DOP-C02 SDLC Automation Practice Test 14 — 15 Questions

Question 1

A DevOps engineer is creating an AWS CloudFormation template to deploy a stack that includes an Amazon EC2 instance. The instance needs to be launched in a specific subnet. How should the engineer reference the subnet ID in the template?

Accepted Answer

Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.. Option C is correct because using a parameter allows the subnet ID to be passed in at stack creation time, making the template reusable. Option A is wrong because hardcoding reduces reusability. Option B is wrong because mappings are for static values, not dynamic IDs. Option D is wrong because the Fn::GetAtt function is used to get attributes of resources created in the same stack, not for parameters.

Answer

Hardcode the subnet ID in the template.

Answer

Use a mapping (Mappings) to define the subnet ID based on the stack name.

Answer

Use the Fn::GetAtt function to retrieve the subnet ID from a VPC resource.

Question 2

A startup is using AWS CodePipeline to deploy a Python web application to AWS Elastic Beanstalk. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (Elastic Beanstalk). The build stage runs unit tests and creates a deployable zip file. The deploy stage uses the Elastic Beanstalk deploy provider. Recently, the deploy stage started failing with the error: 'The API call 'elasticbeanstalk:CreateApplicationVersion' failed with status 403.' The CodePipeline service role has the following permissions: 'elasticbeanstalk:DescribeApplications', 'elasticbeanstalk:DescribeEnvironments', 'elasticbeanstalk:UpdateEnvironment'. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Add the 'elasticbeanstalk:CreateApplicationVersion' and 'elasticbeanstalk:DeleteApplicationVersion' permissions to the CodePipeline service role. Option A is correct because the error indicates the pipeline role lacks permission to create an application version, which is necessary for deployment. Adding elasticbeanstalk:CreateApplicationVersion and related actions will resolve the issue. Option B is wrong because the Elastic Beanstalk service role is for the environment, not the pipeline. Option C is wrong because the pipeline does not need S3 permissions for Elastic Beanstalk deployment. Option D is wrong because the error is about permissions, not environment configuration.

Answer

Change the deploy provider to use CodeDeploy instead of Elastic Beanstalk

Answer

Add 's3:PutObject' permission to the CodePipeline service role to allow it to upload the zip file to S3

Answer

Update the Elastic Beanstalk environment's service role to allow CodePipeline to deploy

Question 3

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project's artifacts are automatically deployed to an Amazon S3 bucket with server-side encryption using AWS KMS? (Choose 2.)

Accepted Answer

In the buildspec.yaml, set the 'artifacts' section to include 'encryptionDisabled: false' and specify the KMS key ID.. Options A and C are correct. Option A ensures the CodeBuild service role has permission to use the KMS key. Option C configures the artifacts to be uploaded with KMS encryption. Option B is wrong because setting the S3 bucket default encryption does not affect CodeBuild uploads if CodeBuild specifies its own encryption. Option D is wrong because encryption in transit (HTTPS) does not relate to server-side encryption. Option E is wrong because enabling versioning does not enforce encryption.

Answer

Enable versioning on the S3 bucket.

Answer

Configure the S3 bucket policy to require HTTPS for all uploads.

Answer

Enable default encryption on the S3 bucket using SSE-KMS.

Question 4

A development team is using AWS CodeCommit as a source control repository. They want to automate the creation of a new feature branch whenever a developer creates a new Jira issue with a specific label. Which AWS service should be used to listen for Jira webhooks and trigger the branch creation?

Accepted Answer

AWS Lambda with Amazon API Gateway to receive the webhook. AWS CodeCommit can be managed through AWS CLI or SDK, but the trigger for webhook events is best handled by AWS Lambda, which can be invoked by Amazon API Gateway or directly via HTTP. AWS CodePipeline is for CI/CD pipelines, not for reacting to external webhooks. Amazon EventBridge can also ingest events, but the simplest integration for custom webhooks is Lambda behind API Gateway. Option D is correct because Lambda can execute code to create a branch in CodeCommit via AWS SDK.

Answer

Amazon EventBridge to schedule a rule every minute

Answer

AWS CodePipeline to poll for new Jira issues

Answer

AWS CodeBuild to run a build when a webhook is received

Question 5

A company uses AWS CodePipeline with multiple stages: source, build, test, and deploy. The test stage takes 45 minutes to complete. Developers complain that the pipeline takes too long to provide feedback. The team wants to run tests in parallel across multiple environments. Which approach should be taken to reduce the pipeline execution time?

Accepted Answer

Configure the test stage with parallel actions in CodePipeline. Running the test stage in parallel across multiple environments can be achieved by using a parallel action group in CodePipeline, which will execute multiple test actions simultaneously. This reduces the overall time from sequential 45 minutes to the longest single test time. Option C is correct. Option A is wrong because building multiple parallel pipelines would increase complexity and resource usage. Option B is wrong because increasing instance size may not improve parallelism. Option D is wrong because CodeBuild cannot parallelize within a single build project without multiple buildspecs.

Answer

Increase the compute capacity of the test environment

Answer

Use AWS CodeBuild batch builds with a single buildspec

Answer

Create multiple pipelines, each running a subset of tests

Question 6

Which THREE steps are required to set up a cross-account CI/CD pipeline where the source stage is in Account A (CodeCommit) and the deploy stage is in Account B (ECS)? (Choose 3.)

Accepted Answer

Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action.. Options A, B, and D are correct. Option A provides cross-account access for CodePipeline in Account A to pull source from Account B. Option B is necessary for the pipeline to deploy to Account B. Option D ensures the pipeline can assume the execution role in Account B. Option C is wrong because KMS keys are not required for cross-account pipelines unless encryption is used. Option E is wrong because S3 buckets are not required for CodeCommit source.

Answer

Configure an AWS KMS key in Account B and share it with Account A for encrypting artifacts.

Answer

Create an S3 bucket in Account B to store the artifacts and grant cross-account access.

Question 7

Which TWO criteria must be met for an AWS CloudFormation stack update to be successful? (Choose 2.)

Accepted Answer

The update template must be valid and must not contain any syntax errors.. Options A and D are correct. Option A is required to update the stack. Option D ensures the template is valid and resources are correctly defined. Option B is wrong because CloudFormation does not require a change set; you can update directly. Option C is wrong because drift detection is not a prerequisite. Option E is wrong because you can update a stack that is in a failed state after a previous update.

Answer

The stack must be in a steady state with no previous failed updates.

Answer

A change set must be created and executed before the update.

Answer

The stack must have no drift detected.

Question 8

An organization is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target group is not configured correctly. Which CodeDeploy component is responsible for registering instances with the load balancer?

Accepted Answer

The AppSpec file hooks section. The AppSpec file's 'hooks' section includes lifecycle hooks like BeforeInstall, AfterInstall, ApplicationStart, etc. One of the hooks is 'BeforeAllowTraffic' and 'AfterAllowTraffic', which are used to manage traffic routing and deregister/register instances with the load balancer. The 'hooks' section in AppSpec contains the script to register/deregister. Option B is correct. Option A is wrong because the deployment group defines the target group, but the registration action is in the AppSpec hooks. Option C is wrong because CodeDeploy agent runs the scripts, but the configuration is in AppSpec. Option D is wrong because the revision contains the application files, not the traffic routing logic.

Answer

The CodeDeploy agent configuration

Answer

The deployment group configuration

Answer

The application revision bundle

Question 9

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack update. The stack contains an AWS::Lambda::Function resource. The update failed with the error 'Resource creation cancelled' after a timeout. The engineer wants to view the logs from the Lambda function during the stack update to diagnose the issue. What should the engineer do?

Accepted Answer

Access the CloudWatch Logs log group for the Lambda function. CloudFormation does not directly capture Lambda function logs. The Lambda function logs are sent to Amazon CloudWatch Logs. The engineer should check the CloudWatch Logs log group for the specific function to see any errors during invocation. Option A is correct. Option B is wrong because the stack events do not include function logs. Option C is wrong because CloudFormation does not log function output. Option D is wrong because CodeBuild is not involved in this scenario.

Answer

Use AWS CodeBuild to build and test the function locally

Answer

Enable detailed CloudFormation logging in the stack template

Answer

Review the CloudFormation stack events in the AWS Management Console

Question 10

A development team is using AWS CodeCommit as a source repository and AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a build stage that runs on AWS CodeBuild. The team wants to automatically trigger the pipeline when changes are pushed to the 'develop' branch of the CodeCommit repository. Which configuration change should be made to the pipeline?

Accepted Answer

Configure the source action to use CodeCommit as the source provider and specify the 'develop' branch.. Option B is correct because CodePipeline can be configured with a source action that uses the 'Amazon S3' (via CodeCommit webhook) or directly with CodeCommit as the source provider, and a cloudwatch event rule is automatically created to trigger the pipeline on changes to the specified branch. Option A is wrong because manual approval is not needed for automatic triggering. Option C is wrong because CodeBuild can be triggered independently, but the pipeline itself needs a source trigger. Option D is wrong because S3 events are not used for CodeCommit.

Answer

Enable S3 event notifications on the repository to invoke the pipeline.

Answer

Add a manual approval action before the build stage.

Answer

Create a CodeBuild webhook on the CodeCommit repository.

Question 11

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline deploys a static website to an S3 bucket. The deployment must ensure that the website is always available and that rollbacks happen automatically if the deployment fails. Which TWO actions should the company take?

Accepted Answer

Use a blue/green deployment strategy with two S3 buckets. To ensure availability during deployment, use a blue/green deployment strategy with two separate buckets (one active, one staging). Automated rollbacks can be achieved by configuring CloudFront to point to the active bucket and using CloudFormation to manage the deployment with rollback triggers. Option A (blue/green with two buckets) is correct because it allows switching traffic after successful deployment. Option D (CloudFormation with rollback configuration) is correct because CloudFormation can automatically roll back on failure. Option B is wrong because versioning alone doesn't provide zero-downtime switching. Option C is wrong because it doesn't specify a rollback mechanism. Option E is wrong because Route53 weighted routing can be used but is more complex and not the best practice.

Answer

Use Amazon Route53 weighted routing to shift traffic

Answer

Use AWS CodeDeploy with an in-place deployment

Answer

Enable S3 bucket versioning to keep multiple versions

Question 12

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The deployment consistently fails because the Lambda function's IAM role is not created before the function. The team uses a single CloudFormation template. Which action should be taken to resolve this dependency issue?

Accepted Answer

Add a DependsOn attribute in the CloudFormation template to ensure the IAM role is created before the Lambda function.. Option A is correct because CloudFormation handles resource dependencies via the DependsOn attribute. The issue is that the template likely lacks a DependsOn on the Lambda function resource to wait for the IAM role. Adding DependsOn ensures the role is created first. Option B is wrong because nested stacks add complexity but don't inherently fix dependency ordering. Option C is wrong because the role should be in the same template. Option D is wrong because wait conditions are for external signals, not resource dependencies.

Answer

Create the IAM role in a separate CodeBuild action before the deploy stage.

Answer

Add a wait condition in the CloudFormation template.

Answer

Separate the IAM role into a nested stack and reference it.

Question 13

An IAM policy is attached to a service role used by AWS CodePipeline. Which TWO statements about this policy are correct?

Accepted Answer

The policy allows starting a pipeline execution. The policy allows codepipeline:StartPipelineExecution and codepipeline:PutJobSuccessResult, PutJobFailureResult. These actions are used by custom actions or Lambda functions to report job status. However, CodePipeline itself does not call StartPipelineExecution; it's used by external triggers. The policy does not allow codepipeline:UpdatePipeline, so updating the pipeline definition is not allowed. Option B is correct: the policy allows reporting success or failure of a job. Option D is correct: the policy allows starting a pipeline execution. Option A is wrong because codebuild:StartBuild is allowed only for the specific project. Option C is wrong because s3:PutObject is allowed for the artifact bucket, but s3:GetObject is also allowed. Option E is wrong because updating the pipeline is not allowed.

Answer

The policy allows updating the pipeline definition

Answer

The policy allows starting any CodeBuild project

Answer

The policy allows reading and writing objects to any S3 bucket

Question 14

A DevOps engineer is setting up a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build environment requires specific software packages that are not available in the default CodeBuild environment. What is the MOST efficient way to customize the build environment?

Accepted Answer

Create a custom Docker image with the required software and push it to Amazon ECR.. Option B is correct because using a custom Docker image with pre-installed software is the most efficient and repeatable way. Option A is wrong because install commands increase build time and are error-prone. Option C is wrong because buildspec is not for environment customization. Option D is wrong because a separate pipeline is unnecessary.

Answer

Create a separate pipeline to pre-build the environment.

Answer

Add install commands in the buildspec file to install the packages during each build.

Answer

Modify the buildspec file to set environment variables that include the software packages.

Question 15

A DevOps team is implementing a CI/CD pipeline for a microservices architecture. Each microservice is built and deployed independently. The team wants to ensure that only one build runs per microservice at a time to avoid resource contention, and that the build artifacts are stored securely. Which THREE steps should the team take?

Accepted Answer

Enable versioning on the S3 bucket storing build artifacts. To ensure only one build per microservice at a time, use a concurrency limit in CodePipeline or CodeBuild. CodeBuild supports batch builds and concurrency settings. Secure storage of artifacts can be achieved by encrypting the S3 bucket where artifacts are stored and enabling versioning to retain history. Option A (concurrency limit) is correct. Option C (encrypt artifacts bucket) is correct. Option E (enable versioning on artifacts bucket) is correct. Option B is wrong because separate pipelines are not necessary for concurrency control. Option D is wrong because CodeArtifact is for package management, not build artifacts.

Answer

Store build artifacts in AWS CodeArtifact

Answer

Create a separate CodePipeline for each microservice