DOP-C02 SDLC Automation Practice Test 14 — 15 Questions

Question 1

A company is using AWS CodeCommit for source control and wants to automatically trigger a build in AWS CodeBuild whenever a pull request is created against the main branch. Which AWS service should be used to connect CodeCommit events to CodeBuild?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon EventBridge. Amazon EventBridge is the correct choice because it can capture CodeCommit repository events (such as pull request creation) via a default event bus and route them to targets like CodeBuild. This allows you to define a rule that matches the 'codecommit: PullRequestCreated' event and triggers a CodeBuild project directly, without needing an intermediary pipeline or compute service.

Answer

AWS CodePipeline

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 2

A DevOps team is designing a CI/CD pipeline for a microservices application. Each microservice has its own CodeCommit repository and must be built and deployed independently. The team wants to minimize manual configuration and ensure that adding a new microservice automatically creates the corresponding pipeline stages. Which approach should the team use?

Accepted Answer

Define a CloudFormation template that creates a pipeline for a given repository and invoke it automatically when a new repository is created using EventBridge and Lambda.. It uses an event-driven approach: EventBridge detects the creation of a new CodeCommit repository, triggers a Lambda function that invokes a CloudFormation template to create a corresponding CodePipeline. This fully automates pipeline provisioning for new microservices without manual intervention, aligning with the requirement to minimize manual configuration.

Answer

Create a separate AWS CodePipeline for each microservice manually using the AWS Management Console.

Answer

Use the AWS Cloud Development Kit (CDK) to define a pipeline that dynamically discovers repositories.

Answer

Use a single AWS CodePipeline with multiple stages, each triggered by a different branch of the same repository.

Question 3

A development team uses AWS CodeBuild to run unit tests on every commit to the develop branch. The tests take a long time because they download dependencies each time. What should the team do to reduce build time?

Accepted Answer

Enable the local cache feature in CodeBuild.. Enabling the local cache feature in CodeBuild allows the build environment to cache dependencies, such as Maven or npm packages, in a local directory that persists across builds. This avoids re-downloading unchanged dependencies on every commit, significantly reducing build time. The cache can be stored in an S3 bucket or locally on the build instance, and is automatically restored at the start of each build.

Answer

Store dependencies in Amazon Elastic File System (EFS) and mount it during builds.

Answer

Increase the compute type of the build environment.

Answer

Use multiple builds in parallel for the same commit.

Question 4

A team uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests against a staging environment. Occasionally, the tests fail due to environment issues, not code issues. The team wants to automatically retry the Test stage up to two times if it fails, but not the Deploy stage. How can this be achieved?

Accepted Answer

Create a CloudWatch Events rule that triggers a Lambda function to retry the failed stage.. The correct approach is to use Amazon EventBridge (formerly CloudWatch Events) to detect a stage failure in CodePipeline and trigger an AWS Lambda function that calls the RetryStageExecution API. This provides automatic retries without manual intervention. CodePipeline's built-in retry setting on a stage action is not automatic; it only allows manual retries via the console or API. Option D (Step Functions) is a valid alternative but adds unnecessary complexity for this use case.

Answer

Configure the Retry setting in the Test stage's action configuration.

Answer

Enable the 'Retry on failure' option in the CodePipeline pipeline settings.

Answer

Use AWS Step Functions to orchestrate the pipeline and implement retries.

Question 5

A company wants to ensure that all code changes are reviewed before being merged to the main branch in AWS CodeCommit. Which feature should be enabled?

Accepted Answer

Create an approval rule template and associate it with the main branch.. AWS CodeCommit does not natively support branch protection rules like GitHub or GitLab. Instead, you must create an approval rule template and associate it with the main branch to require at least one approved pull request before merging. This ensures all code changes are reviewed before being merged to the main branch.

Answer

Configure a Lambda function to validate commits and block pushes.

Answer

Enable branch protection rules on the repository.

Answer

Use CloudWatch Events to notify when a push occurs.

Question 6

During a deployment using AWS CodeDeploy, the deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment group is configured with a minimum healthy instances of 75%. What could be the cause?

Accepted Answer

More than 25% of the instances failed the deployment.. The error message explicitly states that too many individual instances failed deployment and too few healthy instances are available. With a minimum healthy instances setting of 75%, the deployment fails when more than 25% of the instances in the deployment group fail their deployment. This is a built-in safety mechanism in AWS CodeDeploy to prevent cascading failures and ensure application availability.

Answer

The deployment configuration timeout is too short.

Answer

The CodeDeploy service role does not have sufficient permissions.

Answer

The instances are not running the CodeDeploy agent.

Question 7

A developer is troubleshooting a failed CodeBuild build. The build is triggered by a pull request from a forked repository. The buildspec includes a command to fetch pull request references. What is the most likely cause of the failure?

Accepted Answer

The CodeBuild project is not configured to allow pull requests from forked repositories.. When a build is triggered by a pull request from a forked repository, CodeBuild requires explicit configuration to allow builds from forks. By default, CodeBuild projects do not accept webhook events from forked repositories. The error occurs because the project lacks the 'Allow pull requests from forked repositories' setting enabled, even though the IAM role and buildspec may be correctly configured.

Answer

The IAM role for CodeBuild does not have permission to read from the repository.

Answer

The buildspec file is not present in the source code.

Answer

The buildspec contains invalid syntax.

Question 8

A DevOps engineer is setting up a CI/CD pipeline for a Node.js application. The application must be built, tested, and deployed to an Amazon ECS cluster. The team wants to use AWS CodeBuild to run unit tests and package the application as a Docker image, and AWS CodePipeline to orchestrate the workflow. Which artifact type should CodeBuild output to be used by a subsequent CodePipeline action?

Accepted Answer

A JSON file with the image details.. CodePipeline's ECS deploy action requires an input artifact containing an imagedefinitions.json file that specifies the image URI. CodeBuild should produce this JSON file as its output artifact, not merely push the image to ECR. The subsequent deploy action reads the JSON file to determine which image to use, so the correct artifact type is a JSON file with image details.

Answer

A Docker image pushed to Amazon ECR.

Answer

A zip file containing the application source code.

Answer

A tarball stored in Amazon S3.

Question 9

A company uses AWS CodePipeline with a GitHub source action. They want to automatically start the pipeline when a pull request is merged to the main branch. However, the pipeline also starts on every push to any branch. How can they limit the pipeline to only trigger on push events to the main branch?

Accepted Answer

Configure the source action's 'Branch' field to 'main' and set 'PollForSourceChanges' to false, and use a webhook with filters.. It configures the source action to only respond to push events on the main branch by setting the 'Branch' field to 'main' and disabling polling ('PollForSourceChanges': false), while using a webhook with branch filters. This ensures that only pushes to the main branch trigger the pipeline, not pushes to any other branch.

Answer

Use a Lambda function as a source action instead of GitHub.

Answer

Create a GitHub webhook manually and point it to a Lambda function that starts the pipeline only for main branch pushes.

Answer

Add a condition in the pipeline's first stage to check the branch name.

Question 10

A team uses AWS CodeBuild to run security scans on code before deployment. They want to ensure that if the security scan fails, the build is marked as FAILED and no further pipeline stages execute. What should they add to the buildspec?

Accepted Answer

Use the 'phases' section with a command that exits with a non-zero status on failure.. In AWS CodeBuild, the build process is controlled by the 'phases' section of the buildspec file. Each phase runs a series of commands sequentially, and if any command exits with a non-zero status (e.g., a security scan tool returns a failure exit code), CodeBuild immediately marks the build as FAILED and stops further execution. This ensures that no subsequent pipeline stages are triggered, as the build status propagates to the pipeline.

Answer

Use the 'artifacts' section to define failure conditions.

Answer

Use the 'env' section to set a variable that fails the build.

Answer

Use the 'reports' section to mark the build as failed if tests fail.

Question 11

A development team is using AWS CodeCommit as a source control repository. They want to automate code builds and run unit tests every time a developer pushes code to the 'develop' branch. Which AWS service should they use to trigger the build automatically?

Accepted Answer

Create an AWS CodePipeline with CodeCommit as source and CodeBuild as build stage, configured to start on source changes.. AWS CodePipeline can be configured with CodeCommit as the source stage and CodeBuild as the build stage, and by enabling the 'Amazon CloudWatch Events' trigger on the pipeline, it automatically starts whenever a change is pushed to the specified branch (e.g., 'develop'). This is the native, fully managed way to achieve continuous integration without custom scripting or additional services.

Answer

Set up AWS CodeDeploy to run builds on code push.

Answer

Configure AWS CodeCommit to invoke AWS CodeBuild directly.

Answer

Use Amazon CloudWatch Events to detect a push to CodeCommit and trigger AWS CodeBuild.

Question 12

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must deploy to Amazon ECS using blue/green deployments. The team wants to automatically roll back if the new deployment fails health checks. Which combination of AWS services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with an ECS compute platform, configure a CloudWatch alarm for health checks, and enable automatic rollback.. AWS CodeDeploy with an ECS compute platform natively supports blue/green deployments for Amazon ECS, including automatic rollback triggered by CloudWatch alarms. By configuring a CloudWatch alarm based on ECS service health checks (e.g., ELB target group health), CodeDeploy can automatically revert to the original blue task set if the new green deployment fails, meeting the requirement for zero-touch rollback.

Answer

Use AWS CloudFormation with a custom resource to perform blue/green deployment.

Answer

Use AWS Elastic Beanstalk with blue/green environment swapping.

Answer

Use AWS CodePipeline with ECS deployment action and manual approval for rollback.

Question 13

A company is using AWS CodeBuild to run integration tests. The tests require access to an Amazon RDS instance in a private subnet. The CodeBuild project is configured with a VPC ID, subnet IDs, and security group IDs. However, the tests fail with a connection timeout. What is the MOST likely cause?

Accepted Answer

The security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group.. The most likely cause is that the security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group. CodeBuild runs inside the VPC using the specified security group, so it sends traffic to the RDS instance on port 3306 (or the appropriate database port). If the RDS security group's inbound rules do not explicitly permit traffic from the CodeBuild security group (or its CIDR), the connection is dropped, resulting in a timeout.

Answer

The CodeBuild project does not have internet access to download packages.

Answer

The CodeBuild project is not associated with a VPC.

Answer

The RDS instance is not publicly accessible and requires a NAT gateway.

Question 14

A company has a CI/CD pipeline that deploys to Amazon ECS using AWS CodePipeline. The pipeline includes a manual approval step before deployment to production. The security team requires that all approvals be logged in AWS CloudTrail and that the approver's identity be verified. Which action should the DevOps engineer take to meet these requirements?

Accepted Answer

Ensure that the manual approval action is configured as a CodePipeline approval action; CloudTrail will log the 'Approval' event with the IAM user ARN.. CodePipeline's manual approval action inherently generates an 'Approval' event in CloudTrail when an approver approves or rejects the action. This event includes the IAM user ARN of the approver, satisfying both the logging and identity verification requirements without additional configuration.

Answer

Create a custom CloudTrail trail specifically for CodePipeline API calls.

Answer

Enable CloudTrail Insights to detect unusual approval activity.

Answer

Configure the approval action to send a notification to an Amazon SNS topic, and log the SNS delivery to CloudWatch Logs.

Question 15

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The pipeline includes a build stage that runs 'npm install' and 'npm test'. The team notices that the build stage often fails due to network timeouts when downloading npm packages. Which action would MOST reliably resolve this issue?

Accepted Answer

Configure the CodeBuild project to use a VPC with a NAT gateway to the internet.. The network timeouts occur because the CodeBuild project lacks outbound internet access to reach the npm registry. By configuring the CodeBuild project to use a VPC with a NAT gateway, you provide a stable, routable path to the internet via the NAT gateway's elastic IP, eliminating intermittent connectivity issues caused by relying on public endpoints through a non-VPC network path.

Answer

Use a custom Docker image that includes pre-installed npm packages.

Answer

Enable local dependency caching in the buildspec file.

Answer

Increase the build timeout to the maximum value.