DOP-C02 SDLC Automation Practice Test 13 — 15 Questions

Question 1

An organization uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. Developers complain that their pipeline executions often fail because the source stage cannot access the CodeCommit repository. The IAM role used by CodePipeline has the following policy attached. What is the MOST likely cause of the failure? Policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["codecommit:GetBranch","codecommit:GetCommit","codecommit:UploadArchive","codecommit:GetUploadArchiveStatus"],"Resource":"*"}]}

Accepted Answer

The IAM role is missing the 'codecommit:GitPull' permission. Option A is correct because the pipeline source stage needs to use Git operations like GitPull, which require the codecommit:GitPull action. The provided policy only allows GetBranch, GetCommit, and archive operations, which are not sufficient for Git-based connections. Option B is wrong because CodeStar connections are used for third-party sources. Option C is wrong because the role does not need S3 permissions for CodeCommit access. Option D is wrong because tagging is not related to this issue.

Answer

The IAM role does not have permissions to describe the CodeCommit repository

Answer

The CodeCommit repository is not tagged with the pipeline's project tag

Answer

The pipeline uses a CodeStar connection instead of a direct CodeCommit source

Question 2

A DevOps engineer is setting up an AWS CodeBuild project that needs to access resources in a VPC, such as an Amazon RDS database. The engineer has configured the CodeBuild project to run in the VPC. Which additional configuration is required for CodeBuild to pull the build Docker image?

Accepted Answer

Create a VPC interface endpoint for Amazon ECR and configure the CodeBuild project to use it.. Option D is correct because CodeBuild requires a VPC interface endpoint to Amazon ECR or the Docker Hub to pull images when running in a private subnet without internet access. Option A is wrong because internet gateway is not enough; the subnet must be public or have NAT. Option B is wrong because VPC peering does not provide internet access. Option C is wrong because CodeBuild does not have a direct integration with Amazon ECR via a gateway endpoint; ECR requires interface endpoints.

Answer

Create a VPC peering connection to another VPC that has internet access.

Answer

Configure a VPC gateway endpoint for Amazon ECR.

Answer

Attach an internet gateway to the VPC and add a default route to it.

Question 3

A company uses AWS CodeBuild to run unit tests and package a Node.js application. The buildspec.yml file includes commands to install dependencies using npm. The build is failing with the error: 'npm ERR! code EACCES'. How should a DevOps engineer resolve this issue?

Accepted Answer

Use 'npm ci' instead of 'npm install' and ensure a package-lock.json is present. Option B is correct because the default CodeBuild user does not have write permissions to the default npm global directory. Using 'npm ci' does not require global write access and is also faster. Option A is wrong because running as root is not recommended and may cause other issues. Option C is wrong because changing permissions is not necessary. Option D is wrong because CodeBuild environments have internet access by default.

Answer

Configure the CodeBuild project to use a custom VPC with a NAT gateway for internet access

Answer

Configure the buildspec to run npm install with sudo

Answer

Add a command to change the ownership of the node_modules directory to the current user

Question 4

A DevOps team uses AWS CodePipeline to deploy a static website to an Amazon S3 bucket. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that runs a build tool), and a deploy stage (S3). After a recent code change, the build stage succeeded but the deploy stage failed with the error: 'Access Denied' when uploading artifacts to the S3 bucket. What should the team do to fix the issue?

Accepted Answer

Add 's3:PutObject' permission to the CodePipeline service role. Option C is correct because the CodePipeline service role needs permissions to put objects into the S3 bucket. The error indicates the role used by CodePipeline lacks s3:PutObject permission. Option A is wrong because the build project role is for build, not deploy. Option B is wrong because the error is about the deploy stage, not the source stage. Option D is wrong because bucket policy is not the typical issue if the role exists.

Answer

Configure the S3 bucket to allow public access

Answer

Add an S3 bucket policy that grants the CodeBuild service role s3:PutObject access

Answer

Verify that the CodeCommit repository has the correct permissions for the pipeline

Question 5

A company is using AWS CodePipeline with multiple stages that include source, build, and deploy. The pipeline uses an Amazon S3 bucket as the source action. The team notices that the pipeline is not automatically starting when new files are uploaded to the S3 bucket. The S3 bucket has versioning enabled. What is the most likely reason?

Accepted Answer

The pipeline is configured to detect changes based on object key, but the uploaded file uses the same key as an existing object.. Option C is correct because the S3 source action in CodePipeline only triggers on PUT operations that create new objects or versions; if the object key does not change, it may not trigger. Option A is wrong because versioning is actually required for S3 source actions. Option B is wrong because the pipeline action can use the same bucket as the source. Option D is wrong because there is no specific SQS requirement for S3 source triggers.

Answer

The S3 bucket is the same bucket used for the deploy action.

Answer

The S3 bucket is not configured to send Amazon SQS notifications to CodePipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 6

A company is using AWS CodeCommit with multiple repositories. Developers are required to create pull requests for all changes, and the pull request must be associated with a JIRA issue key (e.g., PROJ-123) in the commit message. A DevOps engineer needs to enforce this policy automatically. Which approach meets the requirement with minimal operational overhead?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function to validate the pull request description and reject if missing JIRA key. Option B is correct because CodeCommit supports custom triggers that can invoke a Lambda function to validate commit messages or pull request descriptions. This approach is automatic and does not require additional infrastructure. Option A is wrong because pre-commit hooks are client-side and not enforceable. Option C is wrong because CodeBuild does not run on every commit by default and would require a pipeline trigger. Option D is wrong because S3 is not involved.

Answer

Store JIRA keys in an S3 bucket and configure a CloudWatch Events rule to check commits

Answer

Use AWS CodeBuild to run a validation script during the build phase

Answer

Require developers to install a pre-commit hook script locally

Question 7

A team is using AWS CloudFormation to manage infrastructure. They want to implement a change management process where any modifications to the stack must be reviewed and approved. Which feature should they use?

Accepted Answer

Change Sets. Option B is correct because Change Sets allow you to preview changes and then execute them after manual approval. Option A is wrong because StackSets manage stacks across accounts/regions, not approval workflows. Option C is wrong because Drift Detection identifies changes but does not prevent them. Option D is wrong because Stack Policies protect resources but do not enforce an approval process.

Answer

StackSets

Answer

Drift Detection

Answer

Stack Policy

Question 8

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project can access a private Amazon S3 bucket to download build artifacts? (Choose two.)

Accepted Answer

Add a bucket policy that explicitly allows access from the CodeBuild project's IAM role ARN. Options A and D are correct. The CodeBuild project needs an IAM role with permissions to access the S3 bucket, and the S3 bucket policy must allow access from that role. Option B is wrong because VPC configuration is not required for S3 access. Option C is wrong because the bucket does not need to be public. Option E is wrong because CodeBuild does not use access keys.

Answer

Generate an access key and secret key for the CodeBuild project to use in the buildspec

Answer

Configure the CodeBuild project to run in a VPC with an S3 VPC endpoint

Answer

Make the S3 bucket publicly readable

Question 9

A company uses AWS CodeBuild to run unit tests as part of a CI pipeline. The buildspec.yaml file is located in the root of the source repository. The build takes 30 minutes to complete. The team wants to speed up the build by caching dependencies. Which approach should they take?

Accepted Answer

Configure the buildspec.yaml to enable local caching and specify the paths to cache.. Option C is correct because CodeBuild supports local caching, which stores the cache in an S3 bucket and speeds up builds by reusing downloaded dependencies. Option A is wrong because CodeBuild does not directly support EFS for caching. Option B is wrong because CodeCommit does not provide caching. Option D is wrong because re-downloading dependencies defeats the purpose.

Answer

Download dependencies from the internet each time the build runs.

Answer

Mount an Amazon EFS file system to the build container and store dependencies there.

Answer

Store dependencies in an AWS CodeCommit repository and clone it during the build.

Question 10

Which THREE steps are required to set up a continuous deployment pipeline using AWS CodePipeline that deploys a Docker-based application to Amazon ECS? (Choose three.)

Accepted Answer

Create a source stage that uses AWS CodeCommit as the source provider. Options A, C, and D are correct. A source stage with CodeCommit stores the code; a build stage with CodeBuild builds and pushes the Docker image to ECR; a deploy stage with ECS deploys the new task definition. Option B is wrong because CodeDeploy is for EC2/on-premises, not ECS. Option E is wrong because Lambda is not used for ECS deployment.

Answer

Create a deploy stage that uses AWS CodeDeploy to deploy to Amazon ECS

Answer

Create an invoke stage that uses AWS Lambda to update the ECS service

Question 11

Which TWO approaches can be used to automatically roll back a failed deployment in AWS CodeDeploy? (Choose two.)

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails. Options B and D are correct. Configuring automatic rollback in CodeDeploy will trigger a rollback when deployment fails or a CloudWatch alarm is triggered. Option A is wrong because the deployment group settings control rollback, not the revision. Option C is wrong because CodePipeline can trigger rollback, but it requires manual configuration. Option E is wrong because the IAM role does not initiate rollback.

Answer

Use a CloudWatch Events rule to trigger a rollback when a deployment fails

Answer

Attach an IAM policy to the CodeDeploy service role that allows rollback actions

Answer

Specify a rollback revision in the AppSpec file

Question 12

An organization uses AWS CodePipeline to deploy a serverless application using AWS Lambda and Amazon API Gateway. The pipeline includes a manual approval action. The team wants to ensure that the approval email is sent to multiple approvers and that any one of them can approve or reject. How should the approval action be configured?

Accepted Answer

Create an Amazon SNS topic with multiple subscribers, and configure the approval action to use that SNS topic ARN.. Option B is correct because the manual approval action in CodePipeline supports a list of SNS topic ARNs; any subscriber of that topic can approve or reject. Option A is wrong because the approval action does not have a 'multiple approvers' attribute; it uses SNS topics. Option C is wrong because you cannot specify multiple IAM users directly in the action. Option D is wrong because you cannot specify multiple email addresses directly in the action.

Answer

Specify multiple email addresses in the 'ApproverEmail' field of the approval action.

Answer

Set the 'Approvers' field in the approval action to a comma-separated list of IAM user ARNs.

Answer

Add multiple IAM users to the pipeline's service role.

Question 13

A company has a CI/CD pipeline using AWS CodePipeline that deploys a critical web application to an Auto Scaling group of EC2 instances. The pipeline includes a deploy stage using AWS CodeDeploy. Recently, the deployment failed because the new application version caused an increase in HTTP 500 errors. The operations team manually rolled back the deployment by redeploying the previous version. However, the team wants to automate this process so that future failed deployments are automatically rolled back. Additionally, they want to ensure that if the rollback itself fails, the system should alert the on-call engineer. Currently, the deployment group is configured with 'rollback when a deployment fails' disabled. The team has also set up a CloudWatch alarm that triggers when the HTTP 500 error rate exceeds a threshold. What should a DevOps engineer do to meet these requirements with minimal operational overhead?

Accepted Answer

Configure the deployment group to automatically roll back when a CloudWatch alarm is triggered, and also enable automatic rollback on deployment failure. Set up a CloudWatch alarm on the deployment group's failure metric to notify the on-call engineer. Option C is correct because enabling automatic rollback on alarm in CodeDeploy will trigger a rollback when the CloudWatch alarm is in ALARM state. Additionally, enabling automatic rollback on deployment failure ensures that if the rollback itself fails, the deployment group status will indicate failure, and a CloudWatch alarm can be set on the deployment group's failure metric to alert the on-call engineer. Option A is wrong because it does not address rollback on alarm. Option B is wrong because a manual approval step would require human intervention. Option D is wrong because SNS notification alone does not perform the rollback.

Answer

Create a CloudWatch Events rule that triggers an AWS Lambda function to roll back the deployment when the alarm state is reached, and configure the Lambda function to send an SNS notification on failure

Answer

Add a manual approval step before the deploy stage in CodePipeline and require the on-call engineer to approve or reject the deployment

Answer

Enable the 'rollback when a deployment fails' option in the deployment group and create a CloudWatch alarm on the deployment group's failure metric to notify the on-call engineer via Amazon SNS

Question 14

A company is implementing a CI/CD pipeline using AWS CodePipeline. The source code is stored in an AWS CodeCommit repository. The pipeline must automatically start whenever a change is pushed to any branch. Which configuration is required?

Accepted Answer

Create a CloudWatch Events rule that matches CodeCommit push events and targets the CodePipeline pipeline.. Option D is correct because CodePipeline can use Amazon CloudWatch Events to detect changes in CodeCommit repositories and trigger the pipeline. Option A is wrong because CodePipeline does not have a built-in trigger for branch creation. Option B is wrong because polling is not recommended and may not detect changes immediately. Option C is wrong because CodeCommit does not send SNS notifications for pushes.

Answer

Add a branch creation trigger in CodeCommit that starts the pipeline.

Answer

Create an SNS topic and subscribe the pipeline to it, then configure CodeCommit to publish to the topic on push.

Answer

Configure the pipeline to poll the CodeCommit repository every few minutes.

Question 15

A company uses AWS CodeCommit, CodeBuild, and CodePipeline to manage a multi-module Java application. The pipeline has a single build stage that runs tests and packages the application into a JAR file. Recently, the team split the application into multiple microservices, each in its own CodeCommit repository. They want to create a single pipeline that can build all microservices in parallel and then deploy them together to an Amazon ECS cluster. The pipeline should trigger when any of the repositories receives a push. Currently, the pipeline is configured with a single source stage pointing to one repository. The build stage uses a single build project. The team wants to minimize changes to the existing pipeline structure. What should a DevOps engineer do to achieve this?

Accepted Answer

Add multiple source actions in the source stage, each pointing to a different CodeCommit repository. Configure the build stage to use multiple input artifacts and update the build project to build all modules. Option D is correct because CodePipeline supports multiple source actions in the same stage, and each source can have its own CodeCommit repository. Additionally, CodeBuild can be configured to use multiple input artifacts, allowing the build project to access all repositories. The pipeline trigger can be set to any source change. Option A is wrong because a single source action cannot point to multiple repositories. Option B is wrong because webhooks would require separate pipelines. Option C is wrong because Lambda invocation adds complexity and is not the simplest approach.

Answer

Create a separate pipeline for each microservice and use a webhook to trigger all pipelines on any push

Answer

Create a single source action that uses an S3 bucket as source, and have each repository push to the S3 bucket via a Lambda function

Answer

Create a single source action in CodePipeline that uses a Lambda function to pull from all repositories