DOP-C02 SDLC Automation Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. A DevOps engineer sees the following error when trying to update a CloudFormation stack: 'Stack [arn:aws:cloudformation:us-west-2:123456789012:stack/MyStack/abc123] is in ROLLBACK_COMPLETE state and can not be updated.' What should the engineer do to proceed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delete the stack and create a new one with the updated template.. When a CloudFormation stack reaches the ROLLBACK_COMPLETE state, it means the stack creation or update failed and the rollback has finished, leaving the stack in a terminal state. CloudFormation does not allow updates or rollback continuation on stacks in this state. The only supported action is to delete the stack and create a new one with the corrected template, as stated in the AWS documentation.

Answer

Run 'aws cloudformation continue-update-rollback' to finish the rollback and then update.

Answer

Modify the stack's template and try the update again.

Answer

Use the 'aws cloudformation resume-update' command to resume the update.

Question 2

Refer to the exhibit. A team uses this buildspec.yml in AWS CodeBuild. The build fails because the 'dist' directory does not exist after the build phase. What is the most likely cause?

Accepted Answer

The build command outputs to a 'build' directory, but the artifacts base-directory is set to 'dist'.. The buildspec's build phase runs `python setup.py build`, which by default writes compiled output into a `build` directory at the project root (distutils/setuptools default build_base). However, the `artifacts` section specifies `base-directory: dist`, so CodeBuild looks for output in a `dist` folder that setup.py build never creates (that name is used by `setup.py sdist`/`bdist_wheel`, not the plain `build` subcommand). Because the actual output lives in `build` and `dist` is empty or missing, CodeBuild fails during artifact upload. To fix this, either point base-directory at `build` or change the build command to produce output under `dist`.

Answer

The buildspec version is incorrect.

Answer

The Python runtime version 3.8 is not available in CodeBuild.

Answer

The requirements.txt file is missing from the source code.

Question 3

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The pipeline has a source stage that pulls from a CodeCommit repository, a build stage using AWS CodeBuild, and a deploy stage that uses AWS CodeDeploy to deploy to an EC2 Auto Scaling group. The team notices that the pipeline frequently fails at the deploy stage with the error 'The deployment failed because the deployment group's deployment configuration specifies a minimum healthy host count of 1, but 0 healthy hosts are available.' What is the MOST likely cause of this issue?

Accepted Answer

The CodeDeploy agent is not installed or is not running on the EC2 instances.. The error message indicates that the CodeDeploy deployment is failing because zero healthy hosts are available in the deployment group. The most common cause is that the CodeDeploy agent is not installed or not running on the EC2 instances, preventing them from reporting their health status to the CodeDeploy service. Without a healthy agent, the instances cannot execute the deployment lifecycle hooks, and CodeDeploy considers them unhealthy, leading to the failure.

Answer

The IAM role for CodePipeline does not have sufficient permissions to access the CodeCommit repository.

Answer

The build artifacts are not being stored in an S3 bucket.

Answer

The EC2 instances are not registered with a Classic Load Balancer.

Question 4

A company runs a microservices architecture on Amazon ECS with Fargate launch type. Each microservice is deployed using AWS CodePipeline with a source stage from CodeCommit, a build stage in CodeBuild, and a deploy stage that updates the ECS service. The team wants to implement a blue/green deployment strategy to reduce downtime and enable quick rollbacks. Which combination of AWS services and configurations should be used?

Accepted Answer

Use AWS CodeDeploy with a deployment group configured for blue/green deployment, and an Application Load Balancer (ALB) to shift traffic between the blue and green target groups.. AWS CodeDeploy natively supports blue/green deployments for Amazon ECS (Fargate) by orchestrating traffic shifting between two target groups behind an Application Load Balancer (ALB). This allows the new task set (green) to be validated before production traffic is fully shifted, and enables instant rollback by reverting traffic to the original (blue) target group. CodePipeline can integrate CodeDeploy as a deploy action to automate this workflow.

Answer

Use AWS CloudFormation with a 'DeploymentPreference' set to 'BlueGreen' for the ECS service.

Answer

Use the ECS service's built-in rolling update with a 'minimumHealthyPercent' of 100 and 'maximumPercent' of 200.

Answer

Configure the ECS service with an 'AutoScaling' policy that replaces instances gradually.

Question 5

A DevOps engineer is configuring a webhook trigger in AWS CodePipeline to automatically start a pipeline when changes are pushed to a specific branch in a CodeCommit repository. The webhook is created and the trigger is set to the 'main' branch. However, when a developer pushes a commit to the 'main' branch, the pipeline does not start. What is the MOST likely reason?

Accepted Answer

The CloudWatch Events rule that triggers the pipeline on repository changes is not configured.. AWS CodePipeline uses Amazon CloudWatch Events (now Amazon EventBridge) to detect repository changes and trigger pipeline executions. When a webhook is created in CodePipeline, it automatically sets up a CloudWatch Events rule that listens for CodeCommit repository state changes (e.g., push to a branch). If this rule is missing, misconfigured, or deleted, the pipeline will not start despite the webhook being present. The webhook itself only registers the endpoint; the actual event routing depends on the CloudWatch Events rule.

Answer

The webhook is not properly registered with CodeCommit due to a conflict with an existing webhook.

Answer

The CodeCommit repository is set to send events to Amazon S3, which conflicts with the webhook.

Answer

The pipeline requires an Amazon SNS notification to be configured for the trigger to work.

Question 6

A company uses AWS CodePipeline to deploy a serverless application using AWS SAM. The pipeline has a source stage from CodeCommit, a build stage that runs 'sam build', and a deploy stage that runs 'sam deploy --no-confirm-changeset'. The deploy stage fails with the error 'The security token included in the request is invalid.' What is the MOST likely cause?

Accepted Answer

The IAM role used by CodeBuild has expired credentials or insufficient permissions to call AWS CloudFormation.. The error 'The security token included in the request is invalid' indicates that the AWS credentials used by CodeBuild to call the CloudFormation API are either expired or lack the necessary permissions. In a CodePipeline with a CodeBuild action, the build project assumes an IAM role to perform actions such as 'sam deploy', which internally calls CloudFormation. If that IAM role's temporary credentials have expired (e.g., due to a long-running build) or the role does not have the required CloudFormation permissions (e.g., cloudformation:CreateChangeSet, cloudformation:ExecuteChangeSet), the API call will fail with this exact error.

Answer

The CloudFormation stack is in a 'ROLLBACK_COMPLETE' state and cannot be updated.

Answer

The CodeBuild project does not have access to the CodeCommit repository.

Answer

The SAM template is invalid and contains syntax errors.

Question 7

A development team uses AWS CodeStar to set up a continuous delivery pipeline for a web application. The application is deployed to an Elastic Beanstalk environment. After a successful deployment, the team wants to automatically run integration tests against the deployed application. What is the SIMPLEST way to achieve this?

Accepted Answer

Add a test stage in CodePipeline after the deploy stage that uses CodeBuild to run integration tests.. CodePipeline natively supports a test stage after the deploy stage, and using CodeBuild to run integration tests is the simplest and most integrated approach. This keeps the entire CI/CD workflow within CodePipeline without requiring external triggers, custom scripts, or platform hooks. CodeBuild can be configured to run tests against the deployed Elastic Beanstalk environment URL, and the pipeline will only proceed if the tests pass.

Answer

Configure the Elastic Beanstalk environment to run integration tests after deployment via a custom platform hook.

Answer

Use Amazon CloudWatch alarms to trigger a Lambda function that runs the tests.

Answer

Add a post-deployment script in the CodeDeploy appspec file to run tests.

Question 8

A company uses AWS CodePipeline to deploy a static website to an S3 bucket. The pipeline includes a source stage (S3), a build stage (CodeBuild) that minifies assets, and a deploy stage that copies files to the production S3 bucket. The deploy stage uses 's3 sync' command. After a recent deployment, some users report seeing old content. What is the MOST likely cause?

Accepted Answer

The website is served through Amazon CloudFront, and the CloudFront distribution cache was not invalidated after the deployment.. The most likely cause is that the static website is served through Amazon CloudFront, and the CloudFront distribution cache was not invalidated after the deployment. Even though the S3 bucket contents are updated via 's3 sync', CloudFront caches objects at edge locations based on TTL settings. Without a cache invalidation request, users continue to receive the old cached content until the TTL expires or the cache is manually cleared.

Answer

The S3 bucket policy blocks public read access, so users get a 403 error.

Answer

The IAM role for CodeBuild does not have permissions to write to the S3 bucket.

Answer

The deploy stage uses 's3 cp' instead of 's3 sync', so new files are not uploaded.

Question 9

A team uses AWS CodePipeline to deploy a containerized application to Amazon ECS. The pipeline uses a source stage from CodeCommit, a build stage that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that updates an ECS service. The team wants to add a manual approval step before the deploy stage to allow QA to verify the image. What is the BEST way to implement this?

Accepted Answer

Add a manual approval stage in CodePipeline between the build and deploy stages, and configure SNS to notify approvers.. CodePipeline natively supports manual approval actions that pause the pipeline at a specified stage and wait for an approver to manually approve or reject the transition. By adding a manual approval stage between the build and deploy stages, the pipeline will automatically halt after the build completes, and you can configure Amazon SNS to notify the QA team via email or other endpoints when their approval is required. This approach requires no custom infrastructure, integrates directly with the pipeline's state machine, and provides a built-in audit trail of approvals.

Answer

Configure an AWS Lambda function in the pipeline that checks a DynamoDB table for approval status and pauses until approved.

Answer

Use an Amazon SNS topic to send a notification to QA, and have them manually trigger the deploy stage by clicking a link in the email.

Answer

Use Amazon CloudWatch Events to trigger a custom action that waits for an approval signal.

Question 10

A company uses AWS CodeCommit for source control. Developers work on feature branches and create pull requests to merge into the 'develop' branch. The company wants to enforce that all commits to the 'develop' branch are signed. Which AWS service or feature should be used to enforce this policy?

Accepted Answer

Create an approval rule template in CodeCommit that requires commits to be signed and associate it with the 'develop' branch.. AWS CodeCommit natively supports enforcing signed commits. You can create an approval rule template with the 'Require commit signing' condition and associate it with the 'develop' branch. This ensures that any commit to the branch must be signed with a valid GPG key, and unsigned commits are rejected. Option A is incorrect because using CloudWatch Events and Lambda to revert unsigned commits is not a native enforcement mechanism and is unnecessary. Option C is incorrect because KMS is not used for Git commit signing. Option D is incorrect because IAM policies cannot inspect commit signatures.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that verifies commit signatures and reverts unsigned commits.

Answer

Use AWS Key Management Service (KMS) to create a signing key and require developers to use it.

Answer

Configure an IAM policy that denies 'git push' unless the commit is signed.

Question 11

A company is using AWS CodeBuild to run builds for a Java application. The build takes a long time because it downloads Maven dependencies every time. The team wants to speed up the build by caching dependencies. Which TWO actions should be taken? (Choose 2)

Accepted Answer

Enable Amazon S3 caching in the CodeBuild project and specify an S3 bucket to store the cache.. CodeBuild supports Amazon S3 caching, which allows you to store build artifacts (such as Maven dependencies) in a specified S3 bucket. By enabling this feature, subsequent builds can download the cached dependencies from S3 instead of re-downloading them from the internet, significantly reducing build time. Option E is correct because the buildspec file must explicitly define the cache path (e.g., /root/.m2) to tell CodeBuild which directory to cache; without this, CodeBuild does not know what to save or restore.

Answer

Use CodeBuild's 'build cache' feature without specifying a bucket; it will automatically cache to a default location.

Answer

Set the cache type to 'Local' in the CodeBuild project configuration.

Answer

Mount an Amazon EFS file system to the build container and configure Maven to use it as a local repository.

Question 12

A company uses AWS CodePipeline with multiple stages: Source (CodeCommit), Build (CodeBuild), Test (CodeBuild), and Deploy (CodeDeploy to EC2). The Test stage runs integration tests that require network access to a private database in a VPC. The CodeBuild project is configured to use a VPC. However, the Test stage fails intermittently with timeout errors. Which TWO actions would MOST likely resolve the issue? (Choose 2)

Accepted Answer

Increase the timeout for the Test stage in the CodeBuild project to accommodate network delays.. The intermittent timeout errors suggest that the Test stage's integration tests are occasionally taking longer than the configured timeout. Increasing the timeout accommodates these delays, preventing premature failures. Option C is correct because a NAT gateway is required for CodeBuild in a VPC to access resources outside the VPC, such as the private database, if the database is in a different subnet or requires internet-routable traffic.

Answer

Remove the VPC configuration from the CodeBuild project and use a public subnet instead.

Answer

Use a larger compute type for the CodeBuild project to improve network performance.

Answer

Configure the security group for the CodeBuild project to allow outbound traffic to the database security group on the required port.

Question 13

A DevOps engineer is setting up a CI/CD pipeline for a Python application using AWS CodePipeline. The pipeline includes a build stage with CodeBuild and a deploy stage that runs an AWS CLI command to update a Lambda function. Which THREE steps are necessary to ensure the pipeline can update the Lambda function? (Choose 3)

Accepted Answer

Store the AWS CLI command in the buildspec file or as a separate script in the source repository.. The AWS CLI command to update the Lambda function must be defined in the buildspec file or as a script in the source repository so that CodeBuild can execute it during the deploy stage. This ensures the pipeline has the exact command to run, and it becomes part of the version-controlled build specification.

Answer

Configure a CloudWatch Events rule to trigger the pipeline when the Lambda function is updated.

Answer

Use AWS CodeDeploy instead of the AWS CLI to update the Lambda function.

Question 14

Your company uses AWS CodePipeline to automate the deployment of a critical web application. The pipeline consists of a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy) that deploys to an Auto Scaling group of EC2 instances running Amazon Linux 2. The deployment strategy is 'AllAtOnce'. Recently, the team noticed that during deployments, the application becomes completely unavailable for a few minutes until the new instances are registered with the load balancer. The business requires zero downtime during deployments. You need to modify the deployment process to achieve zero downtime while minimizing cost and complexity. The Auto Scaling group currently has a minimum of 2 instances and a maximum of 4 instances. The application is stateless and sessions are stored in ElastiCache. Which solution should you implement?

Accepted Answer

Use CodeDeploy's blue/green deployment with an Application Load Balancer. Create a new Auto Scaling group for the green environment, deploy to it, and then shift traffic.. CodeDeploy blue/green deployments with an ALB allow traffic to be shifted from the original (blue) Auto Scaling group to a newly provisioned green Auto Scaling group only after the new instances pass health checks, so the application never becomes unavailable. Because the app is stateless and sessions live in ElastiCache, no session affinity or state migration is required, making this both low-risk and low-complexity. This directly satisfies the zero-downtime requirement without over-provisioning capacity.

Answer

Create a second Auto Scaling group, deploy to it, and then update Route 53 to point to the new group.

Answer

Change the deployment configuration to 'HalfAtATime' to update half the instances at a time.

Answer

Increase the Auto Scaling group's minimum size to 4 so there are always extra instances.

Question 15

You are a DevOps engineer for a company that uses AWS CodePipeline to deploy a microservice to Amazon ECS with Fargate. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild) that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that uses an ECS task definition update. Recently, the deploy stage started failing intermittently with the error 'The task definition does not have a compatibilities attribute set correctly.' The task definition is generated dynamically during the build stage and uses the 'FARGATE' launch type. The error occurs only when a new task definition revision is created. You suspect the issue is related to how the task definition is generated. Upon reviewing the buildspec, you see that the task definition JSON is created using environment variables for the image URI. What is the MOST likely cause and solution?

Accepted Answer

The task definition JSON does not include the 'requiresCompatibilities' field with the value '["FARGATE"]'.. The 'requiresCompatibilities' attribute must be explicitly set to 'FARGATE' for Fargate tasks. Option A is incorrect because the error is about compatibilities, not execution role. Option C is incorrect because network mode should be 'awsvpc', but that is not the error. Option D is incorrect because CPU and memory values are required but would cause a different error.

Answer

The task definition is missing the 'executionRoleArn' field, which is required for Fargate.

Answer

The task definition specifies 'networkMode' as 'bridge', but Fargate requires 'awsvpc'.

Answer

The task definition does not specify 'cpu' and 'memory' values, which are required for Fargate.