DOP-C02 SDLC Automation Practice Test 13 — 15 Questions

Question 1

A company uses AWS CodeBuild to run security scans on code. The scan requires access to a private Amazon ECR repository for downloading scanning tools. The CodeBuild project is configured with a VPC and uses an IAM role. However, the build fails with 'Error: unable to pull image from registry.' Which TWO steps should be taken to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add 'ecr:GetDownloadUrlForLayer' and 'ecr:BatchGetImage' permissions to the CodeBuild service role.. The CodeBuild service role must have the 'ecr:GetDownloadUrlForLayer' and 'ecr:BatchGetImage' permissions to authorize the retrieval of container image layers from the private ECR repository. Without these permissions, the Docker pull operation fails with 'unable to pull image from registry' even if network connectivity is established.

Answer

Change the ECR repository policy to allow public access.

Answer

Remove the VPC configuration from the CodeBuild project so it can access the public internet.

Answer

Grant 'kms:Decrypt' permissions for the KMS key used by ECR.

Question 2

A company wants to implement a CI/CD pipeline for an application that runs on Amazon ECS with Fargate. The pipeline should build a Docker image, push it to Amazon ECR, and deploy a new task definition to ECS. Which THREE AWS services are required to build this pipeline?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is required because it manages the deployment of the updated task definition to the ECS service, supporting strategies like blue/green and canary deployments. It integrates with AWS CodePipeline to orchestrate the deployment step, ensuring minimal downtime and rollback capabilities.

Answer

Amazon S3

Answer

AWS CodeCommit

Question 3

Refer to the exhibit. A CodePipeline service role has this IAM policy attached. The pipeline's deploy stage uses CodeDeploy to perform an ECS blue/green deployment. The deployment fails with an access denied error. What is the MOST likely missing permission?

Accepted Answer

ecs:UpdateService. In an ECS blue/green deployment via CodeDeploy, the CodePipeline service role must have permission to call ecs:UpdateService on the ECS service to trigger the deployment of the new task definition. Without this permission, CodeDeploy cannot update the ECS service to use the new task set, resulting in an access denied error. The other permissions are either already present or not directly required for the deployment action.

Answer

ecs:RegisterTaskDefinition

Answer

codedeploy:CreateDeployment

Answer

ecs:CreateService

Question 4

A DevOps team is implementing a CI/CD pipeline for a microservices architecture on AWS ECS. They want to ensure zero-downtime deployments and automatic rollback if health checks fail. Which combination of services should they use?

Accepted Answer

AWS CodeDeploy with ECS blue/green deployment and CloudWatch alarms for automatic rollback.. AWS CodeDeploy supports blue/green deployments for ECS, which creates a new replacement task set alongside the original, allowing traffic to shift only after health checks pass. CloudWatch alarms can be configured to trigger an automatic rollback if the new deployment fails health checks, ensuring zero-downtime and automated recovery.

Answer

AWS CodePipeline with ECS rolling update and manual rollback.

Answer

AWS Elastic Beanstalk with rolling deployment and enhanced health reporting.

Answer

AWS CloudFormation with ECS service update and SNS notification on failure.

Question 5

A developer wants to automatically run unit tests when a pull request is created in AWS CodeCommit. Which AWS service should be used to trigger the tests?

Accepted Answer

Amazon EventBridge rule for CodeCommit pull request state changes targeting AWS Lambda.. Amazon EventBridge can capture CodeCommit pull request state changes (e.g., created, updated, merged) via a rule and route them to a target like AWS Lambda. The Lambda function can then invoke unit tests in response to the pull request creation event. This provides a serverless, event-driven trigger without polling or webhooks.

Answer

AWS CodePipeline with source polling.

Answer

AWS CodeBuild with webhooks from CodeCommit.

Answer

AWS CloudWatch Logs subscription filter for repository logs.

Question 6

A team uses AWS CodePipeline with multiple parallel actions in a stage. They notice that when one action fails, the entire stage fails and no further actions are attempted. They want the pipeline to continue with the remaining actions even if one fails, and then report the failure at the end. Which feature should they use?

Accepted Answer

Configure each action with 'On failure' set to 'CONTINUE'.. AWS CodePipeline allows you to set the 'On failure' property for each action to 'CONTINUE', which instructs the pipeline to proceed with subsequent actions even if that specific action fails. This ensures that all parallel actions in the stage are attempted, and the overall stage status reflects any failures at the end, rather than aborting immediately.

Answer

Configure each action with a 'RunOrder' of 1 and set 'On failure' to 'ABORT'.

Answer

Set the stage's 'On failure' to 'ROLLBACK'.

Answer

Use a custom Lambda function to catch failures and resume the pipeline.

Question 7

A company uses AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yml includes a 'post_build' phase command to tag the image. The build fails with 'unauthorized: authentication required'. What must be done to resolve this?

Accepted Answer

Add 'ecr:InitiateLayerUpload' and 'ecr:CompleteLayerUpload' permissions to the CodeBuild service role.. The error 'unauthorized: authentication required' indicates that CodeBuild's IAM role lacks the necessary permissions to push the Docker image to Amazon ECR. The correct resolution is to add the specific ECR permissions 'ecr:InitiateLayerUpload' and 'ecr:CompleteLayerUpload' to the CodeBuild service role, as these are required for the Docker push operation to upload image layers. Without these permissions, the ECR API rejects the push even if other permissions like 'ecr:GetAuthorizationToken' are present.

Answer

Use the 'docker login' command with AWS CLI in the build phase.

Answer

Install the AWS CLI in the CodeBuild build environment.

Answer

Create a new IAM user with ECR permissions and store the keys in CodeBuild environment variables.

Question 8

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda. They want to automatically deploy the latest version of the Lambda function to production after running integration tests. The source code is in AWS CodeCommit. Which pipeline configuration should they use?

Accepted Answer

CodeCommit -> CodeBuild (test) -> CodeDeploy (Lambda deployment) -> Lambda.. It uses CodeDeploy's built-in Lambda deployment support, which enables safe, gradual traffic shifting (e.g., canary or linear deployments) and automatic rollback on CloudWatch alarm failures. This pipeline integrates CodeCommit for source, CodeBuild for integration tests, and CodeDeploy to orchestrate the Lambda update with minimal risk, aligning with AWS best practices for serverless CI/CD.

Answer

CodeCommit -> CodeBuild (test) -> Lambda (deploy via update-function-code).

Answer

CodeCommit -> Lambda (deploy via S3 trigger) -> CodeBuild (test) -> production.

Answer

CodeCommit -> CodeBuild (test and deploy) -> Lambda via AWS CLI in buildspec.

Question 9

A company has a multi-account AWS environment with separate accounts for development, staging, and production. They want to implement a CI/CD pipeline that deploys to each account sequentially after manual approvals. Which setup allows cross-account deployment with CodePipeline?

Accepted Answer

Create an IAM role in the target account with permissions for the pipeline service role to assume, and use that role in the deployment action.. CodePipeline supports cross-account deployments by having the pipeline service role in the source account assume an IAM role in the target account. This role must have a trust policy allowing the pipeline service role to assume it, and the deployment action (e.g., CloudFormation, CodeDeploy) references that target account role. This enables sequential deployment to development, staging, and production accounts with manual approval gates between stages.

Answer

Create separate pipelines in each account and trigger them via SNS from a master pipeline.

Answer

Use CodePipeline with cross-account actions by specifying the target account ID and region.

Answer

Use a single pipeline in the management account with different stages for each account.

Question 10

A developer is using AWS CodeCommit as a source repository for a CodePipeline. They want to automatically start the pipeline when changes are pushed to the main branch. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that triggers the pipeline on CodeCommit 'push to main' events.. Amazon EventBridge can natively capture CodeCommit repository events, such as 'push to main', and directly trigger a CodePipeline execution without any custom code or polling. This is the simplest and most serverless approach, as it requires no additional infrastructure or manual configuration of webhooks.

Answer

Add a Lambda function that is invoked by CodeCommit triggers, which then starts the pipeline.

Answer

Configure the pipeline to poll the CodeCommit repository every 5 minutes.

Answer

Use a webhook from CodeCommit to the pipeline.

Question 11

Which TWO actions are best practices when designing a CI/CD pipeline for a containerized application on Amazon ECS? (Choose two.)

Accepted Answer

Separate the build stage from the deploy stage in the pipeline.. Separating the build stage from the deploy stage in a CI/CD pipeline for Amazon ECS ensures that the Docker image is built, tested, and validated independently before being promoted to production. This decoupling allows you to reuse the same immutable artifact across multiple environments (e.g., dev, staging, prod), reducing the risk of environment-specific build inconsistencies and enabling rollback to a known good image.

Answer

Run a full integration test suite on every commit to the repository.

Answer

Build the Docker image in the deploy stage to ensure consistency.

Answer

Use a rolling update with a fixed number of tasks for deployment.

Question 12

Which TWO are valid use cases for using AWS CodeArtifact in a CI/CD pipeline? (Choose two.)

Accepted Answer

Caching dependencies from public repositories to improve build speed and reliability.. CodeArtifact can act as a proxy cache for public repositories like npm, PyPI, Maven, and NuGet. By caching dependencies locally, it reduces reliance on external sources, improves build speed by avoiding repeated downloads, and increases reliability by insulating the pipeline from outages or rate limits of public registries.

Answer

Storing Docker images that are used by ECS tasks.

Answer

Storing source code archives for use in deployment stages.

Answer

Hosting static website assets for deployment to S3.

Question 13

Which THREE practices help ensure the security of a CI/CD pipeline that deploys to production? (Choose three.)

Accepted Answer

Integrate static code analysis and vulnerability scanning into the pipeline.. Static code analysis and vulnerability scanning (option A) are essential for identifying security flaws early in the development lifecycle, preventing vulnerable code from reaching production. Integrating these tools into the CI/CD pipeline ensures that every commit is automatically checked against known vulnerabilities and coding standards, reducing the risk of deploying exploitable code.

Answer

Require manual approval for all deployments to production.

Answer

Store deployment credentials in the source repository for traceability.

Question 14

A DevOps engineer is creating a CodePipeline service role. The above IAM policy is attached to the role. The pipeline fails when trying to download artifacts from the S3 bucket. What is the issue?

Accepted Answer

The policy is missing s3:ListBucket permission on the bucket.. The pipeline fails because the IAM policy grants s3:GetObject on the object ARN but lacks s3:ListBucket on the bucket ARN. CodePipeline's S3 artifact download action first calls ListBucket to verify the bucket exists and the object key is accessible before performing the GetObject call. Without s3:ListBucket, the initial validation fails, causing the pipeline to error out even though GetObject is allowed.

Answer

The Resource for S3 actions should be the bucket ARN, not the object ARN.

Answer

The CodeDeploy actions require a specific resource ARN instead of '*'.

Answer

The Action list is missing s3:GetObjectVersion.

Question 15

A DevOps engineer is reviewing the CodePipeline structure above. The pipeline fails during the Deploy stage with an error: 'The deployment group could not be found.' What is the most likely cause?

Accepted Answer

The pipeline is configured as a single-region pipeline, but the Deploy action is in a different region.. The error 'The deployment group could not be found' indicates that CodePipeline is attempting to invoke a CodeDeploy deployment in a region where the specified deployment group does not exist. If the pipeline is configured as a single-region pipeline (e.g., in us-east-1) but the Deploy action references a deployment group in a different region (e.g., us-west-2), CodePipeline will fail because it cannot resolve the deployment group across regions in a single-region pipeline configuration. Cross-region actions require explicit cross-region action configuration in the pipeline structure.

Answer

The source artifact is not accessible from us-west-2.

Answer

The CodeDeploy application does not exist in us-west-2.

Answer

The CodeBuild project is not configured to output artifacts.