DOP-C02 SDLC Automation Practice Test 10 — 15 Questions

Question 1

A development team uses AWS CodeStar to set up a continuous delivery pipeline for a web application. The application is deployed to an Elastic Beanstalk environment. After a successful deployment, the team wants to automatically run integration tests against the deployed application. What is the SIMPLEST way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a test stage in CodePipeline after the deploy stage that uses CodeBuild to run integration tests.. CodePipeline natively supports a test stage after the deploy stage, and using CodeBuild to run integration tests is the simplest and most integrated approach. This keeps the entire CI/CD workflow within CodePipeline without requiring external triggers, custom scripts, or platform hooks. CodeBuild can be configured to run tests against the deployed Elastic Beanstalk environment URL, and the pipeline will only proceed if the tests pass.

Answer

Configure the Elastic Beanstalk environment to run integration tests after deployment via a custom platform hook.

Answer

Use Amazon CloudWatch alarms to trigger a Lambda function that runs the tests.

Answer

Add a post-deployment script in the CodeDeploy appspec file to run tests.

Question 2

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline includes a source stage (S3), a build stage (CodeBuild) that minifies assets, and a deploy stage that copies files to the production S3 bucket. The deploy stage uses 's3 sync' command. After a recent deployment, some users report seeing old content. What is the MOST likely cause?

Accepted Answer

The website is served through Amazon CloudFront, and the CloudFront distribution cache was not invalidated after the deployment.. The most likely cause is that the static website is served through Amazon CloudFront, and the CloudFront distribution cache was not invalidated after the deployment. Even though the S3 bucket contents are updated via 's3 sync', CloudFront caches objects at edge locations based on TTL settings. Without a cache invalidation request, users continue to receive the old cached content until the TTL expires or the cache is manually cleared.

Answer

The S3 bucket policy blocks public read access, so users get a 403 error.

Answer

The IAM role for CodeBuild does not have permissions to write to the S3 bucket.

Answer

The deploy stage uses 's3 cp' instead of 's3 sync', so new files are not uploaded.

Question 3

A company uses AWS CodeCommit for source control. Developers work on feature branches and create pull requests to merge into the 'develop' branch. The company wants to enforce that all commits to the 'develop' branch are signed. Which AWS service or feature should be used to enforce this policy?

Accepted Answer

Use Amazon CloudWatch Events to trigger a Lambda function that verifies commit signatures and reverts unsigned commits.. AWS CodeCommit does not natively enforce signed commits through approval rule templates. To enforce commit signing, you can use a CloudWatch Events rule to trigger a Lambda function that verifies signatures. The Lambda can automatically revert unsigned commits, thereby enforcing the policy. Option B is incorrect because approval rule templates only require manual approvals from specified users; they do not verify commit signatures.

Answer

Create an approval rule template in CodeCommit that requires commits to be signed and associate it with the 'develop' branch.

Answer

Use AWS Key Management Service (KMS) to create a signing key and require developers to use it.

Answer

Configure an IAM policy that denies 'git push' unless the commit is signed.

Question 4

A company is using AWS CodeBuild to run builds for a Java application. The build takes a long time because it downloads Maven dependencies every time. The team wants to speed up the build by caching dependencies. Which TWO actions should be taken? (Choose 2)

Accepted Answer

Enable Amazon S3 caching in the CodeBuild project and specify an S3 bucket to store the cache.. CodeBuild supports Amazon S3 caching, which allows you to store build artifacts (such as Maven dependencies) in a specified S3 bucket. By enabling this feature, subsequent builds can download the cached dependencies from S3 instead of re-downloading them from the internet, significantly reducing build time. Option E is correct because the buildspec file must explicitly define the cache path (e.g., /root/.m2) to tell CodeBuild which directory to cache; without this, CodeBuild does not know what to save or restore.

Answer

Use CodeBuild's 'build cache' feature without specifying a bucket; it will automatically cache to a default location.

Answer

Set the cache type to 'Local' in the CodeBuild project configuration.

Answer

Mount an Amazon EFS file system to the build container and configure Maven to use it as a local repository.

Question 5

A company uses AWS CodePipeline with multiple stages: Source (CodeCommit), Build (CodeBuild), Test (CodeBuild), and Deploy (CodeDeploy to EC2). The Test stage runs integration tests that require network access to a private database in a VPC. The CodeBuild project is configured to use a VPC. However, the Test stage fails intermittently with timeout errors. Which TWO actions would MOST likely resolve the issue? (Choose 2)

Accepted Answer

Increase the timeout for the Test stage in the CodeBuild project to accommodate network delays.. The intermittent timeout errors suggest that the Test stage's integration tests are occasionally taking longer than the configured timeout. Increasing the timeout accommodates these delays, preventing premature failures. Option C is correct because a NAT gateway is required for CodeBuild in a VPC to access resources outside the VPC, such as the private database, if the database is in a different subnet or requires internet-routable traffic.

Answer

Remove the VPC configuration from the CodeBuild project and use a public subnet instead.

Answer

Use a larger compute type for the CodeBuild project to improve network performance.

Answer

Configure the security group for the CodeBuild project to allow outbound traffic to the database security group on the required port.

Question 6

A DevOps engineer is setting up a CI/CD pipeline for a Python application using AWS CodePipeline. The pipeline includes a build stage with CodeBuild and a deploy stage that runs an AWS CLI command to update a Lambda function. Which THREE steps are necessary to ensure the pipeline can update the Lambda function? (Choose 3)

Accepted Answer

Store the AWS CLI command in the buildspec file or as a separate script in the source repository.. The AWS CLI command to update the Lambda function must be defined in the buildspec file or as a script in the source repository so that CodeBuild can execute it during the deploy stage. This ensures the pipeline has the exact command to run, and it becomes part of the version-controlled build specification.

Answer

Configure a CloudWatch Events rule to trigger the pipeline when the Lambda function is updated.

Answer

Use AWS CodeDeploy instead of the AWS CLI to update the Lambda function.

Question 7

Your company uses AWS CodePipeline to automate the deployment of a critical web application. The pipeline consists of a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy) that deploys to an Auto Scaling group of EC2 instances running Amazon Linux 2. The deployment strategy is 'AllAtOnce'. Recently, the team noticed that during deployments, the application becomes completely unavailable for a few minutes until the new instances are registered with the load balancer. The business requires zero downtime during deployments. You need to modify the deployment process to achieve zero downtime while minimizing cost and complexity. The Auto Scaling group currently has a minimum of 2 instances and a maximum of 4 instances. The application is stateless and sessions are stored in ElastiCache. Which solution should you implement?

Accepted Answer

Use CodeDeploy's blue/green deployment with an Application Load Balancer. Create a new Auto Scaling group for the green environment, deploy to it, and then shift traffic.. CodeDeploy's 'Blue/Green' deployment creates new instances, shifts traffic, and allows rollback, achieving zero downtime. Option A is incorrect because 'HalfAtATime' still causes temporary capacity reduction. Option B is incorrect because increasing minimum size does not change deployment strategy. Option D is incorrect because creating a new ASG and using DNS can work but is more complex and costly than CodeDeploy's built-in blue/green.

Answer

Create a second Auto Scaling group, deploy to it, and then update Route 53 to point to the new group.

Answer

Change the deployment configuration to 'HalfAtATime' to update half the instances at a time.

Answer

Increase the Auto Scaling group's minimum size to 4 so there are always extra instances.

Question 8

You are a DevOps engineer for a company that uses AWS CodePipeline to deploy a microservice to Amazon ECS with Fargate. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild) that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that uses an ECS task definition update. Recently, the deploy stage started failing intermittently with the error 'The task definition does not have a compatibilities attribute set correctly.' The task definition is generated dynamically during the build stage and uses the 'FARGATE' launch type. The error occurs only when a new task definition revision is created. You suspect the issue is related to how the task definition is generated. Upon reviewing the buildspec, you see that the task definition JSON is created using environment variables for the image URI. What is the MOST likely cause and solution?

Accepted Answer

The task definition JSON does not include the 'requiresCompatibilities' field with the value '["FARGATE"]'.. The 'requiresCompatibilities' attribute must be explicitly set to 'FARGATE' for Fargate tasks. Option A is incorrect because the error is about compatibilities, not execution role. Option C is incorrect because network mode should be 'awsvpc', but that is not the error. Option D is incorrect because CPU and memory values are required but would cause a different error.

Answer

The task definition is missing the 'executionRoleArn' field, which is required for Fargate.

Answer

The task definition specifies 'networkMode' as 'bridge', but Fargate requires 'awsvpc'.

Answer

The task definition does not specify 'cpu' and 'memory' values, which are required for Fargate.

Question 9

A development team is using AWS CodeCommit as the source for a CI/CD pipeline. They want to automatically trigger a build in AWS CodeBuild whenever a developer pushes changes to any branch in the repository. Which pipeline configuration should be used?

Accepted Answer

Configure a CodeCommit repository trigger to invoke a Lambda function that starts a CodeBuild build. CodeCommit repository triggers can directly invoke a Lambda function on push events, and that Lambda can start a CodeBuild build. This provides the exact per-branch push event trigger the team needs without polling or scheduled executions, and it works for all branches automatically.

Answer

Configure CodePipeline to poll the CodeCommit repository every minute

Answer

Use Amazon EventBridge to capture CodeCommit events and start a CodePipeline execution

Answer

Set up a scheduled CodePipeline execution using Amazon CloudWatch Events

Question 10

A DevOps engineer is designing a CI/CD pipeline that must enforce a policy: any change to the production branch in CodeCommit must be reviewed and approved by two senior developers before the change can be merged. The pipeline must also automatically build and deploy to a staging environment after approval. Which combination of AWS services and configurations should be used?

Accepted Answer

Use CodeCommit pull request approval rules and a CodePipeline with a manual approval step triggered by a Lambda function that checks approval status. CodeCommit pull request approval rules enforce the requirement for two senior developers to approve changes before merging, and CodePipeline with a manual approval step can be configured to trigger a Lambda function that checks the approval status before proceeding to build and deploy to staging. This combination directly satisfies the policy of requiring two approvals and automating the build/deploy after approval.

Answer

Configure CodeBuild to run a script that checks the commit author and rejects if not approved

Answer

Use Amazon EventBridge to trigger a Lambda function that validates the number of approvers before merging

Answer

Use IAM policies to restrict write access to the production branch to only senior developers

Question 11

A DevOps team uses AWS CodeBuild to compile a Java application. The build environment is managed by AWS and runs on Linux. The team wants to speed up the build process by caching dependency directories across builds. Which configuration should the team use?

Accepted Answer

Enable local caching in the CodeBuild project and specify the cache location as /root/.m2. AWS CodeBuild supports local caching, which stores specified directories on the build host's local instance storage. By configuring the cache type as 'local' and specifying the cache location as `/root/.m2` (the default Maven local repository), the team can persist downloaded Maven dependencies across builds, significantly reducing build time by avoiding re-downloading dependencies.

Answer

Configure the buildspec file to use Docker layer caching

Answer

Use the CodeBuild cache configuration to store the entire build output in a custom Docker image

Answer

Store dependencies in an Amazon S3 bucket and download them at the start of each build

Question 12

A company is implementing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application using the AWS Serverless Application Model (SAM). The pipeline must build and package the application, then deploy it to multiple environments (dev, test, prod) sequentially with manual approval gates before production. Which stage configuration should be used?

Accepted Answer

Use a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, then separate deploy stages for each environment with manual approval actions. It uses a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, which is the recommended approach for SAM-based deployments. The pipeline then separates deploy stages for each environment (dev, test, prod) with manual approval actions before production, satisfying the sequential deployment and manual gate requirements.

Answer

Use a single CloudFormation stack with a change set approval step

Answer

Configure CodePipeline with a deploy action provider set to AWS CloudFormation

Answer

Use CodeDeploy to deploy the SAM template directly to Lambda

Question 13

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment strategy is Blue/Green. After a successful deployment, the team notices that the new instances are receiving traffic but the application returns errors. The old instances are still serving traffic correctly. The team wants to roll back immediately. What should be done?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails, then manually trigger a rollback.. To roll back a CodeDeploy Blue/Green deployment, you should initiate a rollback deployment with the previous application revision. This can be done via the AWS CLI (`aws deploy create-deployment` with the old revision) or via the CodeDeploy console. Configuring automatic rollback on deployment failure is a separate setting and is not a prerequisite for manual rollback. The explanation should be corrected to state that the rollback process creates a new replacement environment with the previous revision (or reuses the original if still available) and shifts traffic to it, not that automatic rollback must be configured first.

Answer

Stop the current deployment using the AWS CLI.

Answer

Manually update the Auto Scaling group to associate new instances with the old launch configuration.

Answer

Redeploy the same application revision to the same Auto Scaling group.

Question 14

An organization uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. Developers complain that their pipeline executions often fail because the source stage cannot access the CodeCommit repository. The IAM role used by CodePipeline has the following policy attached. What is the MOST likely cause of the failure? Policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["codecommit:GetBranch","codecommit:GetCommit","codecommit:UploadArchive","codecommit:GetUploadArchiveStatus"],"Resource":"*"}]}

Accepted Answer

The IAM role is missing the 'codecommit:GitPull' permission. The IAM role for CodePipeline is missing the 'codecommit:GitPull' permission, which is required for CodePipeline to clone the repository and fetch source artifacts during the source stage. The listed actions (GetBranch, GetCommit, UploadArchive, GetUploadArchiveStatus) are insufficient for the Git-based pull operation that CodePipeline performs over HTTPS.

Answer

The IAM role does not have permissions to describe the CodeCommit repository

Answer

The CodeCommit repository is not tagged with the pipeline's project tag

Answer

The pipeline uses a CodeStar connection instead of a direct CodeCommit source

Question 15

A company uses AWS CodeBuild to run unit tests and package a Node.js application. The buildspec.yml file includes commands to install dependencies using npm. The build is failing with the error: 'npm ERR! code EACCES'. How should a DevOps engineer resolve this issue?

Accepted Answer

Use 'npm ci' instead of 'npm install' and ensure a package-lock.json is present. The EACCES error in CodeBuild indicates a permission issue when npm tries to write to the node_modules directory. The default CodeBuild user (usually 'codebuild-user') lacks write permissions to the project root, which is owned by root. Using 'npm ci' (clean install) is the correct resolution because it bypasses the permission issue by using the package-lock.json to install dependencies deterministically, and it does not attempt to modify the lock file or run lifecycle scripts that may require elevated permissions. Additionally, 'npm ci' is faster and more reliable in CI/CD environments like CodeBuild.

Answer

Configure the CodeBuild project to use a custom VPC with a NAT gateway for internet access

Answer

Configure the buildspec to run npm install with sudo

Answer

Add a command to change the ownership of the node_modules directory to the current user