DOP-C02 SDLC Automation Practice Test 12 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline includes a source stage (S3), a build stage (CodeBuild) that minifies assets, and a deploy stage that copies files to the production S3 bucket. The deploy stage uses 's3 sync' command. After a recent deployment, some users report seeing old content. What is the MOST likely cause?

Accepted Answer

The website is served through Amazon CloudFront, and the CloudFront distribution cache was not invalidated after the deployment.. Option C is correct because S3 does not automatically invalidate CloudFront cache; old cached files are served. Option A is incorrect because 's3 sync' does sync new files. Option B is incorrect because bucket policies don't affect content freshness. Option D is incorrect because CodeBuild would fail if permissions were insufficient.

Answer

The S3 bucket policy blocks public read access, so users get a 403 error.

Answer

The IAM role for CodeBuild does not have permissions to write to the S3 bucket.

Answer

The deploy stage uses 's3 cp' instead of 's3 sync', so new files are not uploaded.

Question 2

A team uses AWS CodePipeline to deploy a containerized application to Amazon ECS. The pipeline uses a source stage from CodeCommit, a build stage that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that updates an ECS service. The team wants to add a manual approval step before the deploy stage to allow QA to verify the image. What is the BEST way to implement this?

Accepted Answer

Add a manual approval stage in CodePipeline between the build and deploy stages, and configure SNS to notify approvers.. Option A is correct because CodePipeline has a built-in approval action that can be added as a stage. Option B is incorrect because SNS does not provide an approval mechanism. Option C is incorrect because Lambda cannot pause the pipeline. Option D is incorrect because CloudWatch Events cannot approve.

Answer

Configure an AWS Lambda function in the pipeline that checks a DynamoDB table for approval status and pauses until approved.

Answer

Use an Amazon SNS topic to send a notification to QA, and have them manually trigger the deploy stage by clicking a link in the email.

Answer

Use Amazon CloudWatch Events to trigger a custom action that waits for an approval signal.

Question 3

A company uses AWS CodeCommit for source control. Developers work on feature branches and create pull requests to merge into the 'develop' branch. The company wants to enforce that all commits to the 'develop' branch are signed. Which AWS service or feature should be used to enforce this policy?

Accepted Answer

Create an approval rule template in CodeCommit that requires commits to be signed and associate it with the 'develop' branch.. Option C is correct because CodeCommit supports approval rule templates that can require signed commits. Option A is incorrect because IAM policies can restrict who can push but not enforce signing. Option B is incorrect because CloudWatch Events can trigger actions but not enforce signing. Option D is incorrect because AWS KMS is used for encryption keys, not for enforcing commit signing.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that verifies commit signatures and reverts unsigned commits.

Answer

Use AWS Key Management Service (KMS) to create a signing key and require developers to use it.

Answer

Configure an IAM policy that denies 'git push' unless the commit is signed.

Question 4

A company is using AWS CodeBuild to run builds for a Java application. The build takes a long time because it downloads Maven dependencies every time. The team wants to speed up the build by caching dependencies. Which TWO actions should be taken? (Choose 2)

Accepted Answer

Enable Amazon S3 caching in the CodeBuild project and specify an S3 bucket to store the cache.. Options B and D are correct. Enabling caching in CodeBuild and specifying a cache bucket stores dependencies. Option A is incorrect because caching is not automatic. Option C is incorrect because EFS is not required. Option E is incorrect because local caching is not a feature.

Answer

Use CodeBuild's 'build cache' feature without specifying a bucket; it will automatically cache to a default location.

Answer

Set the cache type to 'Local' in the CodeBuild project configuration.

Answer

Mount an Amazon EFS file system to the build container and configure Maven to use it as a local repository.

Question 5

A company uses AWS CodePipeline with multiple stages: Source (CodeCommit), Build (CodeBuild), Test (CodeBuild), and Deploy (CodeDeploy to EC2). The Test stage runs integration tests that require network access to a private database in a VPC. The CodeBuild project is configured to use a VPC. However, the Test stage fails intermittently with timeout errors. Which TWO actions would MOST likely resolve the issue? (Choose 2)

Accepted Answer

Increase the timeout for the Test stage in the CodeBuild project to accommodate network delays.. Options A and D are correct. Using a NAT gateway ensures outbound internet access if needed, and increasing the timeout prevents premature timeouts. Option B is incorrect because security groups should be permissive within the VPC. Option C is incorrect because Subnet IDs are required for VPC configuration. Option E is incorrect because compute type does not affect network.

Answer

Remove the VPC configuration from the CodeBuild project and use a public subnet instead.

Answer

Use a larger compute type for the CodeBuild project to improve network performance.

Answer

Configure the security group for the CodeBuild project to allow outbound traffic to the database security group on the required port.

Question 6

A DevOps engineer is setting up a CI/CD pipeline for a Python application using AWS CodePipeline. The pipeline includes a build stage with CodeBuild and a deploy stage that runs an AWS CLI command to update a Lambda function. Which THREE steps are necessary to ensure the pipeline can update the Lambda function? (Choose 3)

Accepted Answer

Store the AWS CLI command in the buildspec file or as a separate script in the source repository.. Options A, B, and D are correct. The CodeBuild project needs a role that allows Lambda updates, and the pipeline role needs to pass the CodeBuild role. Option C is incorrect because CloudWatch is not required. Option E is incorrect because the CLI command is already in the deploy stage.

Answer

Configure a CloudWatch Events rule to trigger the pipeline when the Lambda function is updated.

Answer

Use AWS CodeDeploy instead of the AWS CLI to update the Lambda function.

Question 7

Your company uses AWS CodePipeline to automate the deployment of a critical web application. The pipeline consists of a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy) that deploys to an Auto Scaling group of EC2 instances running Amazon Linux 2. The deployment strategy is 'AllAtOnce'. Recently, the team noticed that during deployments, the application becomes completely unavailable for a few minutes until the new instances are registered with the load balancer. The business requires zero downtime during deployments. You need to modify the deployment process to achieve zero downtime while minimizing cost and complexity. The Auto Scaling group currently has a minimum of 2 instances and a maximum of 4 instances. The application is stateless and sessions are stored in ElastiCache. Which solution should you implement?

Accepted Answer

Use CodeDeploy's blue/green deployment with an Application Load Balancer. Create a new Auto Scaling group for the green environment, deploy to it, and then shift traffic.. Option C is correct because CodeDeploy's 'Blue/Green' deployment creates new instances, shifts traffic, and allows rollback, achieving zero downtime. Option A is incorrect because 'HalfAtATime' still causes temporary capacity reduction. Option B is incorrect because increasing minimum size does not change deployment strategy. Option D is incorrect because creating a new ASG and using DNS can work but is more complex and costly than CodeDeploy's built-in blue/green.

Answer

Create a second Auto Scaling group, deploy to it, and then update Route 53 to point to the new group.

Answer

Change the deployment configuration to 'HalfAtATime' to update half the instances at a time.

Answer

Increase the Auto Scaling group's minimum size to 4 so there are always extra instances.

Question 8

You are a DevOps engineer for a company that uses AWS CodePipeline to deploy a microservice to Amazon ECS with Fargate. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild) that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that uses an ECS task definition update. Recently, the deploy stage started failing intermittently with the error 'The task definition does not have a compatibilities attribute set correctly.' The task definition is generated dynamically during the build stage and uses the 'FARGATE' launch type. The error occurs only when a new task definition revision is created. You suspect the issue is related to how the task definition is generated. Upon reviewing the buildspec, you see that the task definition JSON is created using environment variables for the image URI. What is the MOST likely cause and solution?

Accepted Answer

The task definition JSON does not include the 'requiresCompatibilities' field with the value '["FARGATE"]'.. Option B is correct because the 'requiresCompatibilities' attribute must be explicitly set to 'FARGATE' for Fargate tasks. Option A is incorrect because the error is about compatibilities, not execution role. Option C is incorrect because network mode should be 'awsvpc', but that is not the error. Option D is incorrect because CPU and memory values are required but would cause a different error.

Answer

The task definition is missing the 'executionRoleArn' field, which is required for Fargate.

Answer

The task definition specifies 'networkMode' as 'bridge', but Fargate requires 'awsvpc'.

Answer

The task definition does not specify 'cpu' and 'memory' values, which are required for Fargate.

Question 9

A development team is using AWS CodeCommit as the source for a CI/CD pipeline. They want to automatically trigger a build in AWS CodeBuild whenever a developer pushes changes to any branch in the repository. Which pipeline configuration should be used?

Accepted Answer

Configure a CodeCommit repository trigger to invoke a Lambda function that starts a CodeBuild build. Option B is correct because using a webhook that triggers on all branch pushes is the simplest and most direct way to achieve automatic builds on every push. Option A is wrong because polling is less efficient and introduces latency. Option C is wrong because event rules require event bus setup and are more complex. Option D is wrong because scheduled builds do not respond to pushes.

Answer

Configure CodePipeline to poll the CodeCommit repository every minute

Answer

Use Amazon EventBridge to capture CodeCommit events and start a CodePipeline execution

Answer

Set up a scheduled CodePipeline execution using Amazon CloudWatch Events

Question 10

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). Recently, deployments have been failing intermittently during the deploy stage with the error: 'The service has reached its maximum number of running tasks.' How should a DevOps engineer resolve this issue?

Accepted Answer

Update the ECS service configuration to increase the maximum number of tasks. Option B is correct because the error indicates that the ECS service's desired count or maximum tasks limit has been reached. Updating the service to increase the maximum number of tasks resolves the issue. Option A is wrong because CodeDeploy does not have a deployment limit that causes this error. Option C is wrong because scaling policies are for auto scaling, not for the error about maximum tasks. Option D is wrong because the issue is not related to insufficient memory but to task count limits.

Answer

Increase the memory reservation for the task definition

Answer

Configure an Amazon ECS Service Auto Scaling policy to scale out

Answer

Increase the number of concurrent deployments allowed in CodeDeploy

Question 11

A DevOps engineer is designing a CI/CD pipeline that must enforce a policy: any change to the production branch in CodeCommit must be reviewed and approved by two senior developers before the change can be merged. The pipeline must also automatically build and deploy to a staging environment after approval. Which combination of AWS services and configurations should be used?

Accepted Answer

Use CodeCommit pull request approval rules and a CodePipeline with a manual approval step triggered by a Lambda function that checks approval status. Option C is correct because AWS CodeCommit does not have native approval workflows; however, CodePipeline can use approval actions and CodeCommit can be configured with pull request notifications to trigger pipelines. A Lambda function can be used to automatically approve the pipeline after the required number of approvals in a pull request. Option A is wrong because IAM does not enforce manual approvals. Option B is wrong because CodeBuild does not have approval capabilities. Option D is wrong because CloudWatch Events cannot enforce two-approver rule directly.

Answer

Configure CodeBuild to run a script that checks the commit author and rejects if not approved

Answer

Use Amazon EventBridge to trigger a Lambda function that validates the number of approvers before merging

Answer

Use IAM policies to restrict write access to the production branch to only senior developers

Question 12

A DevOps team uses AWS CodeBuild to compile a Java application. The build environment is managed by AWS and runs on Linux. The team wants to speed up the build process by caching dependency directories across builds. Which configuration should the team use?

Accepted Answer

Enable local caching in the CodeBuild project and specify the cache location as /root/.m2. Option B is correct because CodeBuild supports local caching, which can be configured to cache specific directories like the Maven local repository. Option A is wrong because S3 caching is not a built-in CodeBuild feature. Option C is wrong because it is not specific to dependency caching. Option D is wrong because Docker layer caching is for Docker builds, not Java dependencies.

Answer

Configure the buildspec file to use Docker layer caching

Answer

Use the CodeBuild cache configuration to store the entire build output in a custom Docker image

Answer

Store dependencies in an Amazon S3 bucket and download them at the start of each build

Question 13

A development team is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a Source stage connected to an Amazon S3 bucket, a Build stage using AWS CodeBuild, and a Deploy stage that deploys to an Amazon ECS cluster. The team notices that the pipeline fails intermittently during the Build stage with a 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE' error. What is the most likely cause?

Accepted Answer

The CodeBuild project is configured to run in a VPC without a NAT gateway, and the build image is pulled from a public registry.. Option C is correct because CodeBuild builds run in a VPC that must have a route to pull Docker images from public registries; if the VPC does not have a NAT gateway or internet gateway, the build container cannot pull the base image. Option A is wrong because CodePipeline does not require CodeBuild to be in the same region. Option B is wrong because the error is about pulling the image, not insufficient resources. Option D is wrong because S3 policy does not affect image pulling.

Answer

The CodeBuild project is in a different AWS Region than the CodePipeline pipeline.

Answer

The S3 bucket where the source code is stored has a bucket policy denying access to the CodeBuild service role.

Answer

The CodeBuild project does not have enough memory or vCPU allocated.

Question 14

A company is implementing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application using the AWS Serverless Application Model (SAM). The pipeline must build and package the application, then deploy it to multiple environments (dev, test, prod) sequentially with manual approval gates before production. Which stage configuration should be used?

Accepted Answer

Use a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, then separate deploy stages for each environment with manual approval actions. Option D is correct because SAM deploy commands can be run in CodeBuild, and multiple deploy stages can be created in CodePipeline with approval actions. Option A is wrong because CloudFormation alone does not handle packaging. Option B is wrong because CodeDeploy is for EC2/ECS, not Lambda. Option C is wrong because CodePipeline cannot directly deploy SAM templates without a build action to package.

Answer

Use a single CloudFormation stack with a change set approval step

Answer

Configure CodePipeline with a deploy action provider set to AWS CloudFormation

Answer

Use CodeDeploy to deploy the SAM template directly to Lambda

Question 15

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment strategy is Blue/Green. After a successful deployment, the team notices that the new instances are receiving traffic but the application returns errors. The old instances are still serving traffic correctly. The team wants to roll back immediately. What should be done?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails, then manually trigger a rollback.. Option B is correct because in a Blue/Green deployment, CodeDeploy can automatically roll back by re-routing traffic to the original (blue) environment if a deployment fails. Option A is wrong because redeploying the same revision would redeploy the faulty code. Option C is wrong because stopping the deployment terminates the process but does not restore traffic to the old instances. Option D is wrong because while you could manually reassociate instances, CodeDeploy provides a built-in rollback mechanism.

Answer

Stop the current deployment using the AWS CLI.

Answer

Manually update the Auto Scaling group to associate new instances with the old launch configuration.

Answer

Redeploy the same application revision to the same Auto Scaling group.