DOP-C02 SDLC Automation Practice Test 10 — 15 Questions

Question 1

A team uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a deployment stage that uses AWS CodeDeploy to copy files to an S3 bucket. However, the deployment fails because the S3 bucket is not configured for static website hosting. What is the MOST likely cause of the failure?

Accepted Answer

The S3 bucket does not have static website hosting enabled.. Option A is correct because CodeDeploy for S3 does not require bucket policy changes; the failure is due to missing static website hosting configuration. Option B is wrong because IAM roles should be fine. Option C is wrong because CodeDeploy does not need the bucket to be public. Option D is wrong because S3 is not a deployment target for CodeDeploy? Actually CodeDeploy can deploy to EC2/On-premises/Lambda, not directly to S3. The question assumes CodeDeploy is used incorrectly. But the best answer is A as per typical issues.

Answer

The IAM role for CodeDeploy does not have permissions to write to the S3 bucket.

Answer

The S3 bucket is not configured as a public bucket.

Answer

AWS CodeDeploy cannot deploy to S3 buckets.

Question 2

A company is using AWS CodeBuild to run integration tests. The tests require access to an Amazon RDS instance in a private subnet. The CodeBuild project is configured with a VPC ID, subnet IDs, and security group IDs. However, the tests fail with a connection timeout. What is the MOST likely cause?

Accepted Answer

The security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group.. Option D is correct because the security group must allow inbound traffic from the CodeBuild security group. Option A is wrong because the CodeBuild project has VPC configuration. Option B is wrong because NAT gateway is not needed for VPC-to-VPC communication within same VPC. Option C is wrong because internet access is not required.

Answer

The CodeBuild project does not have internet access to download packages.

Answer

The CodeBuild project is not associated with a VPC.

Answer

The RDS instance is not publicly accessible and requires a NAT gateway.

Question 3

A company has a CI/CD pipeline that deploys to Amazon ECS using AWS CodePipeline. The pipeline includes a manual approval step before deployment to production. The security team requires that all approvals be logged in AWS CloudTrail and that the approver's identity be verified. Which action should the DevOps engineer take to meet these requirements?

Accepted Answer

Ensure that the manual approval action is configured as a CodePipeline approval action; CloudTrail will log the 'Approval' event with the IAM user ARN.. Option C is correct because CodePipeline manual approval actions are already logged in CloudTrail with the approver's IAM user ARN. Option A is wrong because CloudWatch Logs do not capture approval actions. Option B is wrong because CloudTrail is sufficient. Option D is wrong because enabling CloudTrail is not needed if already enabled.

Answer

Create a custom CloudTrail trail specifically for CodePipeline API calls.

Answer

Enable CloudTrail Insights to detect unusual approval activity.

Answer

Configure the approval action to send a notification to an Amazon SNS topic, and log the SNS delivery to CloudWatch Logs.

Question 4

A development team uses AWS CodeCommit as a Git repository. They want to automatically trigger a build in AWS CodeBuild when a pull request is created or updated. Which configuration should the team use?

Accepted Answer

Create a CodeCommit trigger that invokes CodeBuild on 'Pull Request Created' and 'Pull Request Updated' events.. Option A is correct because CodeCommit can trigger CodeBuild via a repository trigger. Option B is wrong because CodePipeline does not directly trigger on pull requests. Option C is wrong because CloudWatch Events can trigger on pull request events but CodeBuild can be invoked directly via triggers. Option D is wrong because SNS cannot trigger CodeBuild directly.

Answer

Use Amazon SNS to notify CodeBuild when a pull request is created.

Answer

Use Amazon CloudWatch Events to detect CodeCommit pull request events and invoke CodeBuild.

Answer

Configure CodePipeline with a source action on CodeCommit and a build action, and set the pipeline to start on source changes.

Question 5

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage that runs 'npm install' and 'npm test'. The team notices that the build stage often fails due to network timeouts when downloading npm packages. Which action would MOST reliably resolve this issue?

Accepted Answer

Configure the CodeBuild project to use a VPC with a NAT gateway to the internet.. Option B is correct because using a VPC with a NAT gateway ensures consistent outbound internet access for CodeBuild. Option A is wrong because npm packages are not cached by default. Option C is wrong because increasing timeout may not resolve timeouts. Option D is wrong because using a custom image does not fix network issues.

Answer

Use a custom Docker image that includes pre-installed npm packages.

Answer

Enable local dependency caching in the buildspec file.

Answer

Increase the build timeout to the maximum value.

Question 6

A company is using AWS CodePipeline with a deployment stage that uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that if the CloudFormation stack update fails, the pipeline automatically rolls back to the previous version of the stack. Which configuration should the DevOps engineer implement?

Accepted Answer

In the CodePipeline CloudFormation deployment action, set 'Stack failure behavior' to 'ROLLBACK'.. Option D is correct because CloudFormation deployment actions in CodePipeline can be configured with 'Stack failure behavior' set to 'ROLLBACK'. Option A is wrong because CloudFormation stack policy does not control rollback. Option B is wrong because change sets are for manual review. Option C is wrong because rollback triggers in CodeDeploy are for CodeDeploy, not CloudFormation.

Answer

Configure the CodeDeploy deployment group to automatically roll back on failure.

Answer

Configure a CloudFormation stack policy to prevent updates and force rollback.

Answer

Use CloudFormation change sets and manually execute them after review.

Question 7

A DevOps team is designing a CI/CD pipeline for a microservices application that runs on Amazon ECS. They need to implement automated canary deployments. Which TWO AWS services would be essential for this implementation?

Accepted Answer

AWS CodeDeploy. Options B and D are correct. AWS CodeDeploy supports canary deployments for ECS, and AWS CloudWatch provides metrics for monitoring. Option A is wrong because CodeBuild is for building, not deployment. Option C is wrong because CloudFormation can deploy but does not natively support canary. Option E is wrong because EC2 Auto Scaling is not directly used for canary.

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Answer

Amazon EC2 Auto Scaling

Question 8

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The team wants to automatically test the deployed application before promoting it to production. Which THREE steps should be included in the pipeline?

Accepted Answer

Add a stage that runs a performance or load test.. Options A, C, and D are correct. After deployment, an integration test stage validates the deployment. A manual approval stage allows review before promotion. Additional testing (e.g., load test) can be added. Option B is wrong because a separate deployment to a different environment is not necessary. Option E is wrong because rolling back is not a testing step.

Answer

Add a stage that automatically rolls back the deployment if tests fail.

Answer

Add a stage that deploys the application to a separate production environment.

Question 9

A company is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yaml includes commands to build and tag the image. However, the push to ECR fails with an authentication error. Which TWO actions should the DevOps engineer take to resolve this?

Accepted Answer

Add a command in the buildspec to run 'aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com'.. Options B and D are correct. The CodeBuild project must have an IAM role with permissions to push to ECR, and the buildspec must include the 'aws ecr get-login-password' command to authenticate. Option A is wrong because Docker login is not needed. Option C is wrong because ECR does not require a public repository. Option E is wrong because ECR lifecycle policies are not related.

Answer

Configure the ECR repository as public.

Answer

Create an ECR lifecycle policy to expire untagged images.

Answer

Run 'docker login' with ECR credentials in the buildspec.

Question 10

A DevOps team uses AWS CodePipeline with a multi-branch strategy. The pipeline should deploy to production only from the 'main' branch, but run unit tests for all branches. How should the team configure the pipeline?

Accepted Answer

Configure the pipeline source stage to trigger on all branches, use branch-specific logic in the test stage, and add a manual approval step for production deployment only when the branch is 'main'.. Option C is correct because CodePipeline can use branch filtering in the source stage to trigger on specific branches, and the test stage can be configured to run for all branches. Option A is wrong because a single pipeline cannot have dynamic branch-based stages without multiple pipelines. Option B is wrong because separate pipelines per branch would duplicate effort. Option D is wrong because Lambda triggers are not the standard way to implement branch-based logic; branch filtering is native.

Answer

Use an AWS Lambda function to check the branch name and invoke different CodePipeline executions for testing and deployment.

Answer

Create one pipeline with two source stages: one for 'main' and one for all other branches, each with its own test and deploy actions.

Answer

Create a separate pipeline for each branch, each with identical test and deploy stages.

Question 11

A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?

Accepted Answer

The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).. Option B is correct because CodeBuild must be configured with a security group that allows outbound traffic to the RDS security group on the database port. Option A is wrong because IAM permissions affect API calls, not network connectivity. Option C is wrong because subnet CIDR is not relevant for security group rules. Option D is wrong because CodeBuild can access resources in the same VPC if security groups allow.

Answer

CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.

Answer

The CodeBuild service role does not have rds:Connect permission.

Answer

The RDS instance is in a different subnet CIDR than CodeBuild's subnet.

Question 12

A team uses AWS CloudFormation to manage infrastructure. They want to reuse a common set of resources (e.g., VPC, subnets) across multiple stacks. Which CloudFormation feature should they use?

Accepted Answer

Nested stacks. Option A is correct because nested stacks allow reusing a common template. Option B is wrong because cross-stack references allow passing values but not reusing resource definitions. Option C is wrong because custom resources are for extending CloudFormation. Option D is wrong because StackSets deploy across accounts/regions.

Answer

Custom resources

Answer

StackSets

Answer

Cross-stack references

Question 13

A development team uses AWS CodeCommit for source control. They want to enforce that all commits include a JIRA issue key in the commit message. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function on every push to validate commit messages.. Option D is correct because CodeCommit can trigger a Lambda function on pushes to run custom validation. Option A is wrong because branch policies are for pull requests, not commit messages. Option B is wrong because CloudWatch Events can trigger Lambda, but direct trigger from CodeCommit is simpler. Option C is wrong because pre-commit hooks are client-side and not enforceable.

Answer

Use Amazon CloudWatch Events to detect new commits and invoke a Lambda function to validate the commit message.

Answer

Implement a pre-commit hook in each developer's local repository.

Answer

Configure a branch policy on the repository that requires commit message format.

Question 14

A company runs a critical application on Amazon ECS with Fargate. They use blue/green deployments via AWS CodeDeploy. During a recent deployment, the new task set failed health checks and CodeDeploy automatically rolled back. However, the old task set also became unhealthy shortly after rollback. What could explain this?

Accepted Answer

The new application version changed the database schema, which broke the old version after rollback.. Option A is correct because a shared resource like a database schema change by the new version could corrupt data for the old version. Option B is wrong because CodeDeploy does not drain connections from ALB before rollback by default, but that would not cause the old version to become unhealthy. Option C is wrong because CloudWatch alarms are not configured by CodeDeploy to stop old tasks. Option D is wrong because ECS service auto-scaling does not stop tasks.

Answer

The CloudWatch alarm that triggered the rollback also stopped the old task set.

Answer

CodeDeploy did not drain connections from the Application Load Balancer before terminating the old task set.

Answer

The ECS service auto-scaling policy reduced the desired count of the old task set during the deployment.

Question 15

A team wants to automate the creation of a CI/CD pipeline using a JSON/YAML file that defines source, build, and deploy stages. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. Option B is correct because AWS CloudFormation can define CodePipeline resources in a template. Option A is wrong because CodePipeline itself uses a structure, but not to create itself. Option C is wrong because CodeDeploy is for deployment, not pipeline creation. Option D is wrong because Elastic Beanstalk is for applications, not pipeline definition.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CodeDeploy