DOP-C02 SDLC Automation Practice Test 15 — 15 Questions

Question 1

A team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is configured with a deployment configuration that uses the 'CodeDeployDefault.OneAtATime' traffic routing. However, during deployment, the new instances are failing health checks and the deployment is rolling back. The team wants to minimize the impact on users. What should the team do to detect issues earlier?

Accepted Answer

Use a canary deployment configuration that shifts 10% of traffic initially.. Option B is correct because the 'CodeDeployDefault.AllAtOnce' deployment would update all instances at once, but that could cause full outage. However, the question asks to detect issues earlier, so using a smaller batch size or a canary deployment would detect issues earlier. In this context, changing to a canary deployment that shifts a small percentage of traffic first is best. Option A is wrong because increasing batch size makes detection later. Option C is wrong because manual approval doesn't detect health issues automatically. Option D is wrong because stopping the deployment is reactive, not proactive.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce'.

Answer

Increase the batch size to deploy to multiple instances at once.

Answer

Add a manual approval step in the pipeline before the deployment.

Question 2

A company uses AWS CodeCommit for source control. Developers need to automatically run tests on every push to a feature branch, but only if the push includes changes to the 'src/' directory. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CodePipeline. CodeCommit can trigger AWS Lambda via CloudWatch Events or via Amazon EventBridge. The Lambda function can check the commit details for changes in the 'src/' directory and then trigger CodeBuild to run tests. Alternatively, CodePipeline can be configured with a source trigger on the feature branch and a filter for path changes. Option B (Lambda) and Option D (CodePipeline) are correct. Option A is wrong because CodeDeploy is for deployment, not testing. Option C is wrong because CloudWatch Logs is for log storage. Option E is wrong because CodeBuild alone cannot listen to CodeCommit events.

Answer

Amazon CloudWatch Logs

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Question 3

A company uses AWS CloudFormation to manage infrastructure. The development team wants to promote changes from a development environment to a production environment using change sets. They need to ensure that the production stack is not updated if there are any changes to the stack's IAM policies. Which approach should the team use?

Accepted Answer

Create a ChangeSet from the updated template, review the changes for IAM modifications, and execute only if no IAM changes are present.. Option A is correct because ChangeSets allow reviewing changes before execution, and you can inspect changes to IAM resources. Option B is wrong because StackSets are for multi-account deployments. Option C is wrong because drift detection checks for manual changes, not intended updates. Option D is wrong because a custom resource is overly complex.

Answer

Enable drift detection on the production stack and compare with the development stack.

Answer

Use AWS CloudFormation StackSets to deploy to multiple accounts and use stack instance filters.

Answer

Use a custom resource in the template that checks for IAM changes and fails the update.

Question 4

Refer to the exhibit. An AWS CloudFormation template includes a Lambda function with the ARN shown. The function is part of a custom resource to create an S3 bucket. The stack creation fails with the error 'Function not found: arn:aws:lambda:us-east-1:123456789012:function:my-function'. The Lambda function exists in the same account and region. What is the most likely cause?

Accepted Answer

The Lambda function is defined in the same template and has a circular dependency. The error indicates that CloudFormation cannot find the Lambda function. Since the function exists in the same account and region, the issue could be that the function is not deployed yet because of a circular dependency. CloudFormation may be trying to invoke the function before it is created. Option C is correct. Option A is wrong because the ARN is correct. Option B is wrong because IAM permissions would cause a different error. Option D is wrong because the function exists.

Answer

The Lambda function is not in the same AWS region

Answer

The Lambda function lacks necessary IAM permissions

Answer

The Lambda function ARN is malformed

Question 5

A developer is using AWS CodeBuild to compile code. The build takes a long time because dependencies are downloaded each time. What can the developer do to reduce build time?

Accepted Answer

Enable caching in the build project to store dependencies in Amazon S3.. Option C is correct because caching dependencies in a S3 bucket allows subsequent builds to reuse them. Option A is wrong because upgrading instance type may not help if the bottleneck is network. Option B is wrong because parallel builds don't reduce single build time. Option D is wrong because multiple build environments don't reduce time.

Answer

Split the build into multiple parallel build actions.

Answer

Use multiple build environments to distribute the work.

Answer

Use a larger compute type for the build project.

Question 6

A company runs a critical e-commerce application on AWS. They use AWS CodePipeline to manage deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy to an Auto Scaling group). Recently, a deployment caused a 5-minute outage because the new application version had a bug that caused the health checks to fail. The Auto Scaling group marked instances as unhealthy and replaced them, but during the replacement, traffic was routed to the remaining instances, which also failed health checks, causing a full outage. The company wants to implement a deployment strategy that prevents any traffic from being routed to unhealthy instances and automatically rolls back if the deployment fails. They also want to minimize deployment time and cost. Which solution should the DevOps team implement?

Accepted Answer

Use CodeDeploy blue/green deployment with automatic rollback enabled. The best approach is to use a blue/green deployment with CodeDeploy, which creates a new Auto Scaling group (green) alongside the existing one (blue). Traffic is shifted to the green group only after health checks pass. If health checks fail, the deployment is automatically rolled back by terminating the green group. This avoids any outage. Option B is correct. Option A (in-place with rollback) would still cause downtime during instance replacement. Option C (increase health check grace period) would delay detection but not prevent outage. Option D (manual approval) slows down deployment and doesn't automate rollback.

Answer

Add a manual approval step in CodePipeline before deploy

Answer

Use CodeDeploy in-place deployment with automatic rollback enabled

Answer

Increase the health check grace period in the Auto Scaling group

Question 7

A company uses AWS CloudFormation to manage infrastructure as code. They have a stack that creates an Amazon RDS database instance. The database password is stored as a parameter in AWS Systems Manager Parameter Store. The CloudFormation template references the parameter using the 'resolve:ssm' dynamic reference. Recently, a security audit found that the password was exposed in plaintext in the CloudFormation stack outputs. The team wants to prevent sensitive information from being displayed in stack outputs or logs. Which approach should be taken?

Accepted Answer

Set the 'NoEcho' property to 'true' for the parameter in the template. To prevent sensitive data from being shown in outputs or logs, use the 'NoEcho' property set to 'true' in the CloudFormation template parameter. This will mask the value in outputs. Option B is correct. Option A (encrypt the output) is not possible because outputs are not encrypted. Option C (remove the output) would prevent exposure but may break automation that depends on the output. Option D (use AWS Secrets Manager) is good but does not directly solve the output exposure issue.

Answer

Store the password in AWS Secrets Manager and reference it in the template

Answer

Remove the output from the CloudFormation stack

Answer

Encrypt the output value using AWS KMS

Question 8

An organization uses AWS CodePipeline to deploy a web application. The pipeline includes a test stage that runs integration tests using AWS CodeBuild. The tests are flaky and sometimes fail due to external dependencies. The team wants to automatically retry failed tests before marking the stage as failed. How should this be achieved?

Accepted Answer

Configure the CodeBuild project to automatically retry the build on failure.. Option B is correct because the CodeBuild retry feature can automatically retry the build on failure. Option A is wrong because a separate pipeline adds complexity. Option C is wrong because a manual approval doesn't retry tests. Option D is wrong because CloudWatch Events can trigger a retry, but it requires custom logic; the built-in retry is simpler.

Answer

Add a manual approval step after the test stage.

Answer

Use Amazon CloudWatch Events to listen for test failures and trigger a new pipeline execution.

Answer

Create a second pipeline that triggers only on test failures.

Question 9

A startup is using AWS CodeBuild to build and test their application. The build process takes about 10 minutes. Recently, they noticed that some builds are failing randomly with the error 'Could not download dependencies'. The build environment uses a custom Docker image stored in Amazon ECR. The team suspects that the issue is due to network connectivity problems when pulling the Docker image or dependencies from the internet. They want to ensure reliable and faster builds. Which solution should they implement?

Accepted Answer

Configure CodeBuild to use a VPC with a NAT gateway. To improve reliability and speed, use an Amazon ECR repository in the same region and configure CodeBuild to use a VPC with a NAT gateway for internet access, or use a VPC endpoint for ECR. The best approach is to use a VPC with a NAT gateway to provide consistent internet access. Option A is correct. Option B (increase build timeout) does not fix the root cause. Option C (use a larger instance) may not resolve network issues. Option D (use a public Docker Hub) may still have network issues and is not controlled.

Answer

Switch to using a public Docker image from Docker Hub

Answer

Increase the build timeout in CodeBuild project settings

Answer

Use a larger compute type for the CodeBuild project

Question 10

A company uses AWS CodeCommit and wants to enforce that all commits to the 'main' branch are signed with a GPG key. Which steps should the DevOps engineer take to enforce this?

Accepted Answer

Create an IAM policy that denies git push actions unless the commit is signed.. Option B is correct because CodeCommit can use IAM policies with conditions to require signed commits. Option A is wrong because hooks are not supported in CodeCommit. Option C is wrong because the commit ID does not enforce signing. Option D is wrong because CloudWatch Logs cannot enforce signing.

Answer

Use the AWS CLI to verify commit signatures and reject pushes.

Answer

Enable CloudWatch Logs to monitor commits and trigger a Lambda to rollback.

Answer

Configure a pre-receive hook in CodeCommit to reject unsigned commits.

Question 11

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The pipeline has a source stage (S3), a build stage (CodeBuild), and a deploy stage (Elastic Beanstalk). Recently, the deployment started failing with the error 'The Elastic Beanstalk environment is not in a ready state'. The team found that the environment was in an 'Updating' state because a previous deployment was still in progress. They need a solution that prevents concurrent deployments and ensures that the environment is ready before starting a new deployment. Which action should the DevOps engineer take?

Accepted Answer

Configure a 'Wait for Environment to be Ready' action before the deploy stage. To prevent concurrent deployments, configure the pipeline with a concurrency limit or use a stage that checks the environment status before proceeding. The simplest solution is to set the Elastic Beanstalk environment's 'Rolling update type' to 'Immutable' and use a manual approval gate, but the best practice is to use a CodePipeline action that waits for the environment to be ready. Option A is correct. Option B (increase timeout) does not prevent concurrent deployments. Option C (multiple environments) adds complexity. Option D (disable rolling updates) may cause downtime.

Answer

Increase the deployment timeout in the Elastic Beanstalk environment

Answer

Disable rolling updates in the Elastic Beanstalk environment

Answer

Create multiple Elastic Beanstalk environments for blue/green deployment

Question 12

A DevOps engineer is tasked with automating the deployment of a microservices architecture. Each service is packaged as a Docker container. The team wants to use AWS CodePipeline and AWS CodeBuild to build Docker images and push them to Amazon ECR, then deploy to Amazon ECS. What should the CodeBuild buildspec file include to push the image to ECR?

Accepted Answer

Docker build and docker push commands with AWS CLI to authenticate to ECR.. Option C is correct because standard Docker commands are used to build and push images. Option A is wrong because CodeDeploy is not used for pushing images. Option B is wrong because CodeBuild does not natively call ECS. Option D is wrong because there is no built-in ECR push action in CodeBuild; you must use docker push.

Answer

A call to the AWS CodeDeploy API to push the image.

Answer

An invocation of the AWS ECS RunTask API.

Answer

A buildspec phase with 'ecr-push' action.

Question 13

A large enterprise uses AWS CodePipeline with multiple stages including source, build, test, and deploy. The test stage runs a suite of integration tests that take 30 minutes. The team wants to reduce the overall pipeline execution time by running the test stage in parallel across different test environments (e.g., different browsers, operating systems). However, they also need to aggregate the test results into a single report. Which approach should they use?

Accepted Answer

Configure parallel actions in the test stage and use a custom action to aggregate results. CodePipeline supports parallel actions within a stage. You can define multiple test actions (e.g., one for each browser) and run them in parallel. To aggregate results, use a post-test action that runs after all parallel actions complete, or use a custom report generation step. Option C is correct. Option A (sequential) increases time. Option B (separate pipelines) adds complexity. Option D (batch builds) is for CodeBuild batch, but not for different environments.

Answer

Create separate pipelines for each test environment

Answer

Create a sequential test stage that runs each environment one after another

Answer

Use CodeBuild batch builds with a single buildspec to run tests in parallel

Question 14

A company is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from GitHub, a build stage using AWS CodeBuild, and a deploy stage using AWS Elastic Beanstalk. The team wants to ensure that the pipeline only proceeds if the code quality checks pass and unit tests are successful. Which TWO actions should be taken?

Accepted Answer

Add a test stage in the pipeline with a CodeBuild action that runs code quality and unit tests.. Correct answers are A and C. A: Adding a test stage with CodeBuild allows running tests. C: CodeBuild can run both code quality checks and unit tests. B is wrong because S3 is not a stage type for testing. D is wrong because a manual approval does not run tests. E is wrong because CloudFormation is for infrastructure, not testing.

Answer

Add a manual approval step before the deploy stage.

Answer

Configure the source stage to use an S3 bucket and add a test action.

Answer

Use AWS CloudFormation to create a test environment and run tests.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. They have a template that creates an Amazon EC2 instance and an Elastic IP address. The template uses the AWS::EC2::EIP resource. The team notices that when they delete the stack, the Elastic IP address is not released, leading to charges. They want to ensure that the Elastic IP is automatically released when the stack is deleted. What should they do?

Accepted Answer

Set the DeletionPolicy attribute to 'Delete' on the EIP resource. By default, CloudFormation deletes the EIP when the stack is deleted. However, if the EIP is associated with an instance, the association may prevent deletion. To ensure release, set the 'DeletionPolicy' attribute to 'Delete' (which is default) and ensure that the EIP is not associated with an ENI that is not being deleted. Option A is correct. Option B (DependsOn) does not affect deletion. Option C (Retain policy) would keep the EIP, causing charges. Option D (manual release) is not automated.

Answer

Set the DeletionPolicy attribute to 'Retain' to keep the EIP

Answer

Create a custom resource to release the EIP before stack deletion

Answer

Add a DependsOn clause to ensure proper order of deletion