DOP-C02 SDLC Automation Practice Test 13 — 15 Questions

Question 1

A large enterprise uses AWS CodePipeline with multiple stages including source, build, test, and deploy. The test stage runs a suite of integration tests that take 30 minutes. The team wants to reduce the overall pipeline execution time by running the test stage in parallel across different test environments (e.g., different browsers, operating systems). However, they also need to aggregate the test results into a single report. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure parallel actions in the test stage and use a custom action to aggregate results. CodePipeline supports parallel actions within a stage. You can define multiple test actions (e.g., one for each browser or OS) and run them in parallel. To aggregate results, you can add a post-test action that runs after all parallel actions complete, or use a custom action to collect and combine test reports. Option D correctly describes this approach. Option A (separate pipelines) adds complexity and doesn't aggregate easily. Option B (sequential) increases time. Option C (batch builds) is for running multiple builds in parallel with CodeBuild, but it doesn't inherently handle different environments like browsers/OS; also, the scenario asks for parallel actions in the pipeline stage, not batch builds.

Answer

Create separate pipelines for each test environment

Answer

Create a sequential test stage that runs each environment one after another

Answer

Use CodeBuild batch builds with a single buildspec to run tests in parallel

Question 2

A company is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from GitHub, a build stage using AWS CodeBuild, and a deploy stage using AWS Elastic Beanstalk. The team wants to ensure that the pipeline only proceeds if the code quality checks pass and unit tests are successful. Which TWO actions should be taken?

Accepted Answer

Add a test stage in the pipeline with a CodeBuild action that runs code quality and unit tests.. Adding a dedicated test stage with a CodeBuild action allows the pipeline to explicitly run code quality checks and unit tests as a separate, visible step. This ensures the pipeline only proceeds to deployment if these tests pass, as CodeBuild can be configured to fail the action on non-zero exit codes from test commands. Option C is also correct because modifying the buildspec file in the existing build stage to include test commands and setting the build to fail on test failures integrates quality gates directly into the build process, which is a common and valid approach for enforcing test success before deployment.

Answer

Add a manual approval step before the deploy stage.

Answer

Configure the source stage to use an S3 bucket and add a test action.

Answer

Use AWS CloudFormation to create a test environment and run tests.

Question 3

A DevOps team is using AWS CodeBuild to run integration tests against a test database. The database is an Amazon RDS instance in a private subnet. The CodeBuild project is configured to run in a VPC. Which THREE steps are required to allow CodeBuild to access the RDS instance?

Accepted Answer

Ensure the security group attached to the RDS instance allows inbound traffic from the CodeBuild security group.. The security group attached to the RDS instance must explicitly allow inbound traffic from the security group associated with the CodeBuild project's elastic network interfaces. This is a fundamental network access control in AWS: security groups act as virtual firewalls, and without an inbound rule permitting traffic from the CodeBuild security group on the database port (e.g., 3306 for MySQL), the connection will be blocked regardless of other network configurations.

Answer

Place the RDS instance in a public subnet with a public IP.

Answer

Attach a NAT gateway to the VPC so that CodeBuild can route to RDS.

Question 4

An organization uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that minifies assets), and a deploy stage (S3 deployment). The team wants to add a stage for running security vulnerability scans on the code. Which TWO options are viable?

Accepted Answer

Add a custom action in the pipeline that invokes a third-party scanning service via AWS Lambda.. AWS CodePipeline supports custom actions that can invoke external services via AWS Lambda. By creating a custom action, the team can integrate a third-party security scanning service directly into the pipeline, allowing the scan to run as a distinct stage between build and deploy. This approach ensures that the pipeline fails if vulnerabilities are detected, preventing insecure code from reaching the S3 bucket.

Answer

Enable AWS Shield Advanced to scan for vulnerabilities.

Answer

Use Amazon Inspector to scan the source code.

Answer

Add an S3 event notification to trigger a Lambda function that scans the S3 bucket.

Question 5

A company is using AWS CodeBuild to compile and test code. The buildspec.yml file includes a pre_build phase that installs dependencies and a build phase that runs the compilation. The tests are run in the post_build phase. The team wants to improve the security of the build process by ensuring that sensitive information such as database passwords is not exposed in the build logs. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Use AWS Systems Manager Parameter Store to store the secrets and reference them in the buildspec using the 'parameter-store' field.. AWS CodeBuild can retrieve secrets from both Systems Manager Parameter Store and Secrets Manager using the 'parameter-store' and 'secrets-manager' fields in buildspec.yml. In both cases, CodeBuild injects the secret values as environment variables without displaying them in the logs, provided the build configuration does not explicitly print environment variables. IAM permissions control which service and which secrets can be accessed. This prevents secrets from being exposed in build logs, unlike merely restricting access to logs (C) or encrypting them at rest (D) which do not stop the secret from appearing in the log content. Storing secrets as plain-text environment variables (E) is insecure.

Answer

Restrict access to the build logs by using IAM policies to only allow specific users to view them.

Answer

Enable encryption at rest for the CodeBuild project's S3 logs.

Answer

Store the secrets as plain-text environment variables in the CodeBuild project.

Question 6

Refer to the exhibit. A DevOps engineer runs the command to get the pipeline definition. The pipeline has a source stage from an S3 bucket and a build stage with CodeBuild. The CodeBuild project is configured to output artifacts to a specific S3 bucket. However, the pipeline fails at the build stage with an error: 'Artifact 'BuildArtifact' is not found'. What is the most likely cause?

Accepted Answer

The CodeBuild project is not configured to output the expected artifact named 'BuildArtifact'.. The error 'Artifact 'BuildArtifact' is not found' indicates that CodePipeline expects an artifact named 'BuildArtifact' from the CodeBuild project, but the project's output artifact configuration does not include that name. In CodePipeline, the build stage must produce an artifact with the exact name specified in the pipeline definition; if the CodeBuild project's artifacts section (in buildspec.yml or console) omits or misnames it, the pipeline fails at that stage.

Answer

The source stage is using CodeCommit instead of S3.

Answer

The source artifact is not being passed to the build stage.

Answer

The IAM role for CodePipeline does not have permissions to read from the S3 bucket.

Question 7

A company uses AWS CloudFormation to provision infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the stack to change the DB instance class from db.t2.micro to db.t3.medium. Which THREE of the following must be true for the update to succeed? (Choose three.)

Accepted Answer

The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.. CloudFormation stacks in a terminal failure state like ROLLBACK_COMPLETE cannot be updated; they must be deleted and recreated. This is a fundamental constraint of the CloudFormation service, as the stack is considered non-functional and unable to process further operations.

Answer

Deletion protection must be disabled on the DB instance.

Answer

A change set must be created and executed for the update.

Question 8

Refer to the exhibit. An IAM policy is attached to a CodeBuild service role. The CodeBuild project is used to build code from a CodeCommit repository and output artifacts to an S3 bucket. However, the build fails with an error: 'Unable to download source from CodeCommit'. What is the missing permission?

Accepted Answer

Permissions to read from the CodeCommit repository.. The error 'Unable to download source from CodeCommit' indicates that the CodeBuild service role lacks the necessary permissions to read the source code from the CodeCommit repository. CodeBuild uses the service role to interact with CodeCommit via Git, which requires the `codecommit:GitPull` action (or broader read permissions like `codecommit:Get*` and `codecommit:List*`). Without these permissions, the build process cannot clone or fetch the source code, causing the failure.

Answer

Permissions to create CloudWatch Logs for build output.

Answer

Permissions to decrypt the KMS key used to encrypt artifacts.

Answer

Permissions to write to the S3 artifact bucket.

Question 9

A company runs a containerized microservices application on Amazon ECS with Fargate. The application is deployed using AWS CodePipeline with CodeBuild as the build stage and ECS as the deploy stage. The pipeline uses a deployment controller of type CODE_DEPLOY with a blue/green deployment strategy. Recently, the team noticed that during deployments, the new task set fails health checks and the deployment is rolled back. The application logs indicate that the new containers fail because they cannot connect to the Redis cluster, which is a required dependency. The Redis cluster is running on Amazon ElastiCache and is in the same VPC as the ECS tasks. The team has verified that the security group for the ElastiCache cluster allows inbound traffic from the ECS tasks' security group. The ECS task definition includes the Redis endpoint as an environment variable. What is the MOST likely cause of the connection failure?

Accepted Answer

The security group for the ElastiCache cluster only allows inbound traffic from the security group of the original task set, not the new task set created during deployment.. In a blue/green deployment with CODE_DEPLOY, the new task set is created in a separate target group and may have a different security group automatically assigned (or rely on the service's security group). However, the security group rule on the ElastiCache cluster must explicitly allow inbound traffic from the security group of the new task set. If the rule only allows traffic from the original task set's security group, the new task set will fail to connect. Option A is incorrect because the ECS service is configured to use the same subnets for both task sets, so subnet routing is not the issue. Option B is incorrect because the environment variable is passed via the task definition, which is the same for both task sets; the connection failure occurs despite the variable being correct. Option D is incorrect because both task sets are in the same VPC as the ElastiCache cluster.

Answer

The new task set is being launched in different private subnets that do not have a route to the ElastiCache cluster.

Answer

The Redis endpoint environment variable is not being passed correctly to the new task set because of a misconfiguration in the task definition.

Answer

The new task set is using a different VPC than the ElastiCache cluster.

Question 10

Refer to the exhibit. A DevOps engineer created a CloudFormation stack that includes a Lambda function. The stack creation failed and rolled back. The error message for the Lambda function says 'Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack rollback was triggered due to a failure in another resource, and the Lambda creation was cancelled.. CloudFormation creates resources in a specific order, and if a dependency fails or another resource fails, CloudFormation cancels the creation of subsequent resources and initiates a rollback. The error 'Resource creation cancelled' indicates that the Lambda function was never actually attempted to be created; instead, its creation was aborted due to a failure in a preceding or parallel resource. This is a standard CloudFormation behavior when a stack operation is interrupted by a failure in another resource.

Answer

The Lambda function's IAM role does not have sufficient permissions.

Answer

The Lambda function's code is missing from the S3 bucket.

Answer

The Lambda function creation timed out.

Question 11

A company uses AWS CodeCommit as a Git repository and CodeBuild for continuous integration. The buildspec.yml file includes steps to run unit tests and package the application. The team wants to ensure that only code from the main branch is deployed to production. They have set up a CodePipeline that triggers on changes to any branch. The pipeline includes a build stage that runs CodeBuild, and then a deploy stage that deploys to production. The team noticed that code from feature branches is being deployed to production accidentally. The team wants to modify the pipeline to prevent this. What is the MOST effective solution?

Accepted Answer

In the CodePipeline source stage, configure the branch filter to only allow the main branch to trigger the pipeline.. The most effective solution because it configures the source stage to only trigger the pipeline when changes are pushed to the main branch. This directly prevents feature branch changes from starting the pipeline. Option A is not effective because IAM policies can restrict push access but do not control pipeline triggers. Option C is not effective because a manual approval step does not prevent the pipeline from being triggered; it only adds a gate before deployment, and the build stage still runs, wasting resources. Option D is not effective because configuring the branch in the CodeBuild project's source configuration only affects what CodeBuild builds, but the pipeline is still triggered for all branches, so the pipeline will run but CodeBuild may skip non-main branches; however, the pipeline still triggers and may cause unnecessary runs or alerts.

Answer

Use IAM policies to restrict developers from pushing to the main branch.

Answer

Add a manual approval step before the deploy stage and require approval from a senior engineer.

Answer

Modify the CodeBuild project to only build the main branch by specifying the branch in the source configuration.

Question 12

A developer is using AWS CloudFormation to deploy a stack that includes an AWS Lambda function. The Lambda function code is stored in an S3 bucket. The CloudFormation template references the S3 bucket and object key. The developer wants to update the Lambda function code by uploading a new zip file to S3 and then updating the stack. The developer updates the S3 object with a new version, but the stack update does not automatically use the new code. What should the developer do to ensure the stack update uses the new code?

Accepted Answer

Upload the new code to a different S3 key or specify a new version ID in the CloudFormation template.. CloudFormation only detects changes to S3 objects if the S3 key or version changes. By uploading the new code with a different key or specifying a new version ID in the template, CloudFormation will recognize the change and update the Lambda function. Option A is incorrect because S3 event notifications do not automatically trigger stack updates for code changes; they are typically used for other automation. Option B is incorrect because stack policies control whether resources can be updated, but they do not cause CloudFormation to detect the code change; the template reference itself must indicate a new version. Option C is incorrect because deleting and recreating the stack is unnecessary and disruptive; a simple stack update with a new version ID is sufficient.

Answer

Enable S3 event notifications to trigger a CloudFormation stack update when the object is updated.

Answer

Modify the CloudFormation stack policy to allow updates to the Lambda function.

Answer

Delete the stack and recreate it with the new code.

Question 13

A company uses AWS CodePipeline to automate the deployment of a static website hosted on Amazon S3. The pipeline includes a source stage that pulls from a CodeCommit repository and a deploy stage that uses CodeBuild to sync the files to an S3 bucket. The team noticed that the website is not updating after a successful pipeline run. The CodeBuild logs show that the 'aws s3 sync' command completed successfully. However, the website still shows the old content. What is the MOST likely cause?

Accepted Answer

The website is fronted by Amazon CloudFront, which is caching the old content.. The most likely cause is that the website is fronted by Amazon CloudFront, which caches the old content. Even though the 'aws s3 sync' command successfully updates the objects in the S3 bucket, CloudFront continues to serve the cached version until the cache TTL expires or a cache invalidation is performed. Option A is incorrect because the CodeBuild project must have write permissions to the S3 bucket for the sync command to succeed; if it lacked permissions, the sync would fail. Option B is incorrect because the S3 bucket is already configured for static website hosting (implied by the website being accessible). Option D is incorrect because the bucket policy does not affect the ability to serve updated objects; public access is likely already granted for the website to be served. Therefore, the caching behavior of CloudFront is the reason the website shows old content.

Answer

The CodeBuild project does not have permission to write to the S3 bucket.

Answer

The S3 bucket is not configured for static website hosting.

Answer

The S3 bucket policy is blocking public access to the updated objects.

Question 14

A team uses AWS CodePipeline with a multi-branch strategy. They want to run different build projects based on the branch name: 'main' triggers a production build, 'develop' triggers a staging build, and feature branches trigger a test build. Which CodePipeline feature should they use?

Accepted Answer

Create separate pipelines for each branch and use tags.. To run different build projects based on branch, create separate pipelines, each configured with a specific source branch (e.g., main, develop, feature branches). This is the native and straightforward approach. AWS CodePipeline does not provide regex branch filtering in source actions.

Answer

Use AWS Lambda to dynamically change the pipeline definition.

Answer

Configure the source action with a branch filter using a regular expression.

Answer

Use a manual approval action to select the branch.

Question 15

A company uses AWS CloudFormation to create a stack with a Lambda function that uses a VPC. The stack creation fails with 'CREATE_FAILED: The provided execution role does not have permissions to call ec2:CreateNetworkInterface on the resource'. What is the likely cause?

Accepted Answer

The Lambda execution role is missing the ec2:CreateNetworkInterface permission.. When a Lambda function is configured to run inside a VPC, it requires the `ec2:CreateNetworkInterface` permission to create an Elastic Network Interface (ENI) in the VPC subnets. The error message explicitly states that the execution role lacks this permission, which is a required IAM action for VPC-enabled Lambda functions. Without this permission, CloudFormation cannot provision the ENI, causing the stack creation to fail.

Answer

The VPC does not have a subnet with internet access.

Answer

The CloudFormation template does not specify a security group.

Answer

The Lambda function code has a syntax error.