DOP-C02 SDLC Automation Practice Test 12 — 15 Questions

Question 1

A development team is using AWS CodeCommit as a source repository and AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a build stage that runs on AWS CodeBuild. The team wants to automatically trigger the pipeline when changes are pushed to the 'develop' branch of the CodeCommit repository. Which configuration change should be made to the pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the source action to use CodeCommit as the source provider and specify the 'develop' branch.. CodePipeline's source action can be configured to use CodeCommit as the source provider, and by specifying the 'develop' branch in the source action configuration, the pipeline will automatically start a new execution whenever a change is pushed to that branch. This is the native and recommended way to trigger a pipeline from a CodeCommit repository branch change, without needing additional webhooks or event notifications.

Answer

Enable S3 event notifications on the repository to invoke the pipeline.

Answer

Add a manual approval action before the build stage.

Answer

Create a CodeBuild webhook on the CodeCommit repository.

Question 2

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline deploys a static website to an S3 bucket. The deployment must ensure that the website is always available and that rollbacks happen automatically if the deployment fails. Which TWO actions should the company take?

Accepted Answer

Use a blue/green deployment strategy with two S3 buckets. A blue/green deployment strategy with two S3 buckets allows the company to maintain the current (blue) bucket serving the live website while deploying the new version to a separate (green) bucket. This ensures zero-downtime deployments and, if the deployment fails, traffic can simply remain pointed to the blue bucket, providing an automatic rollback without any manual intervention. Option D is correct because AWS CloudFormation can be configured with automatic rollback on failure, which will revert the stack to its last known good state if the deployment fails, ensuring the website remains available.

Answer

Use Amazon Route53 weighted routing to shift traffic

Answer

Use AWS CodeDeploy with an in-place deployment

Answer

Enable S3 bucket versioning to keep multiple versions

Question 3

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The deployment consistently fails because the Lambda function's IAM role is not created before the function. The team uses a single CloudFormation template. Which action should be taken to resolve this dependency issue?

Accepted Answer

Add a DependsOn attribute in the CloudFormation template to ensure the IAM role is created before the Lambda function.. The CloudFormation template lacks an explicit dependency between the IAM role resource and the Lambda function resource. By adding a `DependsOn` attribute to the Lambda function resource, you ensure CloudFormation creates the IAM role first, resolving the deployment failure. This is the standard way to handle resource creation order within a single CloudFormation template.

Answer

Create the IAM role in a separate CodeBuild action before the deploy stage.

Answer

Add a wait condition in the CloudFormation template.

Answer

Separate the IAM role into a nested stack and reference it.

Question 4

An IAM policy is attached to a service role used by AWS CodePipeline. Which TWO statements about this policy are correct?

Accepted Answer

The policy allows starting a pipeline execution. The IAM policy attached to a CodePipeline service role must include permissions to allow the pipeline to start executions. The `codepipeline:StartPipelineExecution` action is required for the pipeline to be triggered by events or manual starts. Without this permission, the pipeline cannot initiate its execution flow.

Answer

The policy allows updating the pipeline definition

Answer

The policy allows starting any CodeBuild project

Answer

The policy allows reading and writing objects to any S3 bucket

Question 5

A DevOps engineer is setting up a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build environment requires specific software packages that are not available in the default CodeBuild environment. What is the MOST efficient way to customize the build environment?

Accepted Answer

Create a custom Docker image with the required software and push it to Amazon ECR.. Creating a custom Docker image with the required software and pushing it to Amazon ECR allows you to pre-configure the build environment with all necessary packages. This approach avoids the overhead of installing packages during each build, reduces build time, and ensures consistency across builds. AWS CodeBuild supports custom images from Amazon ECR, making this the most efficient method for customizing the environment.

Answer

Create a separate pipeline to pre-build the environment.

Answer

Add install commands in the buildspec file to install the packages during each build.

Answer

Modify the buildspec file to set environment variables that include the software packages.

Question 6

A DevOps team is implementing a CI/CD pipeline for a microservices architecture. Each microservice is built and deployed independently. The team wants to ensure that only one build runs per microservice at a time to avoid resource contention, and that the build artifacts are stored securely. Which THREE steps should the team take?

Accepted Answer

Enable versioning on the S3 bucket storing build artifacts. Enabling versioning on the S3 bucket that stores build artifacts allows you to preserve, retrieve, and restore every version of every artifact. This is critical for auditability, rollback, and traceability in a CI/CD pipeline. Without versioning, if an artifact is overwritten or deleted, the previous version is permanently lost, which violates the requirement for secure and reliable artifact storage.

Answer

Store build artifacts in AWS CodeArtifact

Answer

Create a separate CodePipeline for each microservice

Question 7

A team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is configured with a deployment configuration that uses the 'CodeDeployDefault.OneAtATime' traffic routing. However, during deployment, the new instances are failing health checks and the deployment is rolling back. The team wants to minimize the impact on users. What should the team do to detect issues earlier?

Accepted Answer

Use a canary deployment configuration that shifts 10% of traffic initially.. A canary deployment (e.g., shifting 10% of traffic initially) allows the team to detect health check failures on a small subset of new instances before the full rollout. This minimizes user impact by limiting exposure to potentially faulty code, while still catching issues earlier than a one-at-a-time deployment. The 'CodeDeployDefault.OneAtATime' configuration already deploys to one instance at a time, but a canary reduces the blast radius further by routing only a fraction of traffic to the new instances.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce'.

Answer

Increase the batch size to deploy to multiple instances at once.

Answer

Add a manual approval step in the pipeline before the deployment.

Question 8

A company uses AWS CodeCommit for source control. Developers need to automatically run tests on every push to a feature branch, but only if the push includes changes to the 'src/' directory. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CodePipeline. AWS CodePipeline can be configured to trigger a pipeline execution when a push occurs to a specific branch in CodeCommit, and it supports path-based filtering using the 'PathFilter' condition in the source action. By combining CodePipeline with AWS Lambda, you can run custom validation logic (e.g., checking if changes are within the 'src/' directory) before invoking further actions like tests. This pair allows you to conditionally run tests only when the push includes changes to 'src/'.

Answer

Amazon CloudWatch Logs

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Question 9

Refer to the exhibit. An AWS CloudFormation template includes a Lambda function with the ARN shown. The function is part of a custom resource to create an S3 bucket. The stack creation fails with the error 'Function not found: arn:aws:lambda:us-east-1:123456789012:function:my-function'. The Lambda function exists in the same account and region. What is the most likely cause?

Accepted Answer

The Lambda function is defined in the same template and has a circular dependency. The most likely cause is a circular dependency (Option A). In AWS CloudFormation, when a Lambda function is defined in the same template as a custom resource that invokes it, the function must be fully created and available before the custom resource can be processed. If the Lambda function depends on the S3 bucket (e.g., via a bucket name or property), and the custom resource also depends on the Lambda function, CloudFormation cannot resolve the order of creation, leading to a 'Function not found' error because the function hasn't been created yet when the custom resource attempts to invoke it.

Answer

The Lambda function is not in the same AWS region

Answer

The Lambda function lacks necessary IAM permissions

Answer

The Lambda function ARN is malformed

Question 10

A developer is using AWS CodeBuild to compile code. The build takes a long time because dependencies are downloaded each time. What can the developer do to reduce build time?

Accepted Answer

Enable caching in the build project to store dependencies in Amazon S3.. Enabling caching in AWS CodeBuild allows the build project to store frequently downloaded dependencies (e.g., Maven, npm, pip packages) in an Amazon S3 bucket. On subsequent builds, CodeBuild retrieves the cached dependencies from S3 instead of re-downloading them from the internet, which significantly reduces build time. This is the most direct and efficient solution for the described problem of repeated dependency downloads.

Answer

Split the build into multiple parallel build actions.

Answer

Use multiple build environments to distribute the work.

Answer

Use a larger compute type for the build project.

Question 11

A company uses AWS CloudFormation to manage infrastructure as code. They have a stack that creates an Amazon RDS database instance. The database password is stored as a parameter in AWS Systems Manager Parameter Store. The CloudFormation template references the parameter using the 'resolve:ssm' dynamic reference. Recently, a security audit found that the password was exposed in plaintext in the CloudFormation stack outputs. The team wants to prevent sensitive information from being displayed in stack outputs or logs. Which approach should be taken?

Accepted Answer

Remove the output from the CloudFormation stack. Removing the output from the CloudFormation stack is the most direct way to prevent the password from being displayed in outputs or logs. Dynamic references like 'resolve:ssm' resolve the value at stack creation/update time, and if that value is included in an output, it will be displayed in plaintext. Setting 'NoEcho' on a template parameter does not affect the resolved value; it only masks the parameter's value in the console when entering it, not the output of a dynamic reference. Option B (Secrets Manager) is a better practice for storing secrets but does not prevent exposure if the secret is still referenced in an output. Option D (KMS encryption of outputs) is not supported.

Answer

Set the 'NoEcho' property to 'true' for the parameter in the template

Answer

Store the password in AWS Secrets Manager and reference it in the template

Answer

Encrypt the output value using AWS KMS

Question 12

An organization uses AWS CodePipeline to deploy a web application. The pipeline includes a test stage that runs integration tests using AWS CodeBuild. The tests are flaky and sometimes fail due to external dependencies. The team wants to automatically retry failed tests before marking the stage as failed. How should this be achieved?

Accepted Answer

Configure the CodeBuild project to automatically retry the build on failure.. AWS CodeBuild natively supports automatic retries on build failure through the 'auto retry limit' configuration. By setting this limit (e.g., 3), CodeBuild will automatically re-run the build if it fails, which directly addresses flaky tests without requiring additional pipeline stages or external event handling. This keeps the retry logic within the same pipeline execution, ensuring that the test stage only fails after exhausting all retry attempts.

Answer

Add a manual approval step after the test stage.

Answer

Use Amazon CloudWatch Events to listen for test failures and trigger a new pipeline execution.

Answer

Create a second pipeline that triggers only on test failures.

Question 13

A startup is using AWS CodeBuild to build and test their application. The build process takes about 10 minutes. Recently, they noticed that some builds are failing randomly with the error 'Could not download dependencies'. The build environment uses a custom Docker image stored in Amazon ECR. The team suspects that the issue is due to network connectivity problems when pulling the Docker image or dependencies from the internet. They want to ensure reliable and faster builds. Which solution should they implement?

Accepted Answer

Configure CodeBuild to use a VPC with a NAT gateway. To improve reliability and speed, configure CodeBuild to use a VPC with a NAT gateway. This provides consistent internet access for pulling dependencies and Docker images, and allows using VPC endpoints for Amazon ECR, reducing network failures. Option D is correct. Option A (using a public Docker Hub) does not address the underlying network issues and may introduce additional points of failure. Option B (increasing build timeout) does not fix the root cause of connectivity problems. Option C (using a larger compute type) does not resolve network connectivity issues.

Answer

Switch to using a public Docker image from Docker Hub

Answer

Increase the build timeout in CodeBuild project settings

Answer

Use a larger compute type for the CodeBuild project

Question 14

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The pipeline has a source stage (S3), a build stage (CodeBuild), and a deploy stage (Elastic Beanstalk). Recently, the deployment started failing with the error 'The Elastic Beanstalk environment is not in a ready state'. The team found that the environment was in an 'Updating' state because a previous deployment was still in progress. They need a solution that prevents concurrent deployments and ensures that the environment is ready before starting a new deployment. Which action should the DevOps engineer take?

Accepted Answer

Configure a 'Wait for Environment to be Ready' action before the deploy stage. To prevent concurrent deployments, the pipeline should check that the Elastic Beanstalk environment is in a ready state before starting a new deployment. AWS CodePipeline provides a built-in 'Wait for Environment to be Ready' action that polls the environment status and waits until it is ready, preventing deployment attempts when the environment is updating. Option C is correct. Option A (increasing timeout) does not prevent concurrent deployments; it only extends the wait time. Option B (disabling rolling updates) does not address concurrency and may cause downtime. Option D (creating multiple environments) adds unnecessary complexity and is not the simplest solution.

Answer

Increase the deployment timeout in the Elastic Beanstalk environment

Answer

Disable rolling updates in the Elastic Beanstalk environment

Answer

Create multiple Elastic Beanstalk environments for blue/green deployment

Question 15

A DevOps engineer is tasked with automating the deployment of a microservices architecture. Each service is packaged as a Docker container. The team wants to use AWS CodePipeline and AWS CodeBuild to build Docker images and push them to Amazon ECR, then deploy to Amazon ECS. What should the CodeBuild buildspec file include to push the image to ECR?

Accepted Answer

Docker build and docker push commands with AWS CLI to authenticate to ECR.. To push a Docker image to Amazon ECR, the buildspec must first authenticate Docker to the ECR registry using the AWS CLI's `aws ecr get-login-password` command piped to `docker login`, then build the image with `docker build`, tag it with the ECR repository URI, and finally push it with `docker push`. CodeBuild does not have a built-in 'ecr-push' action; it relies on executing these standard Docker and AWS CLI commands in the build phases.

Answer

A call to the AWS CodeDeploy API to push the image.

Answer

An invocation of the AWS ECS RunTask API.

Answer

A buildspec phase with 'ecr-push' action.