DOP-C02 SDLC Automation Practice Test 10 — 15 Questions

Question 1

Which THREE components are required to set up a fully automated CI/CD pipeline for a static website hosted on Amazon S3 using AWS CodePipeline? (Choose THREE.)

Accepted Answer

An AWS CodeBuild project to run build commands (e.g., minification). AWS CodeBuild is required to execute build commands such as minification, bundling, or transpilation of static website assets before deployment. In a fully automated CI/CD pipeline, CodeBuild processes the source code from the repository and produces the deployable artifacts that are then uploaded to the S3 bucket.

Answer

An Amazon CloudFront distribution for content delivery

Answer

An AWS Lambda function to invalidate CloudFront cache

Question 2

Which TWO best practices should be followed when configuring AWS CodeBuild projects to improve build performance and security? (Choose TWO.)

Accepted Answer

Configure the build project to use a custom VPC to access resources like private Amazon RDS databases. Configuring a CodeBuild project to use a custom VPC allows it to access resources that are not publicly accessible, such as private Amazon RDS databases or internal services, which is essential for building applications that depend on those resources. This also enhances security by keeping traffic within the VPC and avoiding exposure to the public internet.

Answer

Run builds as the root user to avoid permission errors

Answer

Use the AWS managed policy 'AdministratorAccess' for the CodeBuild service role to avoid permission issues

Answer

Always use the 'latest' tag for the build environment image to ensure up-to-date software

Question 3

A DevOps engineer is reviewing the IAM policy attached to a CodeBuild service role. The policy allows starting builds and viewing logs. However, when CodeBuild tries to download artifacts from an S3 bucket in the same account, it fails with an access denied error. What is the missing permission?

Accepted Answer

s3:GetObject. The error occurs because CodeBuild needs to download artifacts from S3, which requires the s3:GetObject permission on the bucket or object. Without this permission, the service role cannot read the artifact files, even though it can start builds and view logs. The s3:GetObject action is the specific permission that grants read access to S3 objects.

Answer

kms:Decrypt

Answer

s3:PutObject

Answer

logs:DescribeLogGroups

Question 4

A CodeDeploy deployment group is configured as shown in the exhibit. During a deployment, the deployment fails because the instances are not found. What is the MOST likely reason?

Accepted Answer

The EC2 instances do not have the tag 'Environment' with value 'Production'. The exhibit shows the deployment group is configured to match EC2 instances with the tag 'Environment' set to 'Production'. If the instances do not have this exact tag key-value pair, CodeDeploy cannot find them during the deployment, causing the failure. The error 'instances are not found' directly points to a tag mismatch, not to permissions or load balancer issues.

Answer

The deployment configuration 'CodeDeployDefault.AllAtOnce' is not compatible with in-place deployments

Answer

The service role ARN is incorrect and does not have the necessary permissions

Answer

The load balancer 'my-alb' is not registered with the instances

Question 5

A company uses AWS CodeBuild to compile and test code. The build takes 30 minutes, but the team wants to reduce build time by caching dependencies. Which approach should be used?

Accepted Answer

Enable local caching in the build project configuration.. AWS CodeBuild's local caching feature allows you to cache intermediate build artifacts (such as dependencies) in a local directory on the build instance, which persists across builds for the same build project. This eliminates the need to re-download dependencies from external sources for every build, significantly reducing build time. The cache is stored in a Docker volume or S3 bucket, but the key benefit is that it is automatically managed by CodeBuild without manual download steps.

Answer

Remove unnecessary dependencies from the build specification.

Answer

Store dependencies in an S3 bucket and download them before each build.

Answer

Use AWS CodeArtifact to store dependencies and pull them during build.

Question 6

A team uses AWS CodePipeline with a source action from an Amazon S3 bucket. The pipeline triggers on changes to the S3 bucket, but sometimes runs twice for a single commit. What is the most likely cause?

Accepted Answer

S3 event notifications for the same object may be delivered more than once.. Amazon S3 event notifications are designed for at-least-once delivery, meaning the same event (e.g., an object PUT) can be delivered multiple times. When CodePipeline uses S3 as a source, it relies on these notifications to trigger the pipeline. If S3 sends duplicate notifications for the same object version, CodePipeline will start a new execution for each notification, causing the pipeline to run twice for a single commit.

Answer

CodePipeline has a deduplication setting that is disabled.

Answer

The S3 bucket has versioning enabled.

Answer

The pipeline is also triggered by a CloudWatch Events rule.

Question 7

A development team wants to automate infrastructure provisioning using AWS CloudFormation. Which tool is specifically designed to manage CloudFormation templates as part of a deployment pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct answer because it is a fully managed continuous delivery service that allows you to model, visualize, and automate the steps required to release your infrastructure changes. You can integrate CloudFormation as a deployment action within a pipeline stage, enabling the automated creation, update, or deletion of stacks based on template changes committed to a source repository.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 8

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. After a deployment, some instances fail the health check and are terminated by the Auto Scaling group. What should the DevOps engineer do to prevent this?

Accepted Answer

Update the deployment group to use an Elastic Load Balancer and configure health checks.. Configuring an Elastic Load Balancer (ELB) with health checks in the CodeDeploy deployment group allows CodeDeploy to monitor instance health during deployment. If an instance fails the ELB health check, CodeDeploy can automatically roll back or stop the deployment, preventing the Auto Scaling group from terminating unhealthy instances. This integrates the deployment lifecycle with load balancer health signals, ensuring only healthy instances serve traffic.

Answer

Configure a CloudWatch alarm to stop the deployment if instances are unhealthy.

Answer

Modify the deployment configuration to deploy to only one instance at a time.

Answer

Increase the desired capacity of the Auto Scaling group to tolerate failures.

Question 9

A DevOps team wants to run unit tests in parallel across multiple build environments using AWS CodeBuild. Which build specification configuration allows this?

Accepted Answer

Define a batch build with multiple builds.. AWS CodeBuild supports batch builds, which allow you to define a build project that runs multiple builds in parallel. By specifying a batch configuration in your buildspec file (using the `batch` section), you can run unit tests across multiple build environments simultaneously, improving test execution speed and resource utilization.

Answer

Use multiple build phases in the buildspec file.

Answer

Configure multiple artifacts in the buildspec.

Answer

Set environment variables to run multiple commands concurrently.

Question 10

A team uses AWS CodePipeline to deploy a microservices application. The pipeline has a deploy action that uses AWS CloudFormation. The CloudFormation template creates an Amazon ECS service. The deployment fails because the ECS service cannot be updated. What is the most likely cause?

Accepted Answer

The CloudFormation stack already exists and is in a previous failed state.. When a CloudFormation stack update fails, the stack enters a ROLLBACK_COMPLETE or UPDATE_ROLLBACK_COMPLETE state. In this state, the stack is considered to be in a 'failed' state and cannot be updated again until it is either deleted or the stack is manually continued with a rollback. CodePipeline's CloudFormation deploy action will attempt to perform a stack update, but CloudFormation rejects the request because the existing stack is in a non-updatable state, causing the pipeline deployment to fail.

Answer

The ECS service is in a steady state and cannot be modified.

Answer

The CodePipeline deploy action is configured with the wrong action type.

Answer

The IAM role used by CloudFormation does not have permission to update ECS services.

Question 11

A company uses AWS CodeBuild to run security scans. The scans require access to a private Amazon ECR repository. The build project is configured with a service role. What is the correct way to provide access to ECR?

Accepted Answer

Attach an IAM policy to the CodeBuild service role that allows ECR operations.. CodeBuild uses an IAM service role to define the permissions granted to the build environment. By attaching an IAM policy that allows ECR operations (such as ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:GetAuthorizationToken) to the CodeBuild service role, the build project can authenticate and pull images from the private ECR repository without needing to embed or manage static credentials.

Answer

Set environment variables with ECR credentials in the build project.

Answer

Configure the ECR repository policy to allow access from the CodePipeline service role.

Answer

Include the ECR credentials in the buildspec file.

Question 12

Which TWO options are valid ways to trigger an AWS CodePipeline execution automatically?

Accepted Answer

Create an Amazon CloudWatch Events rule that starts the pipeline on a schedule.. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a cron or rate expression to trigger an AWS CodePipeline execution on a schedule. This is a native integration that directly starts the pipeline without requiring additional compute resources or custom code.

Answer

Use a git push to the repository via SSH.

Answer

Set up a manual approval step in the pipeline.

Answer

Enable AWS CodeBuild to start the pipeline after a build.

Question 13

Which TWO AWS services can be used to implement a blue/green deployment for an application running on Amazon EC2 instances?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy (Option B) is correct because it natively supports blue/green deployments for Amazon EC2 instances by allowing you to provision a new set of instances (the green environment), deploy the new application revision to them, and then shift traffic from the old (blue) environment to the new one. This is achieved through integration with an Elastic Load Balancer (ELB) or Auto Scaling groups, where CodeDeploy manages the lifecycle of instances and traffic routing during the deployment process.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS CodeBuild

Question 14

Refer to the exhibit. A DevOps engineer created this IAM policy for a CodeDeploy service role. The deployment fails with an 'AccessDenied' error when attempting to register instances with an Auto Scaling group. What is the likely cause?

Accepted Answer

The policy is missing autoscaling:UpdateAutoScalingGroup and autoscaling:SetDesiredCapacity.. The CodeDeploy service role must include permissions for autoscaling:UpdateAutoScalingGroup and autoscaling:SetDesiredCapacity to allow CodeDeploy to register instances with an Auto Scaling group during a deployment. Without these actions, the deployment fails with an 'AccessDenied' error when CodeDeploy attempts to attach instances to the Auto Scaling group or adjust its capacity.

Answer

The policy does not allow autoscaling:CompleteLifecycleAction.

Answer

The role is not trusted by the EC2 service.

Answer

The iam:PassRole action is not scoped to the correct resource.

Question 15

A development team uses AWS CodeCommit for source control and wants to automatically run unit tests on every push to the main branch. Which AWS service should they use to trigger the tests?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it provides a fully managed continuous delivery service that can be configured to automatically trigger a build action (such as running unit tests in AWS CodeBuild) whenever a change is pushed to a specified branch in AWS CodeCommit. This is achieved by setting the source stage to the CodeCommit repository and branch, and then adding a build stage that invokes CodeBuild to execute the tests, enabling an automated CI/CD workflow.

Answer

AWS CodeBuild

Answer

Amazon CloudWatch Events

Answer

AWS CodeDeploy