DOP-C02 SDLC Automation Practice Test 11 — 15 Questions

Question 1

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline triggers on changes to the S3 bucket. However, the pipeline does not trigger when a new object is uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to invoke the pipeline.. Option C is correct because S3 event notifications need to be configured to trigger CodePipeline. Option A is wrong because the source stage bucket and pipeline must be in the same region, but the question implies it's not triggering. Option B is wrong because versioning is not required for pipeline triggers. Option D is wrong because bucket policies do not affect event notifications.

Answer

The S3 bucket policy denies the CodePipeline service role.

Answer

The S3 bucket is in a different AWS Region than the pipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 2

A company uses AWS CodeBuild to run builds for a Java application. The buildspec includes a 'mvn test' command. The build succeeds but the tests fail. The team wants to fail the build if any test fails. What should they do?

Accepted Answer

Ensure the buildspec's 'build' phase includes the test command and that the command returns a non-zero exit code on failure.. Option C is correct because CodeBuild's build phase returns exit code; if Maven test fails, it returns non-zero, and CodeBuild fails the build. Option A is wrong because phases are not modified. Option B is wrong because batch builds are for multiple builds. Option D is wrong because post_build runs after build phases.

Answer

Add a 'post_build' phase that fails the build if tests fail.

Answer

Add a 'test' phase in the buildspec before the 'build' phase.

Answer

Configure the build project to use batch builds.

Question 3

A team wants to automatically deploy a new version of a Lambda function when code is pushed to a CodeCommit repository. Which AWS service should orchestrate this workflow?

Accepted Answer

AWS CodePipeline. Option A is correct because CodePipeline can orchestrate source, build, and deploy stages. Option B is wrong because CodeDeploy alone cannot monitor CodeCommit. Option C is wrong because CloudFormation is for infrastructure, not continuous deployment. Option D is wrong because CodeBuild is for building, not deploying.

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Question 4

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must ensure that only code that passes security scanning can proceed to deployment. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Add a security scanning stage in the pipeline after the build stage and before the deploy stage.. A and D are correct. A: Adding a security scanning stage in CodePipeline ensures scanning before deployment. D: Failing the pipeline if the scanning stage fails is standard practice. B is incorrect because scanning after deployment defeats the purpose. C is incorrect because CodeDeploy does not perform scanning. E is incorrect because CloudWatch Events do not gate the pipeline.

Answer

Use Amazon CloudWatch Events to trigger a rollback if vulnerabilities are found after deployment.

Answer

Use AWS CodeDeploy to perform security scanning during deployment.

Answer

Configure the pipeline to run security scanning only in the deploy stage.

Question 5

A company uses AWS CloudFormation to deploy a multi-tier application. The stack creation fails with a 'CREATE_FAILED' error for a resource. The engineer wants to troubleshoot the issue. Which THREE steps should the engineer take? (Choose THREE.)

Accepted Answer

Use the 'describe-stack-events' AWS CLI command to view the events.. A, B, and E are correct. A: Viewing events shows failure details. B: Checking the resource's status reason provides specific error. E: CloudFormation logs are in CloudWatch Logs. C is incorrect because delete_stack would remove resources. D is incorrect because DescribeStacks is less detailed than events.

Answer

Run 'delete-stack' to remove the failed stack and start over.

Answer

Use the 'describe-stacks' AWS CLI command to get the stack outputs.

Question 6

A team uses AWS CodeBuild to build a Node.js application. The buildspec.yml file is at the root of the repository. The build fails with 'Error: Cannot find module 'aws-sdk''. Which TWO actions could resolve the issue? (Choose TWO.)

Accepted Answer

Ensure 'aws-sdk' is listed in the 'dependencies' section of package.json.. B and E are correct. B: Including 'npm install' installs dependencies from package.json. E: Adding aws-sdk to package.json ensures it is installed. A is incorrect because pre_build runs after install. C is incorrect because runtime version does not affect module availability. D is incorrect because build commands are for building, not installing dependencies.

Answer

Specify a different Node.js runtime version in the buildspec.

Answer

Add a 'pre_build' phase that runs 'npm test'.

Answer

Add a 'build' phase command to compile the code.

Question 7

Refer to the exhibit. An IAM policy is attached to a role used by a CI/CD system. The policy is intended to allow starting the pipeline 'MyPipeline' from the same account. However, the CI/CD system receives an 'AccessDenied' error when trying to start the pipeline. What is the problem?

Accepted Answer

The Deny statement with the 'aws:SourceAccount' condition denies access if the condition key is not present in the request.. Option B is correct. The Deny statement with a condition denies all codepipeline actions if the source account is not 123456789012. However, the Allow statement allows StartPipelineExecution for the specific pipeline. But the Deny statement with a condition that does not match (i.e., if the source account is exactly 123456789012, the condition is false, so the Deny does not apply). Wait, let's analyze: The Deny statement applies when the source account is NOT 123456789012. So if the source account IS 123456789012, the Deny does not apply, and the Allow should work. But the error suggests AccessDenied. The issue could be that the policy also needs to allow other actions? Actually, looking closely: The Allow only allows StartPipelineExecution, but maybe the pipeline execution requires other actions? No, StartPipelineExecution should be sufficient. Another possibility: The Deny statement with condition might be interpreted incorrectly. Actually, the Deny with StringNotEquals will deny if the source account is not equal to the specified account. So if the source account is 123456789012, the condition is false, so the Deny does not apply. So the Allow should work. But the error persists. Perhaps the issue is that the policy also needs to allow 'codepipeline:GetPipeline' or something? However, the most likely cause is that the Deny statement is too broad: it denies all codepipeline actions for any resource, but only if the source account is not the one specified. If the source account is correct, the Deny doesn't apply. So why denial? Maybe the condition key 'aws:SourceAccount' is not set for the request? If the condition key is not present, then StringNotEquals evaluates to false (since not present is not equal), so the Deny would apply. That is a common pitfall: when the condition key is absent, the condition evaluates to false, causing the Deny to apply. So Option B is correct: the condition key 'aws:SourceAccount' may not be present in the request, causing the Deny to apply. Option A is wrong because the Allow is not blocked by Deny if condition met. Option C is wrong because there is no explicit deny for GetPipeline. Option D is wrong because the policy is attached to the role, not user.

Answer

The Allow statement does not specify the correct pipeline ARN.

Answer

The policy needs an additional Allow for 'codepipeline:GetPipeline' to start the pipeline.

Answer

The role does not have permission to pass the policy to the CI/CD system.

Question 8

Refer to the exhibit. A DevOps engineer sees the following error when trying to update a CloudFormation stack: 'Stack [arn:aws:cloudformation:us-west-2:123456789012:stack/MyStack/abc123] is in ROLLBACK_COMPLETE state and can not be updated.' What should the engineer do to proceed?

Accepted Answer

Delete the stack and create a new one with the updated template.. Option D is correct. A stack in ROLLBACK_COMPLETE state cannot be updated; it must be deleted and recreated. Option A is wrong because continue-update-rollback is for stacks in UPDATE_ROLLBACK_FAILED state. Option B is wrong because there is no 'resume' operation. Option C is wrong because you cannot update a stack in ROLLBACK_COMPLETE.

Answer

Run 'aws cloudformation continue-update-rollback' to finish the rollback and then update.

Answer

Modify the stack's template and try the update again.

Answer

Use the 'aws cloudformation resume-update' command to resume the update.

Question 9

Refer to the exhibit. A team uses this buildspec.yml in AWS CodeBuild. The build fails because the 'dist' directory does not exist after the build phase. What is the most likely cause?

Accepted Answer

The build command outputs to a 'build' directory, but the artifacts base-directory is set to 'dist'.. Option B is correct. The 'python setup.py build' command typically outputs to a 'build' directory, not 'dist'. The artifacts base-directory should match the actual output directory. Option A is wrong because runtime version is correct. Option C is wrong because requirements.txt is not related to output directory. Option D is wrong because the version field is fine.

Answer

The buildspec version is incorrect.

Answer

The Python runtime version 3.8 is not available in CodeBuild.

Answer

The requirements.txt file is missing from the source code.

Question 10

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The pipeline has a source stage that pulls from a CodeCommit repository, a build stage using AWS CodeBuild, and a deploy stage that uses AWS CodeDeploy to deploy to an EC2 Auto Scaling group. The team notices that the pipeline frequently fails at the deploy stage with the error 'The deployment failed because the deployment group's deployment configuration specifies a minimum healthy host count of 1, but 0 healthy hosts are available.' What is the MOST likely cause of this issue?

Accepted Answer

The CodeDeploy agent is not installed or is not running on the EC2 instances.. Option D is correct because if the CodeDeploy agent is not installed or not running on the EC2 instances, the instances will not report as healthy, causing the deployment to fail with the given error. Option A is incorrect because CodeDeploy does not require the instances to be behind a load balancer. Option B is incorrect because CodeCommit permissions do not affect the deploy stage. Option C is incorrect because CodeBuild artifacts not being stored in S3 would cause a build failure, not a deploy failure.

Answer

The IAM role for CodePipeline does not have sufficient permissions to access the CodeCommit repository.

Answer

The build artifacts are not being stored in an S3 bucket.

Answer

The EC2 instances are not registered with a Classic Load Balancer.

Question 11

A company runs a microservices architecture on Amazon ECS with Fargate launch type. Each microservice is deployed using AWS CodePipeline with a source stage from CodeCommit, a build stage in CodeBuild, and a deploy stage that updates the ECS service. The team wants to implement a blue/green deployment strategy to reduce downtime and enable quick rollbacks. Which combination of AWS services and configurations should be used?

Accepted Answer

Use AWS CodeDeploy with a deployment group configured for blue/green deployment, and an Application Load Balancer (ALB) to shift traffic between the blue and green target groups.. Option C is correct because CodeDeploy supports blue/green deployments for ECS with Fargate, using an Application Load Balancer (ALB) to shift traffic. Option A is incorrect because ECS does not support blue/green natively without CodeDeploy. Option B is incorrect because CloudFormation does not provide blue/green traffic shifting for ECS. Option D is incorrect because ECS service auto scaling does not control deployment strategy.

Answer

Use AWS CloudFormation with a 'DeploymentPreference' set to 'BlueGreen' for the ECS service.

Answer

Use the ECS service's built-in rolling update with a 'minimumHealthyPercent' of 100 and 'maximumPercent' of 200.

Answer

Configure the ECS service with an 'AutoScaling' policy that replaces instances gradually.

Question 12

A DevOps engineer is configuring a webhook trigger in AWS CodePipeline to automatically start a pipeline when changes are pushed to a specific branch in a CodeCommit repository. The webhook is created and the trigger is set to the 'main' branch. However, when a developer pushes a commit to the 'main' branch, the pipeline does not start. What is the MOST likely reason?

Accepted Answer

The CloudWatch Events rule that triggers the pipeline on repository changes is not configured.. Option A is correct because CodePipeline webhooks use AWS CloudWatch Events (EventBridge) to detect changes; if the CloudWatch Events rule is missing, the webhook won't trigger. Option B is incorrect because multiple webhooks can exist. Option C is incorrect because webhooks do not require SNS. Option D is incorrect because S3 notifications are for S3 sources, not CodeCommit.

Answer

The webhook is not properly registered with CodeCommit due to a conflict with an existing webhook.

Answer

The CodeCommit repository is set to send events to Amazon S3, which conflicts with the webhook.

Answer

The pipeline requires an Amazon SNS notification to be configured for the trigger to work.

Question 13

A company uses AWS CodeBuild to compile and test Java code. The buildspec.yml file includes a 'pre_build' phase that runs unit tests. The build occasionally fails with the error 'No space left on device.' The build environment is a general1.medium EC2 instance with 160 GB of disk space. What is the MOST effective solution to resolve this issue?

Accepted Answer

Increase the file system size or add commands to clean up temporary files in the buildspec.. Option C is correct because increasing the file system size or cleaning up disk space addresses the 'No space left' error. Option A is incorrect because using a larger instance type may not increase disk space. Option B is incorrect because the error is disk-related, not memory. Option D is incorrect because the error is not related to dependencies not being cached.

Answer

Configure the build to use an Amazon EFS file system to offload data.

Answer

Switch the build environment to a compute type with more memory, such as general1.large.

Answer

Enable the 'cache' feature in CodeBuild to reuse dependencies and reduce disk usage.

Question 14

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline has a source stage from CodeCommit, a build stage that runs 'sam build', and a deploy stage that runs 'sam deploy --no-confirm-changeset'. The deploy stage fails with the error 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used by CodeBuild has expired credentials or insufficient permissions to call AWS CloudFormation.. Option B is correct because the '--no-confirm-changeset' flag requires the AWS CLI to make API calls, and if the credentials used by CodeBuild are expired, the error occurs. Option A is incorrect because SAM template syntax errors cause different errors. Option C is incorrect because CloudFormation stack drift does not cause token errors. Option D is incorrect because CodeBuild logs do not affect deployment.

Answer

The CloudFormation stack is in a 'ROLLBACK_COMPLETE' state and cannot be updated.

Answer

The CodeBuild project does not have access to the CodeCommit repository.

Answer

The SAM template is invalid and contains syntax errors.

Question 15

A development team uses AWS CodeStar to set up a continuous delivery pipeline for a web application. The application is deployed to an Elastic Beanstalk environment. After a successful deployment, the team wants to automatically run integration tests against the deployed application. What is the SIMPLEST way to achieve this?

Accepted Answer

Add a test stage in CodePipeline after the deploy stage that uses CodeBuild to run integration tests.. Option D is correct because adding a test stage in CodePipeline after the deploy stage is the simplest approach. Option A is incorrect because manual testing is not automatic. Option B is incorrect because CloudWatch Alarms monitor metrics, not run tests. Option C is incorrect because CodeDeploy is the deployment service, not a test runner.

Answer

Configure the Elastic Beanstalk environment to run integration tests after deployment via a custom platform hook.

Answer

Use Amazon CloudWatch alarms to trigger a Lambda function that runs the tests.

Answer

Add a post-deployment script in the CodeDeploy appspec file to run tests.