Option A is not related. Option B is not required. Option D is not the cause.

Answer

The VPC does not have a subnet with internet access.

Answer

The CloudFormation template does not specify a security group.

Answer

The Lambda function code has a syntax error.

Question 13

Refer to the exhibit. A DevOps engineer runs the command to get the pipeline definition. The pipeline has a source stage from an S3 bucket and a build stage with CodeBuild. The CodeBuild project is configured to output artifacts to a specific S3 bucket. However, the pipeline fails at the build stage with an error: 'Artifact 'BuildArtifact' is not found'. What is the most likely cause?

Accepted Answer

The CodeBuild project is not configured to output the expected artifact named 'BuildArtifact'.. Option B is correct because the build stage expects an output artifact named 'BuildArtifact', but the CodeBuild project's buildspec might not be configured to output that artifact. The pipeline definition does not show an output artifact for the build stage. Option A is wrong because the source is S3, not CodeCommit. Option C is wrong because the pipeline role likely has S3 permissions. Option D is wrong because the source artifact is found.

Answer

The source stage is using CodeCommit instead of S3.

Answer

The source artifact is not being passed to the build stage.

Answer

The IAM role for CodePipeline does not have permissions to read from the S3 bucket.

Question 14

A company uses AWS CloudFormation to provision infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the stack to change the DB instance class from db.t2.micro to db.t3.medium. Which THREE of the following must be true for the update to succeed? (Choose three.)

Accepted Answer

The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.. Options B, C, and E are correct. The new instance class must be available in the same VPC and subnet group (B) to preserve network connectivity. The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE (C). The IAM role used by CloudFormation must have sufficient permissions to modify RDS resources (E). Option A is wrong because a change set is not mandatory for updates; it can be used but is not required. Option D is wrong because disabling deletion protection is not required to change instance class; it's only needed to delete the stack.

Answer

Deletion protection must be disabled on the DB instance.

Answer

A change set must be created and executed for the update.

Question 15

Refer to the exhibit. An IAM policy is attached to a CodeBuild service role. The CodeBuild project is used to build code from a CodeCommit repository and output artifacts to an S3 bucket. However, the build fails with an error: 'Unable to download source from CodeCommit'. What is the missing permission?

Accepted Answer

Permissions to read from the CodeCommit repository.. Option D is correct because the policy does not include CodeCommit actions like 'codecommit:GitPull' or 'codecommit:GetBranch'. Option A is wrong because the policy already has S3 permissions. Option B is wrong because KMS is not mentioned. Option C is wrong because Logs permissions would be for CloudWatch, not for source download.

Answer

Permissions to create CloudWatch Logs for build output.

Answer

Permissions to decrypt the KMS key used to encrypt artifacts.

Answer

Permissions to write to the S3 artifact bucket.