DOP-C02 SDLC Automation Practice Test 15 — 15 Questions

Question 1

A DevOps team is designing a CI/CD pipeline for a microservices application that runs on Amazon ECS. They need to implement automated canary deployments. Which TWO AWS services would be essential for this implementation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is essential because it natively supports canary deployments for Amazon ECS through its ECS blue/green deployment type, allowing you to specify a canary traffic shift (e.g., 10% for 5 minutes) before full promotion. This enables automated, controlled rollouts with built-in rollback capabilities based on CloudWatch alarms.

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Answer

Amazon EC2 Auto Scaling

Question 2

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline includes a build stage that runs 'sam build' and a deploy stage that runs 'sam deploy'. The team wants to automatically test the deployed application before promoting it to production. Which THREE steps should be included in the pipeline?

Accepted Answer

Add a stage that runs a performance or load test.. Adding a performance or load test stage after deployment validates that the serverless application can handle expected traffic volumes under AWS SAM's provisioned concurrency and scaling limits. This ensures the application meets non-functional requirements before promotion, catching issues like cold start latency or throttling that unit tests miss.

Answer

Add a stage that automatically rolls back the deployment if tests fail.

Answer

Add a stage that deploys the application to a separate production environment.

Question 3

A company is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The buildspec.yaml includes commands to build and tag the image. However, the push to ECR fails with an authentication error. Which TWO actions should the DevOps engineer take to resolve this?

Accepted Answer

Add a command in the buildspec to run 'aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com'.. The `aws ecr get-login-password` command retrieves a temporary authentication token from the ECR service, which is then piped to `docker login` to authenticate the Docker client against the private ECR registry. This is the standard AWS-recommended method for authenticating Docker to ECR in automated build environments like CodeBuild, as it avoids hardcoding long-lived credentials.

Answer

Configure the ECR repository as public.

Answer

Create an ECR lifecycle policy to expire untagged images.

Answer

Run 'docker login' with ECR credentials in the buildspec.

Question 4

A DevOps team uses AWS CodePipeline with a multi-branch strategy. The pipeline should deploy to production only from the 'main' branch, but run unit tests for all branches. How should the team configure the pipeline?

Accepted Answer

Configure the pipeline source stage to trigger on all branches, use branch-specific logic in the test stage, and add a manual approval step for production deployment only when the branch is 'main'.. AWS CodePipeline supports branch filtering in the source stage to trigger on all branches, and you can use a condition in the deploy stage (e.g., via a Lambda function or a manual approval step) to restrict production deployment to the 'main' branch only. This approach avoids duplicating pipelines while ensuring unit tests run for every branch, meeting the multi-branch strategy requirement efficiently.

Answer

Use an AWS Lambda function to check the branch name and invoke different CodePipeline executions for testing and deployment.

Answer

Create one pipeline with two source stages: one for 'main' and one for all other branches, each with its own test and deploy actions.

Answer

Create a separate pipeline for each branch, each with identical test and deploy stages.

Question 5

A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?

Accepted Answer

The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).. CodeBuild's security group outbound rules must explicitly allow traffic to the RDS security group on the database port (e.g., 3306 for MySQL). Even though CodeBuild runs in a VPC, if the outbound rules are too restrictive, the build agent cannot establish a TCP connection to the RDS instance, causing a timeout. The security group acts as a virtual firewall for the CodeBuild ENI, and without a matching outbound rule, packets are dropped.

Answer

CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.

Answer

The CodeBuild service role does not have rds:Connect permission.

Answer

The RDS instance is in a different subnet CIDR than CodeBuild's subnet.

Question 6

A development team uses AWS CodeCommit for source control. They want to enforce that all commits include a JIRA issue key in the commit message. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function on every push to validate commit messages.. CodeCommit triggers can invoke an AWS Lambda function on every push event, allowing real-time validation of commit messages against a required pattern (e.g., JIRA issue key). This serverless approach enforces the policy centrally without relying on client-side configurations, making it the most efficient and reliable method for a team using AWS CodeCommit.

Answer

Use Amazon CloudWatch Events to detect new commits and invoke a Lambda function to validate the commit message.

Answer

Implement a pre-commit hook in each developer's local repository.

Answer

Configure a branch policy on the repository that requires commit message format.

Question 7

A company runs a critical application on Amazon ECS with Fargate. They use blue/green deployments via AWS CodeDeploy. During a recent deployment, the new task set failed health checks and CodeDeploy automatically rolled back. However, the old task set also became unhealthy shortly after rollback. What could explain this?

Accepted Answer

The new application version changed the database schema, which broke the old version after rollback.. A backward-incompatible database schema change (e.g., a column removal or renaming) applied by the new application version can corrupt or invalidate the data that the old version relies on. When CodeDeploy rolls back to the old task set, the old application cannot function correctly with the altered schema, causing it to fail health checks. This is a classic rollback failure scenario where the deployment changes shared state (the database) that persists beyond the task set lifecycle.

Answer

The CloudWatch alarm that triggered the rollback also stopped the old task set.

Answer

CodeDeploy did not drain connections from the Application Load Balancer before terminating the old task set.

Answer

The ECS service auto-scaling policy reduced the desired count of the old task set during the deployment.

Question 8

A team wants to automate the creation of a CI/CD pipeline using a JSON/YAML file that defines source, build, and deploy stages. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define infrastructure as code (IaC) using JSON or YAML templates, which can include the creation of a CI/CD pipeline by defining resources like AWS CodePipeline, CodeBuild, and CodeDeploy. This enables full automation of the pipeline's source, build, and deploy stages through a declarative template, rather than manually configuring each service. The question specifically asks for automating the creation of the pipeline itself using a JSON/YAML file, which is exactly what CloudFormation does.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Question 9

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline triggers on changes to the S3 bucket. However, the pipeline does not trigger when a new object is uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to invoke the pipeline.. CodePipeline does not automatically monitor S3 buckets for new objects. To trigger a pipeline on S3 events, you must explicitly configure an S3 event notification (e.g., s3:ObjectCreated:Put) that sends the event to CloudWatch Events or directly to CodePipeline via Amazon EventBridge. Without this notification, the pipeline will not start when a new object is uploaded.

Answer

The S3 bucket policy denies the CodePipeline service role.

Answer

The S3 bucket is in a different AWS Region than the pipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 10

A company uses AWS CodeBuild to run builds for a Java application. The buildspec includes a 'mvn test' command. The build succeeds but the tests fail. The team wants to fail the build if any test fails. What should they do?

Accepted Answer

Ensure the buildspec's 'build' phase includes the test command and that the command returns a non-zero exit code on failure.. CodeBuild determines build success or failure based on the exit code of commands in the buildspec. The 'mvn test' command returns a non-zero exit code when tests fail, which causes the build to fail if placed in the 'build' phase. By ensuring the test command is in the 'build' phase and not suppressed (e.g., with '|| true'), the build will fail on test failure.

Answer

Add a 'post_build' phase that fails the build if tests fail.

Answer

Add a 'test' phase in the buildspec before the 'build' phase.

Answer

Configure the build project to use batch builds.

Question 11

A team wants to automatically deploy a new version of a Lambda function when code is pushed to a CodeCommit repository. Which AWS service should orchestrate this workflow?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the entire release process, including source code changes from CodeCommit, building with CodeBuild, and deploying to Lambda. It can automatically trigger a pipeline execution when a new commit is pushed to a CodeCommit repository, enabling automated deployment of the Lambda function.

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Question 12

A DevOps engineer is designing a CI/CD pipeline for a microservices architecture. The pipeline must ensure that only code that passes security scanning can proceed to deployment. Which TWO actions should the engineer take? (Choose TWO.)

Accepted Answer

Add a security scanning stage in the pipeline after the build stage and before the deploy stage.. Integrating a security scanning stage after the build stage and before the deploy stage ensures that only code that has passed security checks proceeds to deployment. This aligns with the principle of shifting security left in the CI/CD pipeline, preventing vulnerable artifacts from reaching production environments.

Answer

Use Amazon CloudWatch Events to trigger a rollback if vulnerabilities are found after deployment.

Answer

Use AWS CodeDeploy to perform security scanning during deployment.

Answer

Configure the pipeline to run security scanning only in the deploy stage.

Question 13

A company uses AWS CloudFormation to deploy a multi-tier application. The stack creation fails with a 'CREATE_FAILED' error for a resource. The engineer wants to troubleshoot the issue. Which TWO steps should the engineer take? (Choose TWO.)

Accepted Answer

Use the 'describe-stack-events' AWS CLI command to view the events.. The 'describe-stack-events' AWS CLI command retrieves all stack events, including the specific event for the failed resource. This event contains the 'ResourceStatusReason' field, which provides the detailed error message from CloudFormation explaining why the resource creation failed. Option C is correct because checking the 'ResourceStatusReason' field in the stack events directly reveals the underlying error. Option B is incorrect because CloudFormation does not automatically create a CloudWatch Logs log group for stack errors; resource-specific logs are only available if the resource itself writes to CloudWatch. During a stack creation failure, there may be no such logs to review. Option D is incorrect because deleting the stack would lose the event history and prevent effective troubleshooting. Option E is incorrect because 'describe-stacks' only returns stack outputs and status, not failure details.

Answer

Review the CloudWatch Logs log group for the stack to find detailed error logs.

Answer

Run 'delete-stack' to remove the failed stack and start over.

Answer

Use the 'describe-stacks' AWS CLI command to get the stack outputs.

Question 14

A team uses AWS CodeBuild to build a Node.js application. The buildspec.yml file is at the root of the repository. The build fails with 'Error: Cannot find module 'aws-sdk''. Which TWO actions could resolve the issue? (Choose TWO.)

Accepted Answer

Ensure 'aws-sdk' is listed in the 'dependencies' section of package.json.. The 'aws-sdk' module must be declared in the 'dependencies' section of package.json for npm to install it during the build. Without this declaration, npm install will not download the module, causing the 'Cannot find module' error at runtime. Option D is correct because CodeBuild does not automatically run npm install; you must explicitly include an 'install' phase in buildspec.yml to execute 'npm install' and populate node_modules.

Answer

Specify a different Node.js runtime version in the buildspec.

Answer

Add a 'pre_build' phase that runs 'npm test'.

Answer

Add a 'build' phase command to compile the code.

Question 15

Refer to the exhibit. An IAM policy is attached to a role used by a CI/CD system. The policy is intended to allow starting the pipeline 'MyPipeline' from the same account. However, the CI/CD system receives an 'AccessDenied' error when trying to start the pipeline. What is the problem?

Accepted Answer

The Deny statement with the 'aws:SourceAccount' condition denies access if the condition key is not present in the request.. The Deny statement with the `aws:SourceAccount` condition key denies access unless the request includes that condition key. When the CI/CD system assumes the role and makes a `StartPipelineExecution` API call, the request context does not automatically include the `aws:SourceAccount` key unless explicitly added by the caller. Since the condition is not satisfied, the Deny statement applies, resulting in an 'AccessDenied' error even though the Allow statement grants the necessary action.

Answer

The Allow statement does not specify the correct pipeline ARN.

Answer

The policy needs an additional Allow for 'codepipeline:GetPipeline' to start the pipeline.

Answer

The role does not have permission to pass the policy to the CI/CD system.