DOP-C02 SDLC Automation Practice Test 15 — 15 Questions

Question 1

Which THREE actions should a DevOps team take to ensure a CI/CD pipeline using AWS CodePipeline is secure? (Choose three.)

Accepted Answer

Use AWS KMS to encrypt artifacts in the pipeline.. AWS CodePipeline can use AWS KMS customer-managed keys (CMKs) to encrypt artifacts stored in S3 or other supported stores. This ensures that pipeline artifacts are encrypted at rest and in transit, protecting sensitive data from unauthorized access. By default, CodePipeline uses an AWS-managed key, but using a customer-managed KMS key gives the team full control over encryption, key rotation, and access policies.

Answer

Require multi-factor authentication (MFA) for pipeline executions.

Answer

Enable AWS CloudTrail to log pipeline executions.

Question 2

Which TWO options are valid ways to trigger an AWS CodePipeline execution automatically? (Choose two.)

Accepted Answer

Changes to a CodeCommit repository.. AWS CodePipeline can automatically start a pipeline execution when a change is detected in a CodeCommit repository. This is achieved through CloudWatch Events that monitor the repository for specific events like push to a branch, and then trigger the pipeline. This integration allows for continuous delivery by automatically building and deploying code changes.

Answer

A scheduled CloudWatch Logs metric filter.

Answer

Completion of a CodeDeploy deployment.

Answer

Manual approval action in the pipeline.

Question 3

Which THREE factors should be considered when designing a deployment strategy using AWS CodeDeploy to minimize downtime during updates? (Choose three.)

Accepted Answer

Configure a load balancer to deregister instances before deployment.. Deregistering instances from a load balancer before deployment ensures that traffic is not routed to instances that are being updated, preventing downtime during the deployment process. AWS CodeDeploy integrates with Elastic Load Balancing to automatically deregister instances, wait for in-flight requests to complete, and then register them back after the deployment succeeds.

Answer

Deploy to all instances simultaneously to reduce total time.

Answer

Use the same instance type for all instances.

Question 4

Refer to the exhibit. The above IAM policy is attached to an IAM role used by a CI/CD pipeline. Which action is this policy allowing?

Accepted Answer

Start and view builds for the specified CodeBuild project.. The IAM policy grants `codebuild:StartBuild` and `codebuild:BatchGetBuilds` actions, which allow starting a build and viewing build details respectively. The `Resource` element restricts these permissions to the specific CodeBuild project `arn:aws:codebuild:us-east-1:123456789012:project/my-project`. Therefore, the policy allows starting and viewing builds for that single project, not any project in the account.

Answer

Start builds for any CodeBuild project in the account.

Answer

View details of any build in the account.

Answer

Create and manage CodeBuild projects.

Question 5

Refer to the exhibit. The above buildspec.yml is used in AWS CodeBuild. The build is failing during the 'build' phase with a 'FileNotFoundError: setup.py' error. What is the MOST likely cause?

Accepted Answer

The source code does not contain a setup.py file in the root directory.. The error 'FileNotFoundError: setup.py' indicates that the build process is attempting to run a command (likely `python setup.py install` or `pip install -e .`) that requires a `setup.py` file in the root directory of the source code. Since the buildspec.yml does not explicitly override the default build commands, CodeBuild uses the default build command for Python, which expects `setup.py` to be present. Option A is correct because the most likely cause is that the source code repository lacks a `setup.py` file in its root directory, causing the build phase to fail.

Answer

The unit tests in the post_build phase are failing.

Answer

The Python version 3.8 is not supported by CodeBuild.

Answer

The artifacts configuration discarding paths is causing the error.

Question 6

A development team uses AWS CodeCommit as a Git repository. They want to automatically trigger a build in AWS CodeBuild whenever a pull request is created or updated. Which AWS service should be used to detect the pull request events and start the build?

Accepted Answer

Amazon EventBridge. Amazon EventBridge can capture CodeCommit repository events, such as pull request creation and updates, via its event bus. By setting up an EventBridge rule that matches these specific events, you can directly trigger an AWS CodeBuild project as a target, enabling automated builds without additional orchestration services.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS CodePipeline

Answer

Amazon CloudWatch Logs

Question 7

A DevOps engineer is designing a CI/CD pipeline for a microservices application using AWS CodePipeline. Each microservice has its own CodeCommit repository. The engineer wants to run unit tests in parallel for all services when any repository receives a push, then run integration tests only after all unit tests pass. Which pipeline structure should the engineer use?

Accepted Answer

Create a single pipeline with a parallel action for unit tests, then a serial stage for integration tests. AWS CodePipeline supports parallel actions within a stage, allowing unit tests for all microservices to run concurrently. After all unit tests succeed, the pipeline transitions to a serial stage for integration tests, ensuring the correct dependency order. This structure minimizes build time while enforcing the required sequential gate.

Answer

Create a single pipeline with a serial stage for unit tests, then integration tests

Answer

Create one pipeline per microservice, each triggering integration tests via SNS

Answer

Use AWS CodeBuild batch builds with a fan-out/fan-in pattern

Question 8

A company uses AWS CloudFormation to manage infrastructure. The DevOps engineer wants to ensure that stack updates are rolled back if a new Amazon RDS instance fails to be created. Which CloudFormation feature should the engineer use?

Accepted Answer

Add a CreationPolicy to the RDS instance with a timeout. A CreationPolicy with a timeout ensures that CloudFormation waits for a specified period for the RDS instance to be fully created and signal success. If the instance fails to create within the timeout, CloudFormation treats it as a failure and triggers a stack update rollback, which is exactly what the engineer needs to automatically revert changes when the RDS creation fails.

Answer

Use a WaitCondition and a WaitHandle to pause creation

Answer

Set the RDS instance's DeletionPolicy to Retain

Answer

Define a StackPolicy that denies updates to the RDS instance

Question 9

A DevOps engineer is troubleshooting a slow AWS CodeBuild project. The build is a Java application that compiles source code and runs tests. The build environment uses a general1.large compute type. The build duration has increased from 5 minutes to 15 minutes over the past month. The engineer notices that the build logs show 'Downloading...' messages for Maven dependencies for several minutes. What is the most cost-effective way to reduce the build time?

Accepted Answer

Enable local caching in the CodeBuild project for dependencies. Enabling local caching in AWS CodeBuild allows the build environment to cache Maven dependencies in the local file system across builds. This eliminates the need to re-download dependencies from remote repositories each time, directly addressing the 'Downloading...' messages in the logs. It is the most cost-effective solution as it requires no additional AWS services or compute upgrades.

Answer

Configure the build to use a VPC with a NAT gateway

Answer

Use AWS CodeArtifact as a proxy for Maven dependencies

Answer

Change the compute type to general1.2xlarge

Question 10

A company uses AWS CodeDeploy with a blue/green deployment configuration. The engineer wants to automatically roll back the deployment if the new instances fail the health check for 5 minutes. Which setting should the engineer configure?

Accepted Answer

Configure the deployment group to roll back when a CloudWatch alarm is triggered. AWS CodeDeploy blue/green deployments can be configured to automatically roll back when a CloudWatch alarm is triggered. By creating a CloudWatch alarm that monitors the health check endpoint and associating it with the deployment group, the engineer can ensure that if the alarm state persists for 5 minutes (as defined in the alarm's period and evaluation periods), CodeDeploy will automatically initiate a rollback to the previous working version.

Answer

Create a CloudWatch alarm that monitors the health check endpoint

Answer

Set the Auto Scaling group health check grace period to 5 minutes

Answer

Set the deployment configuration's 'timeout' to 5 minutes

Question 11

A development team uses AWS CodeCommit and wants to enforce that all commits include a JIRA issue key in the commit message. They want to reject any push that does not contain a valid JIRA key. Which approach should the engineer use?

Accepted Answer

Configure a pre-commit hook in the Git client. While AWS CodeCommit does not support server-side pre-receive hooks to reject pushes, a client-side pre-commit hook in Git can enforce the requirement before the commit is made. This ensures that all commits include a JIRA issue key in the commit message, preventing non-compliant commits from being pushed. Option A is incorrect because CloudWatch Events cannot directly reject pushes. Option B is incorrect because CodeCommit does not natively support server-side hooks. Option C is incorrect because CodeCommit triggers fire after the push is accepted and cannot reject it.

Answer

Create a CloudWatch Events rule that triggers a Lambda function on push

Answer

Use AWS CodeCommit hooks to validate commit messages

Answer

Use a Lambda function triggered by CodeCommit push events that calls codecommit:PutRepositoryTriggers to reject

Question 12

A company uses AWS CodePipeline with an Amazon S3 source action. The pipeline deploys to an Amazon ECS Fargate service. The engineer notices that the pipeline does not automatically start when a new object is uploaded to the S3 bucket. The S3 bucket versioning is enabled. What is the most likely cause?

Accepted Answer

The S3 bucket does not have event notifications configured for the pipeline. AWS CodePipeline with an S3 source action does not automatically detect new object uploads unless the S3 bucket is configured with event notifications that trigger the pipeline. Without these notifications, the pipeline must be started manually or via a webhook. Since versioning is enabled, the issue is not related to versioning but to the missing event notification configuration.

Answer

The pipeline has manual approval required before the source stage

Answer

S3 versioning is not enabled on the bucket

Answer

The ECS service is not configured for blue/green deployments

Question 13

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodeBuild and Amazon ECS. Which TWO actions will help reduce the frequency of Docker image pulls from the public Docker Hub registry?

Accepted Answer

Enable CodeBuild local caching for the cache type 'LOCAL_DOCKER_LAYER_CACHE'. Enables CodeBuild local caching with LOCAL_DOCKER_LAYER_CACHE, which caches Docker image layers locally across builds within the same build project, reducing the need to pull layers from Docker Hub. Option C stores the base image in Amazon ECR, making it available within the AWS network and eliminating the need to pull from Docker Hub. Both actions directly reduce the frequency of Docker image pulls from the public registry.

Answer

Create a Docker Hub access token and store it in AWS Secrets Manager

Answer

Use AWS CodeArtifact as a proxy for Docker Hub

Answer

Configure CodeBuild to use a VPC with a NAT gateway

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The engineer wants to ensure that the stack is not accidentally deleted and that critical resources like databases are retained even if the stack is deleted. Which THREE steps should the engineer take?

Accepted Answer

Use a StackPolicy to deny delete actions. To prevent accidental deletion of the stack and ensure critical resources like databases are retained, the engineer should: (1) enable termination protection on the stack (E), which blocks delete actions on the entire stack; (2) set the DeletionPolicy attribute to Retain on the RDS instance (D), so the database persists even if the stack is deleted; and (3) use a StackPolicy to deny delete actions (C) on the RDS instance or other critical resources, adding a second layer of protection. Option A is incorrect because denying updates does not prevent deletion; the policy must explicitly deny delete actions on the resource. Option B (nested stacks) can help with organization but does not directly prevent deletion or ensure retention.

Answer

Create a StackPolicy that denies updates to the RDS instance

Answer

Use nested stacks to isolate the database

Question 15

A DevOps team uses AWS CodePipeline with an Amazon S3 source action. The pipeline deploys a static website to an S3 bucket. The engineer wants to ensure that only approved changes are deployed to production. The team uses Git feature branches and wants to deploy only when a pull request is merged to the main branch. Which THREE actions should the engineer take?

Accepted Answer

Configure a CloudWatch Events rule to start the pipeline when a CodeCommit pull request is merged. A CloudWatch Events rule can be configured to detect a CodeCommit pull request merge event (via the referenceUpdated event type) and trigger the pipeline automatically. This ensures the pipeline runs only when approved changes are merged to the main branch, aligning with the requirement to deploy only approved changes.

Answer

Use an S3 source and configure event notifications for all object uploads

Answer

Set the pipeline to execute on every push to any branch