DOP-C02 Practice Test 28 — 15 Questions

Question 1

A company uses AWS CodePipeline with a cross-account action where the source account (Account A) triggers a deploy action in a target account (Account B). The pipeline is failing with an 'Access Denied' error when trying to assume the deployment role. What is the MOST likely cause?

Accepted Answer

The KMS key used to encrypt artifacts is not shared with Account B.. Option C is correct because cross-account pipelines require the source account to have a KMS key to encrypt artifacts and the target account to have permissions to decrypt. Option A is wrong because the error is 'Access Denied', not missing role. Option B is wrong because S3 bucket policy might be needed but often not the primary cause. Option D is wrong because CloudFormation role is for stack operations, not for the pipeline artifact decryption.

Answer

The S3 artifact bucket in Account A does not have a bucket policy allowing Account B.

Answer

The deployment role in Account B does not exist.

Answer

The CloudFormation service role in Account B is missing.

Question 2

A company uses AWS CloudFormation to manage infrastructure. The DevOps engineer wants to ensure that stack updates are rolled back if a new Amazon RDS instance fails to be created. Which CloudFormation feature should the engineer use?

Accepted Answer

Add a CreationPolicy to the RDS instance with a timeout. Option D is correct because CreationPolicy with a timeout ensures that a resource is fully created before continuing; if it fails, the stack rolls back. Option A is incorrect because StackPolicy only prevents updates to specific resources. Option B is incorrect because WaitCondition is used for external signals, not for resource creation. Option C is incorrect because it does not force a rollback if creation fails.

Answer

Use a WaitCondition and a WaitHandle to pause creation

Answer

Set the RDS instance's DeletionPolicy to Retain

Answer

Define a StackPolicy that denies updates to the RDS instance

Question 3

Which TWO options are valid ways to trigger an AWS CodePipeline execution automatically? (Choose two.)

Accepted Answer

Changes to a CodeCommit repository.. Options B and D are correct. Option A is wrong because manual approval does not trigger execution; it pauses. Option C is wrong because CodeDeploy is a deployment service, not a trigger. Option E is wrong because CloudWatch Logs do not trigger pipelines.

Answer

A scheduled CloudWatch Logs metric filter.

Answer

Completion of a CodeDeploy deployment.

Answer

Manual approval action in the pipeline.

Question 4

A development team uses AWS CodeCommit as a Git repository. They want to automatically trigger a build in AWS CodeBuild whenever a pull request is created or updated. Which AWS service should be used to detect the pull request events and start the build?

Accepted Answer

Amazon EventBridge. Option A is correct because Amazon EventBridge can monitor AWS CodeCommit events (like pull request creation) and trigger an AWS CodeBuild build using a rule. Option B is incorrect because CodePipeline is a continuous delivery service, not an event detection service. Option C is incorrect because CloudWatch Logs does not detect events; it stores logs. Option D is incorrect because SNS is a notification service, not a trigger for CodeBuild.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS CodePipeline

Answer

Amazon CloudWatch Logs

Question 5

A DevOps engineer is designing a CI/CD pipeline for a microservices application using AWS CodePipeline. Each microservice has its own CodeCommit repository. The engineer wants to run unit tests in parallel for all services when any repository receives a push, then run integration tests only after all unit tests pass. Which pipeline structure should the engineer use?

Accepted Answer

Create a single pipeline with a parallel action for unit tests, then a serial stage for integration tests. Option C is correct because having a single pipeline with a parallel action for unit tests and then a serial integration test stage is the simplest and most straightforward design. Option A is incorrect because it suggests separate pipelines, which would require complex coordination. Option B is incorrect because a serial stage for unit tests would increase overall time. Option D is incorrect because CodeBuild does not have built-in fan-out/fan-in; the pipeline provides that.

Answer

Create a single pipeline with a serial stage for unit tests, then integration tests

Answer

Create one pipeline per microservice, each triggering integration tests via SNS

Answer

Use AWS CodeBuild batch builds with a fan-out/fan-in pattern

Question 6

A company uses AWS CodeDeploy with a blue/green deployment configuration. The engineer wants to automatically roll back the deployment if the new instances fail the health check for 5 minutes. Which setting should the engineer configure?

Accepted Answer

Configure the deployment group to roll back when a CloudWatch alarm is triggered. Option B is correct because CodeDeploy blue/green deployments can automatically roll back based on CloudWatch alarms. Option A is incorrect because creating an alarm alone does not trigger rollback; CodeDeploy must be configured to use it. Option C is incorrect because Auto Scaling group health checks are separate. Option D is incorrect because CodeDeploy does not have a built-in timeout for health checks; it uses alarms.

Answer

Create a CloudWatch alarm that monitors the health check endpoint

Answer

Set the Auto Scaling group health check grace period to 5 minutes

Answer

Set the deployment configuration's 'timeout' to 5 minutes

Question 7

Refer to the exhibit. The above IAM policy is attached to an IAM role used by a CI/CD pipeline. Which action is this policy allowing?

Accepted Answer

Start and view builds for the specified CodeBuild project.. Option A is correct because the policy allows StartBuild and BatchGetBuilds on a specific CodeBuild project. Option B is wrong because CreateProject is not allowed. Option C is wrong because the resource is a project, not a build. Option D is wrong because UpdateProject is not allowed.

Answer

Start builds for any CodeBuild project in the account.

Answer

View details of any build in the account.

Answer

Create and manage CodeBuild projects.

Question 8

Refer to the exhibit. A DevOps engineer ran the above AWS CLI command after a CloudFormation stack update. What does the status 'ROLLBACK_COMPLETE' indicate?

Accepted Answer

The stack update failed and CloudFormation reverted to the previous stack.. Option D is correct because ROLLBACK_COMPLETE means the update failed and CloudForm reverted to the previous state. Option A is wrong because the stack was not created successfully; it rolled back. Option B is wrong because ROLLBACK_COMPLETE is not a delete status. Option C is wrong because it is not an update in progress.

Answer

The stack update is in progress.

Answer

The stack was deleted successfully.

Answer

The stack was created successfully.

Question 9

A DevOps team is designing a CI/CD pipeline for a containerized application. Which THREE components are essential for a complete pipeline? (Choose three.)

Accepted Answer

Artifact storage. Options A, C, and D are correct. Option B is wrong because it's a deployment service, not a pipeline component. Option E is wrong because it's a monitoring service.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Question 10

A DevOps team uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild that generates the website files, and a deploy stage that copies files to an S3 bucket. The team wants to add a manual approval step before the deploy stage. What should the engineer do?

Accepted Answer

Add an approval action in the pipeline stage before deploy. Option C is correct because an approval action in CodePipeline pauses the pipeline until manually approved. Option A is incorrect because CodeBuild does not support manual approval. Option B is incorrect because S3 events cannot pause a pipeline. Option D is incorrect because the pipeline needs to pause, not just notify.

Answer

Use Amazon SNS to send a notification and rely on a Lambda function to resume

Answer

Add a CodeBuild action that waits for an SNS confirmation

Answer

Configure the S3 bucket to send an event to the pipeline after upload

Question 11

An organization uses AWS CodeBuild to compile and test their code. They want to reuse build artifacts across multiple build projects to reduce build time. What is the BEST approach?

Accepted Answer

Store build artifacts in an Amazon S3 bucket and configure each build project to download them from S3.. Option C is correct because storing artifacts in S3 allows sharing across projects. Option A is wrong because local cache is per-project. Option B is wrong because Docker cache is for Docker images. Option D is wrong because EFS is not used for build artifacts.

Answer

Use the local cache feature in CodeBuild to store artifacts on the build instance.

Answer

Use Docker layer caching to store intermediate build layers.

Answer

Mount an Amazon EFS file system to each build environment to share artifacts.

Question 12

Refer to the exhibit. The above buildspec.yml is used in AWS CodeBuild. The build is failing during the 'build' phase with a 'FileNotFoundError: setup.py' error. What is the MOST likely cause?

Accepted Answer

The source code does not contain a setup.py file in the root directory.. Option B is correct because the pre_build phase runs flake8 on src/ directory, but the build command expects setup.py in the root; setup.py might be in src/ or missing. Option A is wrong because Python 3.8 is supported. Option C is wrong because unit tests are in post_build, not causing build failure. Option D is wrong because artifacts are only collected after build.

Answer

The unit tests in the post_build phase are failing.

Answer

The Python version 3.8 is not supported by CodeBuild.

Answer

The artifacts configuration discarding paths is causing the error.

Question 13

An organization uses AWS CodePipeline with a multi-branch strategy. They want to run unit tests on every push to any branch, but only deploy to production on pushes to the 'main' branch. What is the most efficient way to achieve this?

Accepted Answer

Configure a single pipeline with a source action that triggers on all branches, then use a 'branch' condition on the deployment stage to only proceed if the branch is 'main'.. Option B is correct because using a single pipeline with a branch filter on the source action triggers on all branches, and a separate deployment stage with a condition based on the branch name ensures only main deploys. Option A is wrong because it requires manual pipeline creation per branch. Option C is wrong because it still deploys to all environments. Option D is wrong because it would trigger for main only, missing other branches.

Answer

Use a single pipeline with a source action that triggers on all branches, and deploy to a test environment for all branches, then promote to production manually.

Answer

Create separate pipelines for each branch, each with its own test and deploy stages.

Answer

Use a single pipeline with a source action that only triggers on the 'main' branch, and run tests in a separate system.

Question 14

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the 'ValidateService' lifecycle event. The CloudWatch Agent reports that the target process is running but the health check endpoint returns HTTP 503. The CodeDeploy agent logs show no errors. What is the most likely cause of the failure?

Accepted Answer

The application is not fully functional due to missing configuration files. Option B is correct because the health check is failing (HTTP 503) even though the process is running, indicating the application is not serving traffic properly, likely due to missing dependencies or configuration. Option A is incorrect because CodeDeploy agent logs showed no errors. Option C is incorrect because Auto Scaling group health checks are separate from CodeDeploy's validation. Option D is incorrect because the process is running.

Answer

The Auto Scaling group is not healthy

Answer

The CodeDeploy agent is not installed on the instances

Answer

The target process is not listening on the expected port

Question 15

A company uses AWS CodeBuild to run unit tests. The buildspec.yaml file includes commands to install dependencies and run tests. Which TWO environment variables are automatically set by CodeBuild and can be used in the build commands? (Choose TWO.)

Accepted Answer

CODEBUILD_SRC_DIR. Options B and D are correct. CODEBUILD_BUILD_ID and CODEBUILD_SRC_DIR are automatically set by CodeBuild. Option A is wrong because AWS_REGION is automatically set, but it is an AWS CLI environment variable, not specific to CodeBuild. Option C is wrong because CODEBUILD_BUILD_NUMBER is not an automatic environment variable; it is exposed but not automatically set. Option E is wrong because CI is not automatically set by CodeBuild.

Answer

AWS_REGION

Answer

CODEBUILD_BUILD_NUMBER

Answer

CI