DOP-C02 SDLC Automation Practice Test 11 — 15 Questions

Question 1

A company uses AWS CodeBuild to compile a Java application. The build specification includes a pre-build phase to download dependencies. Which file defines the commands for each build phase?

Accepted Answer

buildspec.yml. In AWS CodeBuild, the build specification file named 'buildspec.yml' defines the commands that CodeBuild runs during each phase of the build process, including the pre-build phase for downloading dependencies. This YAML file is placed in the root of the source code or specified in the build project configuration, and it contains structured sections for install, pre_build, build, and post_build phases. Option B is correct because buildspec.yml is the standard file that CodeBuild uses to orchestrate build commands.

Answer

pipeline.json

Answer

config.xml

Answer

appspec.yml

Question 2

A DevOps engineer notices that a CodePipeline execution fails at the deploy stage when deploying a Lambda function using AWS CloudFormation. The error message indicates that the stack update failed because the Lambda function's code is too large. What is the most likely cause?

Accepted Answer

The Lambda function deployment package exceeds the maximum allowed size for Lambda.. The error message explicitly states that the Lambda function's code is too large, which directly points to the Lambda deployment package exceeding the maximum allowed size. AWS Lambda has a hard limit of 50 MB for zipped direct uploads (or 250 MB for container images), and CloudFormation will fail the stack update if the package exceeds this limit during a deploy stage.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to update the Lambda function.

Answer

The CloudFormation template exceeds the maximum size limit for templates.

Answer

The artifact stored in the pipeline's S3 bucket exceeds the maximum allowed size for CodePipeline artifacts.

Question 3

A DevOps team is implementing a blue/green deployment strategy for a microservice running on Amazon ECS with AWS CodeDeploy. They want to shift 10% of traffic to the new task set for 5 minutes, then shift the remaining 90%. Which deployment configuration should they use?

Accepted Answer

CodeDeployDefault.ECSCanary10Percent5Minutes. The built-in configuration `CodeDeployDefault.ECSCanary10Percent5Minutes` shifts 10% of traffic to the new task set, holds for 5 minutes, then shifts the remaining 90%. This matches the requirement exactly. A custom configuration (D) is unnecessary and not a standard deployment configuration.

Answer

CodeDeployDefault.ECSAllAtOnce

Answer

CodeDeployDefault.ECSLinear10PercentEvery1Minutes

Answer

Custom configuration with 10% initial traffic and 100% after 5-minute interval

Question 4

A company uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that creates an Amazon RDS DB instance. The database password must be stored securely and rotated automatically. Which approach meets these requirements?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation. Reference the secret in the template using a dynamic reference.. AWS Secrets Manager provides built-in capabilities for automatic password rotation, which is a requirement. By storing the password in Secrets Manager and referencing it in the CloudFormation template using a dynamic reference (e.g., `{{resolve:secretsmanager:secret-id:SecretString:password}}`), the password is never exposed in the template or parameter logs, and rotation can be configured without updating the stack. This approach meets both security and automation requirements.

Answer

Hardcode the password in the CloudFormation template and use a NoEcho parameter.

Answer

Use AWS Key Management Service (KMS) to encrypt the password and pass it as a parameter.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it using a dynamic reference.

Question 5

A company uses AWS CodePipeline with multiple stages: Source, Build, Test, Deploy. The Test stage runs integration tests using AWS CodeBuild. If the Test stage fails, what happens to the pipeline execution?

Accepted Answer

The pipeline execution stops and the status is set to 'Failed'.. In AWS CodePipeline, by default, if a stage (such as Test) fails, the pipeline execution immediately stops and the overall pipeline status is set to 'Failed'. This is because CodePipeline treats each stage as a sequential gate; a failure in any stage blocks progression to subsequent stages unless explicitly configured otherwise (e.g., with a 'Blocker' or 'Manual Approval' action). Option B correctly describes this default behavior.

Answer

The pipeline continues to the next stage but marks the Test stage as failed.

Answer

The pipeline skips the Test stage and proceeds to Deploy.

Answer

The pipeline automatically retries the Test stage up to three times.

Question 6

A DevOps engineer wants to use AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment must ensure that only a certain percentage of instances are taken out of service at a time. Which deployment configuration supports this requirement?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime is the correct deployment configuration because it ensures that only one instance in the Auto Scaling group is taken out of service at a time, which directly satisfies the requirement of limiting the percentage of instances removed during deployment. This configuration is designed for EC2/On-Premises deployments and uses a fixed number of instances (one) rather than a percentage, making it ideal for gradual, safe rollouts.

Answer

CodeDeployDefault.LambdaCanary10Percent5Minutes

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.LambdaLinear10PercentEvery1Minute

Question 7

A company uses AWS CodeStar to manage software development projects. The team wants to integrate a third-party issue tracking system with CodeStar. Which AWS service should they use to achieve this integration?

Accepted Answer

AWS CodePipeline webhooks. AWS CodePipeline webhooks allow you to connect external systems, such as a third-party issue tracking system, to your CodePipeline pipeline. When the external system triggers an event (e.g., an issue status change), the webhook sends an HTTP POST request to a configured endpoint in CodePipeline, which then starts the pipeline. This is the native integration mechanism for CodeStar to receive events from outside AWS.

Answer

Amazon API Gateway

Answer

Amazon CloudWatch Events

Answer

Amazon Simple Notification Service (SNS)

Question 8

A company is designing a CI/CD pipeline for a serverless application using AWS CodePipeline. Which TWO actions are valid ways to deploy an AWS Lambda function?

Accepted Answer

Use AWS CloudFormation to update the Lambda function's stack.. AWS CloudFormation can manage Lambda function deployments as part of a stack update. By defining the Lambda function resource in a CloudFormation template, CodePipeline can trigger a stack update that creates or updates the function, ensuring infrastructure-as-code best practices and consistent deployments.

Answer

Use Amazon S3 to trigger the Lambda function deployment.

Answer

Use AWS CodeBuild to directly deploy the Lambda function.

Answer

Use AWS CodeCommit to push the Lambda code.

Question 9

A company uses AWS CodeBuild to build and test a Node.js application. The buildspec.yml currently runs npm install and npm test. They want to also run a security scan using a third-party tool. Which THREE steps are required to integrate the security scan into the CodeBuild build?

Accepted Answer

Ensure the build fails if the scanner finds vulnerabilities by checking the exit code.. CodeBuild phases (install, pre_build, build, post_build) run shell commands sequentially, and a non-zero exit code from any command causes the build to fail. By checking the exit code of the security scanner (e.g., via `$?` or relying on the tool's default exit behavior), the build will stop and report failure if vulnerabilities are found, enforcing a security gate. This is the standard mechanism to integrate third-party tools without custom scripting.

Answer

Create a new 'security' phase in the buildspec.yml.

Answer

Upload the security scanner configuration to an S3 bucket and reference it in the buildspec.

Question 10

A DevOps engineer runs the above AWS CLI commands and notices that the CodeBuild project 'my-project' exists but builds fail with the error 'Access Denied' when trying to fetch source code from CodeCommit. The IAM role 'CodeBuildServiceRole' has a policy that allows 'codecommit:GitPull' on all repositories. What is the most likely cause of the failure?

Accepted Answer

The IAM role does not have a trust policy that allows CodeBuild to assume the role.. The error 'Access Denied' when CodeBuild tries to fetch source code from CodeCommit typically indicates that the IAM role CodeBuild is using does not have the necessary permissions to perform the action. Even though the role 'CodeBuildServiceRole' has a policy allowing 'codecommit:GitPull', the role itself must have a trust policy that allows the CodeBuild service to assume it. Without a proper trust policy, CodeBuild cannot assume the role, and any attached permissions are irrelevant, leading to an access denied error.

Answer

The IAM role does not have permissions to access the CodeCommit repository.

Answer

The CodeCommit repository does not exist.

Answer

The source location in the build project is incorrect.

Question 11

A DevOps engineer creates a CloudFormation stack with the above template. After creation, they want to update the Lambda function code by uploading a new zip file to the S3 bucket and updating the S3Key property. However, the stack update fails because the Lambda function is published as a version and the alias points to that version. What is the most likely reason for the update failure?

Accepted Answer

The AWS::Lambda::Version resource is immutable and cannot be updated.. The AWS::Lambda::Version resource is immutable by design; once created, it cannot be updated or replaced. When a CloudFormation stack includes a Lambda version and an alias pointing to that version, any attempt to update the function code (e.g., by changing the S3Key property) triggers an update to the AWS::Lambda::Version resource, which CloudFormation cannot perform because versions are immutable. This causes the stack update to fail.

Answer

The alias must be deleted before updating the function code.

Answer

The IAM role does not have permission to update the function.

Answer

The function code cannot be updated because the S3 bucket is in a different region.

Question 12

A DevOps team uses AWS CodeBuild to compile code and run unit tests. The team notices that builds are failing with a timeout error after 60 minutes. What is the most likely cause and solution?

Accepted Answer

The build timeout limit is exceeded; increase the timeout in CodeBuild project settings.. The default build timeout for AWS CodeBuild is 60 minutes. When a build runs longer than this limit, it fails with a timeout error. The correct solution is to increase the timeout value in the CodeBuild project settings, which can be set up to a maximum of 8 hours (480 minutes) for on-demand compute environments.

Answer

The buildspec has syntax errors; validate the YAML.

Answer

The build environment is too small; increase compute type.

Answer

The source code repository is too large; use shallow clone.

Question 13

A development team uses AWS CodePipeline to orchestrate builds and deployments. They want to automatically deploy to a staging environment only if a manual approval step is granted. Which configuration should they use?

Accepted Answer

Add an approval action in the pipeline stage before the deploy action.. AWS CodePipeline supports a manual approval action that pauses the pipeline at a specified stage until an authorized user approves or rejects the deployment. By placing the approval action in the stage before the deploy action, the pipeline will only proceed to the staging deployment after the manual approval is granted, satisfying the requirement exactly.

Answer

Use a Lambda function to check a parameter in Parameter Store.

Answer

Configure a CloudWatch Events rule to trigger deployment after a manual event.

Answer

Set the deploy action to manual invocation only.

Question 14

A company uses AWS CodeCommit for source control. Developers frequently push large binary files (e.g., compiled binaries, datasets) to the repository, causing repository size to grow and clone operations to become slow. What is the BEST approach to manage this?

Accepted Answer

Enable Git LFS in CodeCommit and configure the large files to use LFS.. AWS CodeCommit supports Git Large File Storage (LFS), which replaces large files in the repository with text pointers while storing the actual binary content in a separate hosted storage backend. This keeps the repository lightweight, speeds up clone and fetch operations, and avoids hitting the default repository size limits. Enabling Git LFS is the recommended and best practice for managing large binary files in CodeCommit.

Answer

Use S3 as the source in CodePipeline and skip CodeCommit for binaries.

Answer

Store binaries in a separate CodeCommit repository.

Answer

Increase the repository size limit by requesting a quota increase.

Question 15

A team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment.' The instances are healthy and can connect to the CodeDeploy service. What is the most likely cause?

Accepted Answer

The appspec.yml file or lifecycle event scripts have errors.. The error 'too many individual instances failed deployment' indicates that the deployment failed on the instances themselves, not at the infrastructure level. Since the instances are healthy and can connect to CodeDeploy, the most likely cause is that the appspec.yml file or the lifecycle event scripts (e.g., hooks like BeforeInstall, AfterInstall) contain errors that cause the deployment to fail on each instance. This is a common issue when scripts have syntax errors, missing dependencies, or incorrect paths.

Answer

The Auto Scaling group launch configuration is incorrect.

Answer

The deployment group is not configured with the correct service role.

Answer

The target revision is not accessible from the instances.