DOP-C02 SDLC Automation Practice Test 14 — 15 Questions

Question 1

A company uses AWS CodePipeline to automate deployments. The pipeline consists of Source, Build, and Deploy stages. The Build stage uses CodeBuild, and the Deploy stage uses CodeDeploy. Recently, the pipeline failed at the Deploy stage with an error: 'The deployment group does not exist'. Which TWO actions should the team take to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the deployment group name specified in the pipeline's Deploy stage matches the actual deployment group name in CodeDeploy.. The error 'The deployment group does not exist' directly indicates a mismatch between the deployment group name specified in the CodePipeline Deploy stage configuration and the actual deployment group name defined in CodeDeploy. The pipeline's Deploy stage action references a deployment group by name; if that name does not match an existing group in CodeDeploy, the deployment fails. Verifying and correcting this name resolves the issue.

Answer

Increase the timeout for the Deploy stage to allow more time for the deployment group to be created.

Answer

Ensure that the CodeBuild project has permissions to access the CodeDeploy deployment group.

Answer

Check that the CodeDeploy application exists in the same AWS account as the pipeline.

Question 2

A company uses AWS CloudFormation with nested stacks to manage a microservices application. The root stack creates a VPC, and nested stacks create ECS services. A developer updates the root stack, but the update fails with 'UPDATE_ROLLBACK_IN_PROGRESS'. The rollback also fails. Which THREE steps should the team take to recover the stack? (Choose THREE.)

Accepted Answer

Use the 'SignalResource' action to send a success signal to the failed resource if it is a custom resource.. If a custom resource failed during rollback due to a missing success signal, sending a success signal via 'SignalResource' can allow the rollback to proceed. Option D is correct because 'ContinueUpdateRollback' resumes the failed rollback, skipping the problematic resource. Option E is correct because if a resource cannot be deleted (e.g., non-empty S3 bucket), manually fixing it allows the rollback to continue. Option A is incorrect because a stack policy does not fix rollback failures. Option C is incorrect because manually deleting a nested stack outside CloudFormation causes drift and does not resolve the rollback state.

Answer

Set the stack policy to allow all updates and retry the update.

Answer

Manually delete the failed nested stack from the AWS CloudFormation console.

Question 3

A DevOps team uses AWS OpsWorks for Chef Automate to manage configuration. They want to ensure that all EC2 instances automatically register with OpsWorks and are assigned to the correct layer. Which THREE steps are required? (Choose THREE.)

Accepted Answer

Install the AWS OpsWorks agent on each EC2 instance.. The AWS OpsWorks agent is required on each EC2 instance to communicate with the OpsWorks service. The agent handles lifecycle events (setup, configure, deploy, shutdown) and runs Chef runs as directed by the OpsWorks stack. Without the agent, the instance cannot register or participate in the OpsWorks management plane.

Answer

Configure the instance's user data to run the Chef client.

Answer

Attach an IAM role with the AmazonEC2RoleforOpsWorks policy to the EC2 instance.

Question 4

The exhibit shows the output of the AWS CLI command 'batch-get-builds' for a CodeBuild build. The build failed. What is the most likely cause of the failure?

Accepted Answer

The S3 bucket 'my-bucket' does not exist or the build project lacks permissions to access it.. The `batch-get-builds` output shows a failure in the DOWNLOAD_SOURCE phase, with an error indicating that the build could not access the S3 bucket `my-bucket`. The error details, such as 'Access Denied' or 'NoSuchBucket', imply that the CodeBuild service role lacks the required `s3:GetObject` permission on the bucket, or the bucket does not exist. This is a common misconfiguration when the source code is stored in an S3 bucket and the build project is not properly configured to retrieve it.

Answer

The source code has compilation errors.

Answer

The buildspec file is malformed.

Answer

The build project does not have sufficient memory.

Question 5

The exhibit shows an IAM policy attached to an AWS Lambda execution role. The Lambda function is triggered by an S3 event and writes to the same bucket. However, the function fails with a permission error when trying to write to 'my-bucket'. What is the likely issue?

Accepted Answer

The policy grants s3:PutObject only on objects (my-bucket/*), but the action also requires permission on the bucket (my-bucket) for certain operations like s3:PutObject with ACLs.. The provided explanation falsely claims that s3:PutObject with ACLs or cross-account access requires additional permission on the bucket resource. In AWS, s3:PutObject is an object-level action; the ARN used is the object ARN. If the Lambda function fails to write, likely causes include missing s3:PutObjectAcl (if setting an ACL), missing kms:GenerateDataKey (if using SSE-KMS), or an explicit bucket policy denial. Option D is not the correct answer.

Answer

The S3 bucket is in a different region than the Lambda function.

Answer

The policy is missing the 'lambda:InvokeFunction' permission on the function itself.

Answer

The Lambda function does not have an S3 trigger configured.

Question 6

The exhibit shows a CloudFormation stack event. The stack creation failed with 'Resource creation cancelled'. What is the most likely reason for this cancellation?

Accepted Answer

The stack was manually cancelled by a user or an automation script.. The 'Resource creation cancelled' event in a CloudFormation stack creation indicates that the operation was explicitly halted by a user or an automation script (e.g., via the AWS CLI, Console, or SDK). This is distinct from a timeout or permission error, which would produce different error messages such as 'Resource creation timed out' or 'API: cloudformation:CreateStack Access Denied'.

Answer

The stack template contains a syntax error.

Answer

The IAM role used for stack operations lacks permissions.

Answer

A stack creation timeout was reached.

Question 7

A DevOps team is using AWS CodePipeline to automate build, test, and deploy phases. The team notices that the pipeline is failing intermittently during the deploy stage due to a timeout when updating an Auto Scaling group. The deploy stage uses CodeDeploy with a blue/green deployment configuration. What is the MOST likely cause and solution?

Accepted Answer

The CodeDeploy deployment group has a low original revision timeout. Increase the original revision timeout.. The intermittent timeout during the deploy stage when updating an Auto Scaling group with a blue/green deployment is most likely caused by the CodeDeploy deployment group's original revision timeout being too low. This timeout controls how long CodeDeploy waits for the new instances in the green environment to become healthy and complete their lifecycle hooks before considering the original revision as failed. Increasing this timeout allows sufficient time for instance initialization, application deployment, and health checks, resolving the intermittent failures.

Answer

The CloudFormation stack update is failing. Update the stack with a longer timeout.

Answer

The CodeCommit repository has too many branches. Clean up unused branches.

Answer

The CodeBuild project has a low build timeout. Increase the build timeout.

Question 8

An organization uses AWS CodeBuild to compile a Java application. The buildspec.yml includes a pre_build phase that runs unit tests. Recently, the build started failing with 'NoClassDefFoundError' for certain test dependencies, even though the pom.xml includes them. The build environment uses an Amazon Linux 2 Docker image. What is the MOST likely cause?

Accepted Answer

The CodeBuild project has a cache that is corrupted or out of sync. Clear the build cache.. The 'NoClassDefFoundError' for test dependencies that are declared in pom.xml indicates that the required JAR files are missing from the build environment at runtime. A corrupted or out-of-sync build cache in CodeBuild can cause previously downloaded Maven dependencies to be reused incorrectly, leading to missing classes even though the pom.xml specifies them. Clearing the cache forces a fresh download of all dependencies, resolving the mismatch.

Answer

The S3 bucket for artifacts has incorrect permissions. Update the bucket policy.

Answer

The CodeCommit repository is not pulling the latest code. Add a webhook to trigger builds on push.

Answer

The build environment does not have Maven installed. Install Maven in the buildspec.

Question 9

A company uses AWS CloudFormation to manage infrastructure. The DevOps team wants to deploy a stack across multiple accounts using AWS CodePipeline. Which approach is BEST for automating cross-account deployments?

Accepted Answer

Use a single pipeline in the management account with IAM roles that assume cross-account roles.. AWS CodePipeline can assume an IAM role in the target account (via a cross-account role) to perform CloudFormation deployments. This allows a single pipeline in the management account to automate deployments across multiple accounts without manual triggers or separate pipelines, adhering to the principle of least privilege and centralized control.

Answer

Use AWS CloudFormation StackSets to deploy the stack across accounts.

Answer

Create a separate pipeline in each account and trigger them manually.

Answer

Use an S3 bucket with cross-account access and Lambda to invoke CloudFormation.

Question 10

A company uses AWS CodeCommit for source control. Developers report that their local branches are out of sync with the remote repository, and they are unable to push changes because of 'non-fast-forward' errors. What should the developers do to fix this?

Accepted Answer

Pull the latest changes using 'git pull --rebase' and then push.. A 'non-fast-forward' error occurs when the remote branch has commits that are not in the local branch. Using 'git pull --rebase' fetches the latest changes from the remote and replays local commits on top, allowing a clean fast-forward push. Option A is wrong because creating a new branch does not resolve the underlying divergence; it simply avoids the conflict without integrating changes. Option B is wrong because 'git push --force' overwrites remote commits, potentially losing work from other developers. Option D is wrong because deleting the remote branch is drastic and unnecessary; it would require recreating the branch and losing history.

Answer

Create a new branch and push that instead.

Answer

Use 'git push --force' to overwrite the remote branch.

Answer

Delete the remote branch and push again.

Question 11

A DevOps team is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a Source stage using CodeCommit, a Build stage using CodeBuild, and a Deploy stage using CloudFormation. The team wants to add manual approval before the Deploy stage for production deployments. How should this be configured?

Accepted Answer

Add an Approval stage to the pipeline with SNS topic for notification.. AWS CodePipeline natively supports Approval stages that can be configured to pause the pipeline and send a notification via an SNS topic. The SNS topic can be subscribed to by email, SMS, or other endpoints, allowing a manual approver to review the build output and then approve or reject the transition to the Deploy stage. This directly meets the requirement for a manual approval gate before production deployment without custom code or separate pipelines.

Answer

Configure a CloudWatch event to send an email on build success.

Answer

Use a Lambda function to approve based on build status.

Answer

Create a separate pipeline for production and trigger it manually.

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment fails with a '502 Bad Gateway' error. The developer checks the logs and sees that the application is running but returns errors. The environment uses a load balancer. What is the MOST likely cause?

Accepted Answer

The application is not binding to the correct port or is crashing under load.. A 502 Bad Gateway error from an Elastic Beanstalk environment with a load balancer typically indicates that the reverse proxy (nginx or Apache) is unable to communicate with the application process. Since the logs show the application is running but returning errors, the most likely cause is that the application is not binding to the correct port (expected port 8080 by default) or is crashing under load, causing the proxy to receive no valid response and return a 502.

Answer

The application source bundle is missing a required file.

Answer

The security group of the environment does not allow inbound HTTP traffic.

Answer

The environment's environment variables are misconfigured.

Question 13

A DevOps engineer needs to automate the creation of a new AWS CodeCommit repository when a new project starts. The engineer wants to use infrastructure as code. Which service should be used?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define and provision AWS infrastructure as code using templates. You can declare an AWS::CodeCommit::Repository resource in a CloudFormation template, which will automatically create the CodeCommit repository when the stack is created, enabling fully automated and repeatable infrastructure deployment.

Answer

AWS CodePipeline

Answer

AWS CodeStar

Answer

AWS CodeBuild

Question 14

An organization uses AWS CodeDeploy for automated deployments to EC2 instances. The deployment is failing with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum healthy hosts setting of 75%. The application has 4 instances. What is the MOST likely issue?

Accepted Answer

The deployment failed on 2 instances, leaving only 2 healthy.. With a minimum healthy hosts setting of 75% and 4 instances, at least 3 instances must remain healthy during deployment. If 2 instances fail, only 2 are healthy (50%), which falls below the 75% threshold, causing CodeDeploy to abort the deployment to prevent further impact. This error message directly corresponds to the healthy host count dropping below the configured minimum.

Answer

The AppSpec file references a script that does not exist.

Answer

The IAM instance profile does not have sufficient permissions.

Answer

The CodeDeploy agent is not installed on any of the instances.

Question 15

A company uses AWS CodePipeline with a cross-account action where the source account (Account A) triggers a deploy action in a target account (Account B). The pipeline is failing with an 'Access Denied' error when trying to assume the deployment role. What is the MOST likely cause?

Accepted Answer

The KMS key used to encrypt artifacts is not shared with Account B.. In a cross-account CodePipeline setup, if the source account (Account A) uses a KMS key to encrypt artifacts in the S3 bucket, the target account (Account B) must have access to that KMS key to decrypt the artifacts during the deploy action. Without the KMS key being shared via a cross-account key policy that grants the deployment role in Account B the `kms:Decrypt` permission, the pipeline fails with an 'Access Denied' error when attempting to assume the deployment role, because the role assumption process itself may require decrypting pipeline metadata or artifacts.

Answer

The S3 artifact bucket in Account A does not have a bucket policy allowing Account B.

Answer

The deployment role in Account B does not exist.

Answer

The CloudFormation service role in Account B is missing.