DOP-C02 SDLC Automation Practice Test 11 — 15 Questions

Question 1

A DevOps team uses AWS CodePipeline to deploy a static website to an Amazon S3 bucket. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that runs a build tool), and a deploy stage (S3). After a recent code change, the build stage succeeded but the deploy stage failed with the error: 'Access Denied' when uploading artifacts to the S3 bucket. What should the team do to fix the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add 's3:PutObject' permission to the CodePipeline service role. The deploy stage in CodePipeline uses the CodePipeline service role to upload artifacts to the S3 bucket. The error 'Access Denied' indicates that this role lacks the necessary permissions. Adding 's3:PutObject' to the CodePipeline service role grants it the required write access to the S3 bucket, resolving the issue.

Answer

Configure the S3 bucket to allow public access

Answer

Add an S3 bucket policy that grants the CodeBuild service role s3:PutObject access

Answer

Verify that the CodeCommit repository has the correct permissions for the pipeline

Question 2

A company is using AWS CodeCommit with multiple repositories. Developers are required to create pull requests for all changes, and the pull request must be associated with a JIRA issue key (e.g., PROJ-123) in the commit message. A DevOps engineer needs to enforce this policy automatically. Which approach meets the requirement with minimal operational overhead?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function to validate the pull request description and reject if missing JIRA key. CodeCommit triggers can invoke an AWS Lambda function on pull request events (e.g., created or updated). The Lambda function can parse the pull request description or commit messages for a JIRA key pattern (e.g., regex `[A-Z]+-\d+`) and, if missing, automatically reject the pull request by updating its status or adding a comment. This serverless approach enforces the policy without requiring any changes to developer workflows or additional infrastructure, minimizing operational overhead.

Answer

Store JIRA keys in an S3 bucket and configure a CloudWatch Events rule to check commits

Answer

Use AWS CodeBuild to run a validation script during the build phase

Answer

Require developers to install a pre-commit hook script locally

Question 3

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project can access a private Amazon S3 bucket to download build artifacts? (Choose two.)

Accepted Answer

Add a bucket policy that explicitly allows access from the CodeBuild project's IAM role ARN. A bucket policy can explicitly grant access to the CodeBuild project's IAM role ARN, allowing the CodeBuild service to download objects from the private S3 bucket. This is a common method to cross-account or service-specific access without making the bucket public.

Answer

Generate an access key and secret key for the CodeBuild project to use in the buildspec

Answer

Configure the CodeBuild project to run in a VPC with an S3 VPC endpoint

Answer

Make the S3 bucket publicly readable

Question 4

A company uses AWS CodeBuild to run unit tests as part of a CI pipeline. The buildspec.yaml file is located in the root of the source repository. The build takes 30 minutes to complete. The team wants to speed up the build by caching dependencies. Which approach should they take?

Accepted Answer

Configure the buildspec.yaml to enable local caching and specify the paths to cache.. CodeBuild's local caching feature allows you to specify paths in the buildspec.yaml (e.g., /root/.m2 for Maven or /root/.cache/pip for pip) that are preserved between builds on the same build environment. This avoids re-downloading dependencies from the internet each time, significantly reducing build time for a 30-minute build. The cache is stored on the build instance's local storage and is automatically managed by CodeBuild.

Answer

Download dependencies from the internet each time the build runs.

Answer

Mount an Amazon EFS file system to the build container and store dependencies there.

Answer

Store dependencies in an AWS CodeCommit repository and clone it during the build.

Question 5

Which THREE steps are required to set up a continuous deployment pipeline using AWS CodePipeline that deploys a Docker-based application to Amazon ECS? (Choose three.)

Accepted Answer

Create a source stage that uses AWS CodeCommit as the source provider. AWS CodePipeline requires a source stage to detect changes in the source code repository. AWS CodeCommit is a fully managed source control service that integrates natively with CodePipeline, allowing automatic pipeline execution when new commits are pushed to the specified branch. This is a fundamental step in establishing a continuous delivery workflow.

Answer

Create a deploy stage that uses AWS CodeDeploy to deploy to Amazon ECS

Answer

Create an invoke stage that uses AWS Lambda to update the ECS service

Question 6

Which TWO approaches can be used to automatically roll back a failed deployment in AWS CodeDeploy? (Choose two.)

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails. AWS CodeDeploy allows you to configure a deployment group to automatically roll back a deployment when it fails. This is a native feature that can be enabled in the deployment group settings, ensuring that if a deployment fails (e.g., due to health check failures or script errors), CodeDeploy automatically reverts to the last known good revision without manual intervention.

Answer

Use a CloudWatch Events rule to trigger a rollback when a deployment fails

Answer

Attach an IAM policy to the CodeDeploy service role that allows rollback actions

Answer

Specify a rollback revision in the AppSpec file

Question 7

A company has a CI/CD pipeline using AWS CodePipeline that deploys a critical web application to an Auto Scaling group of EC2 instances. The pipeline includes a deploy stage using AWS CodeDeploy. Recently, the deployment failed because the new application version caused an increase in HTTP 500 errors. The operations team manually rolled back the deployment by redeploying the previous version. However, the team wants to automate this process so that future failed deployments are automatically rolled back. Additionally, they want to ensure that if the rollback itself fails, the system should alert the on-call engineer. Currently, the deployment group is configured with 'rollback when a deployment fails' disabled. The team has also set up a CloudWatch alarm that triggers when the HTTP 500 error rate exceeds a threshold. What should a DevOps engineer do to meet these requirements with minimal operational overhead?

Accepted Answer

Configure the deployment group to automatically roll back when a CloudWatch alarm is triggered, and also enable automatic rollback on deployment failure. Set up a CloudWatch alarm on the deployment group's failure metric to notify the on-call engineer. It uses CodeDeploy's built-in features to automatically roll back when a CloudWatch alarm (HTTP 500 error rate) triggers, and also enables rollback on deployment failure. If the rollback itself fails, the deployment group's failure metric triggers a CloudWatch alarm to notify the on-call engineer via SNS. This meets all requirements with minimal operational overhead. Option B is incorrect because it adds unnecessary complexity with a Lambda function, while CodeDeploy already supports alarm-based rollback. Option C introduces manual intervention, which contradicts the automation requirement. Option D only enables rollback on failure, not on alarm, so it would not detect HTTP 500 errors during deployment.

Answer

Create a CloudWatch Events rule that triggers an AWS Lambda function to roll back the deployment when the alarm state is reached, and configure the Lambda function to send an SNS notification on failure

Answer

Add a manual approval step before the deploy stage in CodePipeline and require the on-call engineer to approve or reject the deployment

Answer

Enable the 'rollback when a deployment fails' option in the deployment group and create a CloudWatch alarm on the deployment group's failure metric to notify the on-call engineer via Amazon SNS

Question 8

A company is implementing a CI/CD pipeline using AWS CodePipeline. The source code is stored in an AWS CodeCommit repository. The pipeline must automatically start whenever a change is pushed to any branch. Which configuration is required?

Accepted Answer

Create a CloudWatch Events rule that matches CodeCommit push events and targets the CodePipeline pipeline.. AWS CodePipeline can be triggered automatically by Amazon CloudWatch Events when a CodeCommit repository receives a push event. By creating a CloudWatch Events rule that matches the `codecommit:GitPush` event source and targets the pipeline, the pipeline starts automatically on any branch push without polling or manual intervention.

Answer

Add a branch creation trigger in CodeCommit that starts the pipeline.

Answer

Create an SNS topic and subscribe the pipeline to it, then configure CodeCommit to publish to the topic on push.

Answer

Configure the pipeline to poll the CodeCommit repository every few minutes.

Question 9

A company uses AWS CodeCommit, CodeBuild, and CodePipeline to manage a multi-module Java application. The pipeline has a single build stage that runs tests and packages the application into a JAR file. Recently, the team split the application into multiple microservices, each in its own CodeCommit repository. They want to create a single pipeline that can build all microservices in parallel and then deploy them together to an Amazon ECS cluster. The pipeline should trigger when any of the repositories receives a push. Currently, the pipeline is configured with a single source stage pointing to one repository. The build stage uses a single build project. The team wants to minimize changes to the existing pipeline structure. What should a DevOps engineer do to achieve this?

Accepted Answer

Add multiple source actions in the source stage, each pointing to a different CodeCommit repository. Configure the build stage to use multiple input artifacts and update the build project to build all modules. CodePipeline supports multiple source actions in the same stage, and each source can have its own CodeCommit repository. Additionally, CodeBuild can be configured to use multiple input artifacts, allowing the build project to access all repositories. The pipeline trigger can be set to any source change. Option A is wrong because a single source action cannot point to multiple repositories. Option B is wrong because webhooks would require separate pipelines. Option C is wrong because Lambda invocation adds complexity and is not the simplest approach.

Answer

Create a separate pipeline for each microservice and use a webhook to trigger all pipelines on any push

Answer

Create a single source action that uses an S3 bucket as source, and have each repository push to the S3 bucket via a Lambda function

Answer

Create a single source action in CodePipeline that uses a Lambda function to pull from all repositories

Question 10

A startup is using AWS CodePipeline to deploy a Python web application to AWS Elastic Beanstalk. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (Elastic Beanstalk). The build stage runs unit tests and creates a deployable zip file. The deploy stage uses the Elastic Beanstalk deploy provider. Recently, the deploy stage started failing with the error: 'The API call 'elasticbeanstalk:CreateApplicationVersion' failed with status 403.' The CodePipeline service role has the following permissions: 'elasticbeanstalk:DescribeApplications', 'elasticbeanstalk:DescribeEnvironments', 'elasticbeanstalk:UpdateEnvironment'. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Add the 'elasticbeanstalk:CreateApplicationVersion' and 'elasticbeanstalk:DeleteApplicationVersion' permissions to the CodePipeline service role. The error indicates that the CodePipeline service role lacks the permission 'elasticbeanstalk:CreateApplicationVersion', which is required by the Elastic Beanstalk deploy provider to create a new application version from the build artifact. Therefore, adding the missing permissions (CreateApplicationVersion and optionally DeleteApplicationVersion) to the pipeline role resolves the issue. Option C is correct. Option A is wrong because changing the deploy provider to CodeDeploy is unnecessary and would require reconfiguring the deployment target. Option B is misleading because S3 permissions are not the immediate issue; the pipeline role already needs S3 permissions to read artifacts, but the specific error is about Elastic Beanstalk API calls, not S3 uploads. Option D is incorrect because the issue is with the pipeline role's permissions, not the Elastic Beanstalk environment's service role.

Answer

Change the deploy provider to use CodeDeploy instead of Elastic Beanstalk

Answer

Add 's3:PutObject' permission to the CodePipeline service role to allow it to upload the zip file to S3

Answer

Update the Elastic Beanstalk environment's service role to allow CodePipeline to deploy

Question 11

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project's artifacts are automatically deployed to an Amazon S3 bucket with server-side encryption using AWS KMS? (Choose 2.)

Accepted Answer

In the buildspec.yaml, set the 'artifacts' section to include 'encryptionDisabled: false' and specify the KMS key ID.. Setting 'encryptionDisabled: false' in the buildspec.yaml artifacts section explicitly enables encryption for the build output, and specifying the KMS key ID ensures that the artifacts are encrypted with that specific AWS KMS key. This configuration directly instructs CodeBuild to use server-side encryption with AWS KMS when uploading artifacts to S3.

Answer

Enable versioning on the S3 bucket.

Answer

Configure the S3 bucket policy to require HTTPS for all uploads.

Answer

Enable default encryption on the S3 bucket using SSE-KMS.

Question 12

A development team is using AWS CodeCommit as a source control repository. They want to automate the creation of a new feature branch whenever a developer creates a new Jira issue with a specific label. Which AWS service should be used to listen for Jira webhooks and trigger the branch creation?

Accepted Answer

AWS Lambda with Amazon API Gateway to receive the webhook. AWS Lambda with Amazon API Gateway is the correct choice because API Gateway can expose a public HTTPS endpoint that Jira can send webhook POST requests to. The Lambda function then processes the incoming payload, checks for the specific label, and uses the AWS SDK to create a new branch in CodeCommit. This provides a real-time, event-driven integration without polling or scheduled checks.

Answer

Amazon EventBridge to schedule a rule every minute

Answer

AWS CodePipeline to poll for new Jira issues

Answer

AWS CodeBuild to run a build when a webhook is received

Question 13

A company uses AWS CodePipeline with multiple stages: source, build, test, and deploy. The test stage takes 45 minutes to complete. Developers complain that the pipeline takes too long to provide feedback. The team wants to run tests in parallel across multiple environments. Which approach should be taken to reduce the pipeline execution time?

Accepted Answer

Configure the test stage with parallel actions in CodePipeline. AWS CodePipeline supports parallel actions within a stage, allowing multiple test environments (e.g., different OS or browser configurations) to run simultaneously. This reduces the overall pipeline execution time from the sum of sequential tests to the duration of the longest single test (45 minutes), provided the parallel actions are independent. By configuring the test stage with parallel actions, the team can achieve faster feedback without altering the underlying test logic or infrastructure.

Answer

Increase the compute capacity of the test environment

Answer

Use AWS CodeBuild batch builds with a single buildspec

Answer

Create multiple pipelines, each running a subset of tests

Question 14

Which TWO criteria must be met for an AWS CloudFormation stack update to be successful? (Choose 2.)

Accepted Answer

The update template must be valid and must not contain any syntax errors.. AWS CloudFormation validates the template syntax and structure before initiating any stack update. If the template contains invalid JSON or YAML, references nonexistent resources, or violates intrinsic function rules, the update request is rejected immediately. This validation ensures that only syntactically correct templates proceed to the update operation.

Answer

The stack must be in a steady state with no previous failed updates.

Answer

A change set must be created and executed before the update.

Answer

The stack must have no drift detected.

Question 15

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack update. The stack contains an AWS::Lambda::Function resource. The update failed with the error 'Resource creation cancelled' after a timeout. The engineer wants to view the logs from the Lambda function during the stack update to diagnose the issue. What should the engineer do?

Accepted Answer

Access the CloudWatch Logs log group for the Lambda function. AWS Lambda automatically sends function execution logs to Amazon CloudWatch Logs. When a Lambda function is invoked during a CloudFormation stack update (e.g., via a custom resource or a function that runs as part of the update), all stdout, stderr, and logging statements are captured in a log group named /aws/lambda/<function-name>. Accessing this log group allows the engineer to view detailed error messages, stack traces, or timeout-related output that caused the 'Resource creation cancelled' failure.

Answer

Use AWS CodeBuild to build and test the function locally

Answer

Enable detailed CloudFormation logging in the stack template

Answer

Review the CloudFormation stack events in the AWS Management Console