DOP-C02 SDLC Automation Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. A DevOps engineer is troubleshooting a cross-account deployment where an AWS CodeBuild project in Account A needs to upload build artifacts to an S3 bucket in Account B. The engineer attaches this IAM policy to the CodeBuild service role in Account A. However, the upload fails. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The condition requires bucket-owner-full-control ACL, but the bucket policy may not allow it. The IAM policy includes a condition that requires the `bucket-owner-full-control` canned ACL (`s3:x-amz-acl: bucket-owner-full-control`). For this condition to be satisfied, the bucket policy in Account B must explicitly allow the `s3:PutObject` action with that ACL. If the bucket policy does not include a statement granting `s3:PutObject` with the condition that the ACL is `bucket-owner-full-control`, the upload will fail with an access denied error, even if the IAM policy in Account A appears permissive.

Answer

The bucket policy in Account B grants s3:PutObject to Account A

Answer

The policy does not include s3:PutObjectAcl permission

Answer

The policy does not include s3:GetObject permission

Question 2

A company uses AWS CodePipeline with an Amazon S3 source, AWS CodeBuild, and AWS CodeDeploy. The deployment stage fails intermittently with the error 'Deployment failed because the deployment group does not exist'. The pipeline has been working for months. What is the MOST likely cause?

Accepted Answer

The pipeline's cross-region action configuration references the deployment group in a different region without specifying the region.. The error 'deployment group does not exist' occurs when CodePipeline attempts to use a CodeDeploy deployment group that is not present in the region being accessed. If the deployment group is in a different region from the pipeline, the action must explicitly specify that region. Without it, CodePipeline defaults to the pipeline's home region, which does not contain the deployment group, causing the error every time the action runs. This is a common misconfiguration for cross-region deployments.

Answer

The deployment group name contains a typo in the pipeline definition.

Answer

The IAM role for CodePipeline does not have sufficient permissions in all regions.

Answer

The pipeline was recreated without specifying the deployment group.

Question 3

An organization uses AWS CodeBuild to compile and test their code. They want to reuse build artifacts across multiple build projects to reduce build time. What is the BEST approach?

Accepted Answer

Store build artifacts in an Amazon S3 bucket and configure each build project to download them from S3.. Storing artifacts in Amazon S3 allows sharing across multiple build projects. Option A is incorrect because the local cache is tied to a single build project and not shared. Option C is incorrect because Docker layer caching is used for container builds, not for general build artifacts. Option D is incorrect because Amazon EFS is a file system for shared storage but is not typically used for CodeBuild artifact sharing; S3 is the recommended service.

Answer

Use the local cache feature in CodeBuild to store artifacts on the build instance.

Answer

Use Docker layer caching to store intermediate build layers.

Answer

Mount an Amazon EFS file system to each build environment to share artifacts.

Question 4

A team uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The team checks the logs and finds that the application installation script fails on some instances due to missing dependencies. What is the BEST long-term solution?

Accepted Answer

Create a custom AMI that includes all dependencies and use it in the Auto Scaling group.. Creating a custom AMI that includes all dependencies ensures that every instance launched in the Auto Scaling group has the required software pre-installed. This eliminates the root cause of the deployment failure—missing dependencies—by baking them into the machine image, making deployments consistent and reliable. It is the best long-term solution because it avoids runtime dependency installation failures and reduces deployment time.

Answer

Use an Elastic Load Balancer health check to automatically replace failed instances.

Answer

Modify the CodeDeploy AppSpec file to run the installation script as root.

Answer

Implement a retry mechanism in the deployment script to install dependencies again.

Question 5

A company has a monorepo in AWS CodeCommit with multiple microservices. They want to use AWS CodePipeline to build and deploy only the microservice that changed. What is the MOST efficient approach?

Accepted Answer

Use an AWS Lambda function triggered by CloudWatch Events for CodeCommit to start the specific pipeline for the changed microservice.. It uses an AWS Lambda function triggered by CloudWatch Events (now Amazon EventBridge) on CodeCommit repository events (e.g., push to a specific branch) to detect which microservice changed and then start the corresponding CodePipeline pipeline. This is the most efficient approach as it avoids unnecessary builds of unchanged microservices and does not require splitting the monorepo or adding complex conditional logic within a single pipeline.

Answer

Configure a single pipeline that always builds all microservices.

Answer

Create separate CodeCommit repositories for each microservice.

Answer

Use a single pipeline with multiple build actions that each check if their microservice changed.

Question 6

A DevOps engineer needs to automate the creation of a CI/CD pipeline using infrastructure as code. Which AWS service is BEST suited to define and provision the pipeline resources?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct choice because it is an infrastructure-as-code (IaC) service that allows you to define and provision AWS resources, including CI/CD pipeline components like CodePipeline, CodeBuild, and CodeDeploy, using declarative templates. This enables fully automated, repeatable, and version-controlled pipeline creation without manual intervention.

Answer

AWS Elastic Beanstalk

Answer

AWS CodePipeline

Answer

AWS Service Catalog

Question 7

A team uses AWS CodeBuild to run unit tests. They notice that builds are taking longer than expected. The build environment includes many dependencies that are downloaded every time. Which change would MOST reduce build time?

Accepted Answer

Store dependencies in an Amazon S3 bucket and configure CodeBuild to use S3 cache.. Storing dependencies in an S3 bucket and configuring CodeBuild to use S3 caching (Option B) reduces build time because dependencies are downloaded once and reused across builds, avoiding the repeated download of large dependency sets. Option A (local caching) is not persistent and may be cleared between builds. Option C (larger compute instance) addresses CPU or memory bottlenecks, not the network-bound dependency download. Option D (Amazon EFS) provides shared storage but is not designed for caching and may introduce latency, making it less effective than S3 cache for this purpose.

Answer

Enable local caching for dependencies.

Answer

Increase the compute type to a larger instance.

Answer

Use Amazon EFS to share dependencies across builds.

Question 8

An organization uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests that take 30 minutes. The team wants to speed up feedback without skipping tests. Which action should they take?

Accepted Answer

Configure parallel build actions in the Test stage to run tests concurrently.. Running integration tests in parallel within the Test stage reduces the total wall-clock time for the test suite, speeding up feedback without skipping any tests. AWS CodePipeline supports parallel actions within a stage, allowing multiple test suites to execute concurrently, which directly addresses the goal of faster feedback while maintaining test coverage.

Answer

Use a larger build environment for the Test stage.

Answer

Remove the Test stage and rely on post-deployment testing.

Answer

Move the Test stage to after deployment.

Question 9

A company uses AWS CodeDeploy with a blue/green deployment configuration. After a deployment, the new instances are not registered with the load balancer, causing downtime. What is the MOST likely cause?

Accepted Answer

The CodeDeploy deployment group does not have a load balancer configured or the deregistration delay is too long.. In AWS CodeDeploy blue/green, to shift traffic, the deployment group must have a load balancer configured. Without this configuration, CodeDeploy will not register new instances with any load balancer, leaving them out of service and causing downtime. A misconfigured deregistration delay affects how long old instances remain registered after traffic is shifted, but it does not prevent new instances from being registered. Therefore, the most likely cause is the missing load balancer configuration.

Answer

The IAM role for CodeDeploy does not have permission to register instances with the load balancer.

Answer

The original instances are still registered with the load balancer.

Answer

The load balancer health check is misconfigured.

Question 10

A company uses AWS CodePipeline to deploy a critical application. The pipeline has a manual approval step before deployment. Which TWO actions should be taken to improve security and auditability? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all approval actions.. Enabling AWS CloudTrail to log all approval actions provides a detailed, immutable audit trail of who approved or rejected a pipeline stage, when it happened, and from which IP address. This is essential for compliance and forensic analysis, as CloudTrail captures the `Approval` API calls made by CodePipeline, including the `approve` and `reject` actions, along with the IAM user or role identity. Without CloudTrail, there is no native logging of manual approval events, making it impossible to prove accountability.

Answer

Remove the approval step and rely on post-deployment monitoring.

Answer

Replace the manual approval with an automated approval based on test results.

Answer

Use a shared IAM user for all approvers to simplify management.

Question 11

Which THREE AWS services can be used as a source action in AWS CodePipeline? (Choose three.)

Accepted Answer

Amazon S3. Amazon S3 is a supported source action in AWS CodePipeline because you can configure a pipeline to use an S3 bucket as a source location for your application code or artifacts. When you upload a new version of a file to the specified S3 bucket, CodePipeline can automatically detect the change (via Amazon CloudWatch Events or S3 event notifications) and start the pipeline execution. This is commonly used for deploying static websites or integrating with third-party CI/CD tools that output artifacts to S3.

Answer

Amazon DynamoDB

Answer

AWS CloudFormation

Question 12

A DevOps team is designing a CI/CD pipeline for a containerized application. Which THREE components are essential for a complete pipeline? (Choose three.)

Accepted Answer

Artifact storage. Artifact storage (Option B) is essential because a complete CI/CD pipeline must store build outputs (e.g., Docker images, JAR files) in a durable, versioned repository. Without artifact storage, subsequent deployment stages cannot reliably retrieve the exact build artifact that passed testing, breaking traceability and rollback capabilities. Services like Amazon ECR or S3 serve this role, ensuring immutability and consistent delivery across environments.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Question 13

Refer to the exhibit. A DevOps engineer attaches this IAM policy to a user. The user reports that they cannot start a pipeline execution for 'my-pipeline' using the AWS CLI. What is the MOST likely reason?

Accepted Answer

The user is missing the 'codepipeline:ListPipelines' permission needed to list pipelines before execution.. The IAM policy shown in the exhibit grants permissions for specific actions on the 'my-pipeline' resource, but it does not include the 'codepipeline:ListPipelines' action. When a user runs the AWS CLI command to start a pipeline execution, the AWS CLI first calls 'ListPipelines' to resolve the pipeline name to its ARN, and if that permission is missing, the request fails with an access denied error even though the 'StartPipelineExecution' action is allowed.

Answer

The IAM policy does not allow the 'codepipeline:StartPipelineExecution' action.

Answer

The resource ARN for the pipeline is incorrect.

Answer

The policy has a condition that restricts execution to certain times.

Question 14

Refer to the exhibit. A developer runs the AWS CLI command to start a build in AWS CodeBuild. The build project 'my-project' uses an S3 bucket as the source. What is the MOST likely cause of the error?

Accepted Answer

The CodeBuild service role does not have s3:GetObject permission on the source bucket.. The error occurs because CodeBuild needs to download the source code from the S3 bucket during the build. The CodeBuild service role, not the developer's IAM user, makes the s3:GetObject API call to retrieve the source object. Without this permission on the service role, the build fails with an access denied error.

Answer

The S3 bucket name is misspelled in the build project configuration.

Answer

The developer's IAM user does not have s3:GetObject permission.

Answer

The S3 bucket is in a different region than the CodeBuild project.

Question 15

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The pipeline has a Source stage that polls the repository for changes. Recently, developers have noticed that the pipeline does not always trigger when code is pushed to the main branch. What is the most likely cause?

Accepted Answer

The number of pushes to the repository has exceeded the CodePipeline poll rate limit.. CodePipeline uses a polling mechanism to check for changes in CodeCommit repositories. When the number of pushes exceeds the default poll rate limit (typically one request per 15 seconds), the pipeline may miss some changes, leading to inconsistent triggering. This is a known limitation of polling-based detection, especially in high-velocity development environments.

Answer

The repository does not have a webhook configured to notify CodePipeline of changes.

Answer

The IAM role used by CodePipeline does not have permission to read from CodeCommit.

Answer

CloudWatch Events is not enabled for the repository.