DOP-C02 SDLC Automation Practice Test 16 — 15 Questions

Question 1

A DevOps team is using AWS CodeBuild to run integration tests against a test database. The database is an Amazon RDS instance in a private subnet. The CodeBuild project is configured to run in a VPC. Which THREE steps are required to allow CodeBuild to access the RDS instance?

Accepted Answer

Ensure the security group attached to the RDS instance allows inbound traffic from the CodeBuild security group.. Correct answers are A, B, and D. A: The CodeBuild project must have VPC configuration to place it in the same VPC. B: Security group must allow inbound traffic from CodeBuild. D: Outbound routes are needed to reach RDS. C is wrong because NAT gateway is for internet access, not internal RDS. E is wrong because the database should be in a private subnet, and a public subnet is not needed.

Answer

Place the RDS instance in a public subnet with a public IP.

Answer

Attach a NAT gateway to the VPC so that CodeBuild can route to RDS.

Question 2

A DevOps team uses AWS CodePipeline with an S3 source action and CodeBuild as a build provider. The pipeline has a manual approval step before deployment. Recently, the team noticed that the pipeline automatically starts when a new object is uploaded to the S3 bucket, even if the object is not the source code. They want to ensure that the pipeline only triggers on changes to the source code directory. What is the MOST efficient solution?

Accepted Answer

Configure the S3 event notification to use a prefix filter that matches the source code directory.. Option C is correct because S3 event notifications can be filtered by prefix and suffix, so setting a prefix filter to the source code directory ensures only changes to that directory trigger the pipeline. Option A is wrong because enabling versioning alone doesn't filter events. Option B is wrong because CloudWatch Events can filter but adds complexity and cost. Option D is wrong because disabling automatic triggers would require manual intervention, which is not efficient.

Answer

Use Amazon CloudWatch Events to create a custom rule that matches the source code path and triggers the pipeline.

Answer

Enable versioning on the S3 bucket and configure the pipeline to use the latest version.

Answer

Disable the S3 trigger and manually start the pipeline after each code commit.

Question 3

An organization uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that minifies assets), and a deploy stage (S3 deployment). The team wants to add a stage for running security vulnerability scans on the code. Which TWO options are viable?

Accepted Answer

Add a custom action in the pipeline that invokes a third-party scanning service via AWS Lambda.. Correct answers are B and D. B: CodeBuild can run security scans as part of the build. D: Third-party tools can be integrated via CodePipeline custom actions. A is wrong because S3 cannot run scans. C is wrong because Inspector is for EC2 instances, not code. E is wrong because Shield is for DDoS protection.

Answer

Enable AWS Shield Advanced to scan for vulnerabilities.

Answer

Use Amazon Inspector to scan the source code.

Answer

Add an S3 event notification to trigger a Lambda function that scans the S3 bucket.

Question 4

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration uses a linear traffic shifting with a 10-minute interval. The application logs show that the new version of the application crashes on startup. What is the MOST effective way to handle this situation to ensure successful future deployments?

Accepted Answer

Add a script in the AppSpec file's 'Validate Service' lifecycle hook to check the application health and fail the deployment if the application does not start successfully.. Option B is correct because adding a script to the AppSpec file that validates the application health before allowing traffic shifting can catch startup failures early and prevent deployment failures. Option A is wrong because increasing the interval doesn't fix the root cause. Option C is wrong because rolling back doesn't address the underlying issue. Option D is wrong because a blue/green deployment would still have the same crash issue.

Answer

Increase the interval in the linear traffic shifting to 30 minutes to allow more time for instances to stabilize.

Answer

Configure the deployment to automatically roll back when a failure occurs and ignore the error.

Answer

Switch to a blue/green deployment strategy to minimize the impact on existing instances.

Question 5

A company is using AWS CodeBuild to compile and test code. The buildspec.yml file includes a pre_build phase that installs dependencies and a build phase that runs the compilation. The tests are run in the post_build phase. The team wants to improve the security of the build process by ensuring that sensitive information such as database passwords is not exposed in the build logs. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Use AWS Systems Manager Parameter Store to store the secrets and reference them in the buildspec using the 'parameter-store' field.. Options B and D are correct. Using AWS Systems Manager Parameter Store or AWS Secrets Manager to store secrets and referencing them in the buildspec using parameter-store or secrets-manager prevents secrets from being printed in logs. Option A is wrong because environment variables in plain text can be logged. Option C is wrong because build logs are accessible to authorized users, but the issue is exposure in plain text. Option E is wrong because encryption at rest does not prevent secrets from being logged in plain text.

Answer

Restrict access to the build logs by using IAM policies to only allow specific users to view them.

Answer

Enable encryption at rest for the CodeBuild project's S3 logs.

Answer

Store the secrets as plain-text environment variables in the CodeBuild project.

Question 6

Refer to the exhibit. A DevOps engineer runs the command to get the pipeline definition. The pipeline has a source stage from an S3 bucket and a build stage with CodeBuild. The CodeBuild project is configured to output artifacts to a specific S3 bucket. However, the pipeline fails at the build stage with an error: 'Artifact 'BuildArtifact' is not found'. What is the most likely cause?

Accepted Answer

The CodeBuild project is not configured to output the expected artifact named 'BuildArtifact'.. Option B is correct because the build stage expects an output artifact named 'BuildArtifact', but the CodeBuild project's buildspec might not be configured to output that artifact. The pipeline definition does not show an output artifact for the build stage. Option A is wrong because the source is S3, not CodeCommit. Option C is wrong because the pipeline role likely has S3 permissions. Option D is wrong because the source artifact is found.

Answer

The source stage is using CodeCommit instead of S3.

Answer

The source artifact is not being passed to the build stage.

Answer

The IAM role for CodePipeline does not have permissions to read from the S3 bucket.

Question 7

A company uses AWS CloudFormation to provision infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the stack to change the DB instance class from db.t2.micro to db.t3.medium. Which THREE of the following must be true for the update to succeed? (Choose three.)

Accepted Answer

The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.. Options B, C, and E are correct. The new instance class must be available in the same VPC and subnet group (B) to preserve network connectivity. The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE (C). The IAM role used by CloudFormation must have sufficient permissions to modify RDS resources (E). Option A is wrong because a change set is not mandatory for updates; it can be used but is not required. Option D is wrong because disabling deletion protection is not required to change instance class; it's only needed to delete the stack.

Answer

Deletion protection must be disabled on the DB instance.

Answer

A change set must be created and executed for the update.

Question 8

Refer to the exhibit. An IAM policy is attached to a CodeBuild service role. The CodeBuild project is used to build code from a CodeCommit repository and output artifacts to an S3 bucket. However, the build fails with an error: 'Unable to download source from CodeCommit'. What is the missing permission?

Accepted Answer

Permissions to read from the CodeCommit repository.. Option D is correct because the policy does not include CodeCommit actions like 'codecommit:GitPull' or 'codecommit:GetBranch'. Option A is wrong because the policy already has S3 permissions. Option B is wrong because KMS is not mentioned. Option C is wrong because Logs permissions would be for CloudWatch, not for source download.

Answer

Permissions to create CloudWatch Logs for build output.

Answer

Permissions to decrypt the KMS key used to encrypt artifacts.

Answer

Permissions to write to the S3 artifact bucket.

Question 9

A company runs a containerized microservices application on Amazon ECS with Fargate. The application is deployed using AWS CodePipeline with CodeBuild as the build stage and ECS as the deploy stage. The pipeline uses a deployment controller of type CODE_DEPLOY with a blue/green deployment strategy. Recently, the team noticed that during deployments, the new task set fails health checks and the deployment is rolled back. The application logs indicate that the new containers fail because they cannot connect to the Redis cluster, which is a required dependency. The Redis cluster is running on Amazon ElastiCache and is in the same VPC as the ECS tasks. The team has verified that the security group for the ElastiCache cluster allows inbound traffic from the ECS tasks' security group. The ECS task definition includes the Redis endpoint as an environment variable. What is the MOST likely cause of the connection failure?

Accepted Answer

The security group for the ElastiCache cluster only allows inbound traffic from the security group of the original task set, not the new task set created during deployment.. Option B is correct because in a blue/green deployment with CODE_DEPLOY, the new task set is created in a separate target group, and the security group for the ElastiCache cluster must allow traffic from the new task set's security group. If the security group rule is only attached to the original task set's security group, the new task set cannot connect. Option A is wrong because the ECS service uses the same subnets; the issue is not subnet-related. Option C is wrong because if the environment variable is correctly set, DNS resolution should work. Option D is wrong because the security group for ECS tasks is typically attached to the service, and adding a new security group rule is necessary.

Answer

The new task set is being launched in different private subnets that do not have a route to the ElastiCache cluster.

Answer

The Redis endpoint environment variable is not being passed correctly to the new task set because of a misconfiguration in the task definition.

Answer

The new task set is using a different VPC than the ElastiCache cluster.

Question 10

Refer to the exhibit. A DevOps engineer created a CloudFormation stack that includes a Lambda function. The stack creation failed and rolled back. The error message for the Lambda function says 'Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack rollback was triggered due to a failure in another resource, and the Lambda creation was cancelled.. Option A is correct because 'Resource creation cancelled' typically occurs when the stack is in a rollback and the resource creation was cancelled. Option B is wrong because insufficient permissions would say 'AccessDenied'. Option C is wrong because a missing property would give a validation error. Option D is wrong because the error message does not indicate a timeout.

Answer

The Lambda function's IAM role does not have sufficient permissions.

Answer

The Lambda function's code is missing from the S3 bucket.

Answer

The Lambda function creation timed out.

Question 11

A company uses AWS CodeCommit as a Git repository and CodeBuild for continuous integration. The buildspec.yml file includes steps to run unit tests and package the application. The team wants to ensure that only code from the main branch is deployed to production. They have set up a CodePipeline that triggers on changes to any branch. The pipeline includes a build stage that runs CodeBuild, and then a deploy stage that deploys to production. The team noticed that code from feature branches is being deployed to production accidentally. The team wants to modify the pipeline to prevent this. What is the MOST effective solution?

Accepted Answer

In the CodePipeline source stage, configure the branch filter to only allow the main branch to trigger the pipeline.. Option A is correct because adding a filter to the source stage that only triggers on the main branch ensures that feature branch changes do not start the pipeline. Option B is wrong because restricting IAM permissions for developers does not prevent the pipeline from triggering on feature branches if the pipeline is configured to do so. Option C is wrong because a manual approval step prevents unintended deployments but still triggers the pipeline, wasting resources. Option D is wrong because configuring the branch in the build stage does not stop the pipeline from being triggered by feature branches.

Answer

Use IAM policies to restrict developers from pushing to the main branch.

Answer

Add a manual approval step before the deploy stage and require approval from a senior engineer.

Answer

Modify the CodeBuild project to only build the main branch by specifying the branch in the source configuration.

Question 12

A DevOps team uses AWS CodePipeline to deploy a microservices application. The pipeline includes a CodeBuild project that runs unit tests. Recently, builds have been failing intermittently due to test timeouts. The team wants to improve the reliability of the pipeline without increasing the build timeout. Which action should the team take?

Accepted Answer

Configure the CodeBuild project to run tests in parallel by using separate build environments or test splits.. Option A correctly identifies that running tests in parallel reduces overall build time and helps avoid timeouts without increasing the timeout limit. Option B increases timeout but does not address intermittent failures. Option C addresses flaky tests but does not directly solve timeout issues. Option D moves testing to CodeDeploy, which is not designed for unit testing.

Answer

Increase the build timeout to the maximum allowed value of 8 hours.

Answer

Use AWS CodeDeploy to run the unit tests on EC2 instances with more CPU and memory.

Answer

Modify the unit tests to be non-flaky by adding retries for network calls.

Question 13

A developer is using AWS CloudFormation to deploy a stack that includes an AWS Lambda function. The Lambda function code is stored in an S3 bucket. The CloudFormation template references the S3 bucket and object key. The developer wants to update the Lambda function code by uploading a new zip file to S3 and then updating the stack. The developer updates the S3 object with a new version, but the stack update does not automatically use the new code. What should the developer do to ensure the stack update uses the new code?

Accepted Answer

Upload the new code to a different S3 key or specify a new version ID in the CloudFormation template.. Option C is correct because CloudFormation only detects changes to S3 objects if the S3 key or version changes. By uploading the new code with a different key or setting a new version ID, CloudFormation will detect the change and update the Lambda function. Option A is wrong because the stack policy does not affect resource updates. Option B is wrong because CloudFormation does not automatically poll for S3 changes. Option D is wrong because recreating the entire stack is unnecessary and disruptive.

Answer

Enable S3 event notifications to trigger a CloudFormation stack update when the object is updated.

Answer

Modify the CloudFormation stack policy to allow updates to the Lambda function.

Answer

Delete the stack and recreate it with the new code.

Question 14

An organization uses AWS CloudFormation to manage infrastructure across multiple accounts using AWS Organizations. They want to enforce that all S3 buckets are encrypted with SSE-S3. A DevOps engineer creates a service control policy (SCP) to deny the creation of any S3 bucket without encryption. However, CloudFormation stack creation fails with an access denied error even when the template includes encryption. What is the most likely cause?

Accepted Answer

The SCP is incorrectly scoped to the management account instead of the member accounts.. Option A is correct because SCPs apply globally to all principals in the account, and if the SCP denies the s3:PutBucketPublicAccessBlock action (required for bucket creation) or the specific encryption deny condition is too broad, it can block legitimate requests. Option B is unlikely because CloudFormation uses the role's permissions, not the user's directly. Option C is incorrect because SSE-S3 is server-side encryption. Option D is incorrect because CloudFormation does not require a separate SCP.

Answer

The CloudFormation template specifies SSE-KMS encryption, which is not allowed by the SCP.

Answer

The SCP is denying the s3:PutBucketPublicAccessBlock action, which is required for all bucket creation requests.

Answer

The CloudFormation service role does not have permissions to create buckets in the target account.

Question 15

A company uses AWS CodePipeline to automate the deployment of a static website hosted on Amazon S3. The pipeline includes a source stage that pulls from a CodeCommit repository and a deploy stage that uses CodeBuild to sync the files to an S3 bucket. The team noticed that the website is not updating after a successful pipeline run. The CodeBuild logs show that the 'aws s3 sync' command completed successfully. However, the website still shows the old content. What is the MOST likely cause?

Accepted Answer

The website is fronted by Amazon CloudFront, which is caching the old content.. Option B is correct because S3 static website hosting serves content from the bucket, but if CloudFront is used as a CDN, it caches the content. The sync command updates the S3 bucket, but CloudFront serves cached content until the TTL expires or the cache is invalidated. Option A is wrong because the bucket policy does not affect serving content if it's already public. Option C is wrong because the sync command does not require public access to update objects. Option D is wrong because website hosting can be enabled on the bucket; the issue is caching.

Answer

The CodeBuild project does not have permission to write to the S3 bucket.

Answer

The S3 bucket is not configured for static website hosting.

Answer

The S3 bucket policy is blocking public access to the updated objects.