DOP-C02 SDLC Automation Practice Test 12 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. They want to update a stack but need to ensure that critical database resources are not accidentally replaced during the update. What is the BEST way to protect these resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define a stack policy that denies updates to the database resources.. A stack policy explicitly defines which resources can be updated or replaced during a stack update. By applying a stack policy that denies update actions on the critical database resources, you prevent accidental replacement or modification without having to remove the resources from the stack. This is the most direct and robust method to protect specific resources during a CloudFormation update operation.

Answer

Use a CreationPolicy on the database resources.

Answer

Use a DeletionPolicy of Retain on the database resources.

Answer

Set an UpdatePolicy with AutoScalingReplacingUpdate.

Question 2

An organization uses AWS CodePipeline with multiple stages: Source, Build, Deploy to Test, Deploy to Prod. They want to implement a canary deployment strategy for the production deployment. Which approach should they use?

Accepted Answer

Use CodeDeploy with a canary deployment configuration in the Deploy to Prod stage.. AWS CodePipeline integrates natively with CodeDeploy, which supports canary deployments by shifting a percentage of traffic to the new revision over a specified time interval (e.g., 10% every 5 minutes). Using CodeDeploy with a canary configuration in the Deploy to Prod stage directly implements the desired canary strategy within the pipeline, leveraging CodeDeploy's built-in traffic shifting and health monitoring.

Answer

Use a Lambda function in CodePipeline to manually adjust weights in Route53.

Answer

Use an Elastic Load Balancer to gradually shift traffic using weighted target groups.

Answer

Use CloudFormation with a canary update policy in the Deploy to Prod stage.

Question 3

A DevOps engineer is troubleshooting a failed build in AWS CodeBuild. The build log shows: 'Error: Cannot find module 'lodash'.' The buildspec.yml file lists 'npm install' as a command. What is the most likely cause?

Accepted Answer

The package.json file is missing or does not include lodash.. The error 'Cannot find module 'lodash'' indicates that the lodash package is not installed. Since the buildspec includes 'npm install', the most likely cause is that the package.json file is missing or does not list lodash as a dependency. Without package.json or with incorrect dependencies, npm install will not install lodash, leading to the error.

Answer

The npm install command is running before the source is downloaded.

Answer

The lodash package is not compatible with the Node.js version.

Answer

The build environment does not have internet access to download packages.

Question 4

A company uses AWS Elastic Beanstalk for deploying web applications. They want to automate deployments whenever a new commit is pushed to the master branch of their CodeCommit repository. Which AWS service should they use to trigger the deployment?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed continuous delivery service that can be configured to automatically trigger a deployment pipeline when a new commit is pushed to a CodeCommit repository's master branch. It integrates directly with CodeCommit as a source action and Elastic Beanstalk as a deployment provider, enabling end-to-end automation without custom scripting.

Answer

AWS CloudTrail

Answer

AWS OpsWorks

Answer

Amazon CloudWatch Events

Question 5

Which TWO AWS services can be used as sources in an AWS CodePipeline? (Choose two.)

Accepted Answer

AWS CodeCommit. AWS CodePipeline supports AWS CodeCommit and Amazon S3 as source stages. CodeCommit is a fully managed source control service that integrates natively with CodePipeline, allowing automatic pipeline execution on code changes. Amazon S3 can serve as a source when you upload a source bundle (e.g., a ZIP file) to an S3 bucket, and CodePipeline can poll the bucket for changes or use S3 event notifications to trigger the pipeline.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Question 6

Which THREE actions can be performed using the AWS CLI for CodeDeploy? (Choose three.)

Accepted Answer

create-deployment. The `create-deployment` command is correct because it is the primary AWS CLI operation used to start a new deployment in CodeDeploy. It triggers the deployment of a revision (application code and configuration) to a specified deployment group, making it a core action for automating SDLC pipelines.

Answer

push-revision

Answer

register-instance

Question 7

Which TWO are valid deployment configurations in AWS CodeDeploy? (Choose two.)

Accepted Answer

AllAtOnce. In AWS CodeDeploy, the valid deployment configurations are predefined traffic-shifting strategies. 'AllAtOnce' is a valid configuration that deploys the new application revision to all instances simultaneously, making it one of the two correct options. 'Canary10Percent5Minutes' is also a valid configuration that shifts 10% of traffic to the new version for 5 minutes before deploying the remainder, making it the second correct option.

Answer

Rolling

Answer

Linear

Answer

BlueGreen

Question 8

Refer to the exhibit. A CodeBuild project uses this buildspec. The build fails with the error: 'The runtime version specified is not supported in this environment.' What change should be made?

Accepted Answer

Update the runtime-versions to nodejs: 14.. The CodeBuild managed image for the specified environment (likely Ubuntu Standard 5.0 or similar) only supports Node.js runtime versions 14 and above. The error indicates that Node.js 12 is not available in the runtime-versions section of the buildspec for that environment. Updating to nodejs: 14 aligns with the supported runtime versions in the managed image, resolving the error without requiring custom images or manual installation.

Answer

Add an install command to install Node.js 12 from source.

Answer

Remove the runtime-versions section and install Node.js manually.

Answer

Change the build environment to use a custom image that includes Node.js 12.

Question 9

A company uses AWS CodePipeline with a multi-branch strategy. Developers push to feature branches, which should trigger a pipeline that runs unit tests and then deploys to a staging environment. However, the pipeline only triggers on the main branch. What should be done to enable pipeline execution for feature branches?

Accepted Answer

Update the source stage to use 'Webhook' as the change detection method and specify a branch pattern.. AWS CodePipeline can use a webhook (e.g., from GitHub or CodeCommit) to detect changes on any branch. By configuring the source stage with 'Webhook' as the change detection method and specifying a branch pattern (e.g., 'feature/*'), the pipeline will automatically trigger on pushes to matching feature branches, not just the main branch.

Answer

Change the source provider from Amazon S3 to AWS CodeCommit.

Answer

Increase the polling frequency in the source stage to detect new branches.

Answer

Create a separate pipeline for each feature branch.

Question 10

A DevOps team is designing a CI/CD pipeline for a microservices application. Each service is stored in a separate repository. The team wants to build and test only the services that changed in a given commit. Which AWS solution is MOST efficient and cost-effective?

Accepted Answer

Use AWS CodeBuild with a webhook that triggers builds only for repositories where files changed, using buildspec filters.. AWS CodeBuild webhooks can be configured with buildspec filter patterns (e.g., using `git diff` or path-based globs) to trigger builds only for repositories where files changed. This avoids unnecessary builds for unchanged services, making it both efficient and cost-effective by minimizing compute time and resource usage.

Answer

Use AWS CodeCommit triggers with Amazon SNS to send notifications and then manually trigger builds.

Answer

Use AWS CodePipeline with a single pipeline that builds all services on every commit.

Answer

Use Amazon EventBridge to detect repository changes and trigger AWS Lambda functions that determine which services changed.

Question 11

A developer wants to automate the creation of a new Amazon ECS service whenever a new Docker image is pushed to Amazon ECR. Which AWS service should be used to orchestrate this workflow?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture ECR image push events (via the 'ECR Image Action' event type) and route them to a target such as an ECS service or a Lambda function that triggers an ECS service update or creation. This serverless event bus natively integrates with ECR and ECS, making it the simplest and most direct service to orchestrate the workflow without custom polling or additional orchestration logic.

Answer

AWS Step Functions

Answer

Amazon CloudWatch Logs

Answer

Amazon S3

Question 12

A developer wants to automatically deploy a new version of an AWS Lambda function whenever code is pushed to a specific branch in AWS CodeCommit. Which combination of services should be used?

Accepted Answer

AWS CodeCommit, Amazon EventBridge, AWS CodePipeline. AWS CodePipeline can be configured with a source stage that uses AWS CodeCommit as the source provider, and an Amazon EventBridge rule can detect push events to a specific branch in CodeCommit. When a push occurs, EventBridge triggers the pipeline execution, which then deploys the new Lambda function version automatically. This combination provides a fully managed, event-driven CI/CD pipeline for Lambda deployments.

Answer

AWS CodeCommit, Amazon S3, AWS Lambda

Answer

AWS CodeCommit, AWS CodeBuild

Answer

AWS CodeCommit, Amazon CloudWatch Logs

Question 13

A company uses AWS CodeDeploy with a blue/green deployment strategy for an Amazon EC2 Auto Scaling group. During deployment, the new instances are failing health checks and the deployment is rolling back. What is the MOST likely cause?

Accepted Answer

The new instances are not passing the configured health check grace period.. In a blue/green deployment with CodeDeploy, new instances are launched and must pass health checks before traffic is routed to them. If the health check grace period is not configured or is too short, the new instances may be deemed unhealthy before the application has fully started, triggering a rollback. This is the most likely cause because the health check grace period directly controls how long CodeDeploy waits before evaluating instance health.

Answer

The application is not registered with an Elastic Load Balancer.

Answer

The deployment group is not configured to use an Auto Scaling group.

Answer

The CodeDeploy agent is not installed on the new instances.

Question 14

A team uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The deployment fails with an error: 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used in the deploy stage does not have permission to assume the CloudFormation execution role.. The error 'The security token included in the request is invalid' typically occurs when the IAM role used by CodePipeline in the deploy stage lacks the necessary trust relationship or permissions to assume the CloudFormation execution role. In AWS SAM deployments via CodePipeline, the deploy action uses a specified IAM role to call CloudFormation, and if that role cannot assume the CloudFormation service role (or the CloudFormation role itself is misconfigured), the security token becomes invalid. This is a common misconfiguration when the pipeline's IAM role does not include the 'sts:AssumeRole' permission for the CloudFormation execution role ARN.

Answer

The build stage did not produce the correct output artifact.

Answer

The SAM template has a syntax error.

Answer

The 'sam deploy' command is missing the '--capabilities' parameter.

Question 15

A DevOps engineer is troubleshooting a failed CodePipeline execution. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy. The build stage succeeds, but the deploy stage fails with 'No deployments found for the specified deployment group.' Which TWO actions should the engineer take to resolve this?

Accepted Answer

Confirm that the CodeDeploy deployment group exists in the same AWS Region as the pipeline.. CodePipeline and CodeDeploy must operate in the same AWS Region. If the deployment group is in a different Region, CodePipeline cannot find it, resulting in the 'No deployments found' error. This is a common cross-Region misconfiguration that prevents the deploy stage from locating the specified deployment group.

Answer

Update the IAM role for CodePipeline to allow it to list deployment groups.

Answer

Check the CodeBuild build logs for errors.

Answer

Ensure the CodeCommit repository has a valid commit.