DOP-C02 SDLC Automation Practice Test 17 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). Recently, deployments have been failing intermittently during the deploy stage with the error: 'The service has reached its maximum number of running tasks.' How should a DevOps engineer resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the ECS service configuration to increase the maximum number of tasks. The error 'The service has reached its maximum number of running tasks' indicates that the ECS service's desired count or maximum tasks (if using a placement constraint) has been hit. Updating the ECS service configuration to increase the maximum number of tasks (or the desired count) allows the deployment to proceed by accommodating the new tasks during a rolling update. This directly resolves the capacity limit that CodeDeploy encounters when trying to launch new tasks.

Answer

Increase the memory reservation for the task definition

Answer

Configure an Amazon ECS Service Auto Scaling policy to scale out

Answer

Increase the number of concurrent deployments allowed in CodeDeploy

Question 2

A DevOps engineer is designing a CI/CD pipeline that must enforce a policy: any change to the production branch in CodeCommit must be reviewed and approved by two senior developers before the change can be merged. The pipeline must also automatically build and deploy to a staging environment after approval. Which combination of AWS services and configurations should be used?

Accepted Answer

Use CodeCommit pull request approval rules and a CodePipeline with a manual approval step triggered by a Lambda function that checks approval status. CodeCommit pull request approval rules enforce the requirement for two senior developers to approve changes before merging, and CodePipeline with a manual approval step can be configured to trigger a Lambda function that checks the approval status before proceeding to build and deploy to staging. This combination directly satisfies the policy of requiring two approvals and automating the build/deploy after approval.

Answer

Configure CodeBuild to run a script that checks the commit author and rejects if not approved

Answer

Use Amazon EventBridge to trigger a Lambda function that validates the number of approvers before merging

Answer

Use IAM policies to restrict write access to the production branch to only senior developers

Question 3

A DevOps team uses AWS CodeBuild to compile a Java application. The build environment is managed by AWS and runs on Linux. The team wants to speed up the build process by caching dependency directories across builds. Which configuration should the team use?

Accepted Answer

Enable local caching in the CodeBuild project and specify the cache location as /root/.m2. AWS CodeBuild supports local caching, which stores specified directories on the build host's local instance storage. By configuring the cache type as 'local' and specifying the cache location as `/root/.m2` (the default Maven local repository), the team can persist downloaded Maven dependencies across builds, significantly reducing build time by avoiding re-downloading dependencies.

Answer

Configure the buildspec file to use Docker layer caching

Answer

Use the CodeBuild cache configuration to store the entire build output in a custom Docker image

Answer

Store dependencies in an Amazon S3 bucket and download them at the start of each build

Question 4

A company is implementing a CI/CD pipeline using AWS CodePipeline to deploy a serverless application using the AWS Serverless Application Model (SAM). The pipeline must build and package the application, then deploy it to multiple environments (dev, test, prod) sequentially with manual approval gates before production. Which stage configuration should be used?

Accepted Answer

Use a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, then separate deploy stages for each environment with manual approval actions. It uses a CodeBuild build stage to run 'sam package' and 'sam deploy' commands, which is the recommended approach for SAM-based deployments. The pipeline then separates deploy stages for each environment (dev, test, prod) with manual approval actions before production, satisfying the sequential deployment and manual gate requirements.

Answer

Use a single CloudFormation stack with a change set approval step

Answer

Configure CodePipeline with a deploy action provider set to AWS CloudFormation

Answer

Use CodeDeploy to deploy the SAM template directly to Lambda

Question 5

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment strategy is Blue/Green. After a successful deployment, the team notices that the new instances are receiving traffic but the application returns errors. The old instances are still serving traffic correctly. The team wants to roll back immediately. What should be done?

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails, then manually trigger a rollback.. To roll back a CodeDeploy Blue/Green deployment, you should initiate a rollback deployment with the previous application revision. This can be done via the AWS CLI (`aws deploy create-deployment` with the old revision) or via the CodeDeploy console. Configuring automatic rollback on deployment failure is a separate setting and is not a prerequisite for manual rollback. The explanation should be corrected to state that the rollback process creates a new replacement environment with the previous revision (or reuses the original if still available) and shifts traffic to it, not that automatic rollback must be configured first.

Answer

Stop the current deployment using the AWS CLI.

Answer

Manually update the Auto Scaling group to associate new instances with the old launch configuration.

Answer

Redeploy the same application revision to the same Auto Scaling group.

Question 6

A DevOps engineer is setting up an AWS CodeBuild project that needs to access resources in a VPC, such as an Amazon RDS database. The engineer has configured the CodeBuild project to run in the VPC. Which additional configuration is required for CodeBuild to pull the build Docker image?

Accepted Answer

Create a VPC interface endpoint for Amazon ECR and configure the CodeBuild project to use it.. When a CodeBuild project runs inside a VPC, it loses default internet access, so it cannot reach public endpoints like Amazon ECR (Docker Hub or ECR) to pull the build image. A VPC interface endpoint (powered by AWS PrivateLink) creates a private, highly available connection to Amazon ECR within the VPC, allowing CodeBuild to pull images without traversing the internet. This is the correct solution because it provides direct, secure access to ECR while keeping all traffic within the AWS network.

Answer

Create a VPC peering connection to another VPC that has internet access.

Answer

Configure a VPC gateway endpoint for Amazon ECR.

Answer

Attach an internet gateway to the VPC and add a default route to it.

Question 7

A company uses AWS CodeBuild to run unit tests and package a Node.js application. The buildspec.yml file includes commands to install dependencies using npm. The build is failing with the error: 'npm ERR! code EACCES'. How should a DevOps engineer resolve this issue?

Accepted Answer

Use 'npm ci' instead of 'npm install' and ensure a package-lock.json is present. The EACCES error in CodeBuild indicates a permission issue when npm tries to write to the node_modules directory. The default CodeBuild user (usually 'codebuild-user') lacks write permissions to the project root, which is owned by root. Using 'npm ci' (clean install) is the correct resolution because it bypasses the permission issue by using the package-lock.json to install dependencies deterministically, and it does not attempt to modify the lock file or run lifecycle scripts that may require elevated permissions. Additionally, 'npm ci' is faster and more reliable in CI/CD environments like CodeBuild.

Answer

Configure the CodeBuild project to use a custom VPC with a NAT gateway for internet access

Answer

Configure the buildspec to run npm install with sudo

Answer

Add a command to change the ownership of the node_modules directory to the current user

Question 8

A DevOps team uses AWS CodePipeline to deploy a static website to an Amazon S3 bucket. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that runs a build tool), and a deploy stage (S3). After a recent code change, the build stage succeeded but the deploy stage failed with the error: 'Access Denied' when uploading artifacts to the S3 bucket. What should the team do to fix the issue?

Accepted Answer

Add 's3:PutObject' permission to the CodePipeline service role. The deploy stage in CodePipeline uses the CodePipeline service role to upload artifacts to the S3 bucket. The error 'Access Denied' indicates that this role lacks the necessary permissions. Adding 's3:PutObject' to the CodePipeline service role grants it the required write access to the S3 bucket, resolving the issue.

Answer

Configure the S3 bucket to allow public access

Answer

Add an S3 bucket policy that grants the CodeBuild service role s3:PutObject access

Answer

Verify that the CodeCommit repository has the correct permissions for the pipeline

Question 9

A company is using AWS CodeCommit with multiple repositories. Developers are required to create pull requests for all changes, and the pull request must be associated with a JIRA issue key (e.g., PROJ-123) in the commit message. A DevOps engineer needs to enforce this policy automatically. Which approach meets the requirement with minimal operational overhead?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function to validate the pull request description and reject if missing JIRA key. CodeCommit triggers can invoke an AWS Lambda function on pull request events (e.g., created or updated). The Lambda function can parse the pull request description or commit messages for a JIRA key pattern (e.g., regex `[A-Z]+-\d+`) and, if missing, automatically reject the pull request by updating its status or adding a comment. This serverless approach enforces the policy without requiring any changes to developer workflows or additional infrastructure, minimizing operational overhead.

Answer

Store JIRA keys in an S3 bucket and configure a CloudWatch Events rule to check commits

Answer

Use AWS CodeBuild to run a validation script during the build phase

Answer

Require developers to install a pre-commit hook script locally

Question 10

A team is using AWS CloudFormation to manage infrastructure. They want to implement a change management process where any modifications to the stack must be reviewed and approved. Which feature should they use?

Accepted Answer

Change Sets. Change Sets allow you to preview how proposed changes to a CloudFormation stack will impact your running resources before you execute them. This enables a review-and-approve workflow because you can generate a change set, have a team member or automated process inspect the list of resource additions, modifications, or deletions, and then either execute or discard the change set. This directly supports the required change management process.

Answer

StackSets

Answer

Drift Detection

Answer

Stack Policy

Question 11

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project can access a private Amazon S3 bucket to download build artifacts? (Choose two.)

Accepted Answer

Add a bucket policy that explicitly allows access from the CodeBuild project's IAM role ARN. A bucket policy can explicitly grant access to the CodeBuild project's IAM role ARN, allowing the CodeBuild service to download objects from the private S3 bucket. This is a common method to cross-account or service-specific access without making the bucket public.

Answer

Generate an access key and secret key for the CodeBuild project to use in the buildspec

Answer

Configure the CodeBuild project to run in a VPC with an S3 VPC endpoint

Answer

Make the S3 bucket publicly readable

Question 12

A company uses AWS CodeBuild to run unit tests as part of a CI pipeline. The buildspec.yaml file is located in the root of the source repository. The build takes 30 minutes to complete. The team wants to speed up the build by caching dependencies. Which approach should they take?

Accepted Answer

Configure the buildspec.yaml to enable local caching and specify the paths to cache.. CodeBuild supports caching dependencies to speed up builds. The simplest native approach is to enable caching in the buildspec.yaml using the cache configuration, specifying local caching paths (e.g., /root/.m2 for Maven or /root/.cache/pip for pip) so dependencies are preserved between builds on the same build environment. This avoids re-downloading dependencies from the internet each time and can significantly reduce build time. Note that CodeBuild also supports Amazon S3 caching, and EFS can be mounted for shared storage, but local caching is the most direct and commonly recommended option for dependency caching within the buildspec.

Answer

Download dependencies from the internet each time the build runs.

Answer

Mount an Amazon EFS file system to the build container and store dependencies there.

Answer

Store dependencies in an AWS CodeCommit repository and clone it during the build.

Question 13

Which THREE steps are required to set up a continuous deployment pipeline using AWS CodePipeline that deploys a Docker-based application to Amazon ECS? (Choose three.)

Accepted Answer

Create a source stage that uses AWS CodeCommit as the source provider. AWS CodePipeline requires a source stage to detect changes in the source code repository. AWS CodeCommit is a fully managed source control service that integrates natively with CodePipeline, allowing automatic pipeline execution when new commits are pushed to the specified branch. This is a fundamental step in establishing a continuous delivery workflow.

Answer

Create a deploy stage that uses AWS CodeDeploy to deploy to Amazon ECS

Answer

Create an invoke stage that uses AWS Lambda to update the ECS service

Question 14

Which TWO approaches can be used to automatically roll back a failed deployment in AWS CodeDeploy? (Choose two.)

Accepted Answer

Configure the deployment group to automatically roll back when a deployment fails. AWS CodeDeploy allows you to configure a deployment group to automatically roll back a deployment when it fails. This is a native feature that can be enabled in the deployment group settings, ensuring that if a deployment fails (e.g., due to health check failures or script errors), CodeDeploy automatically reverts to the last known good revision without manual intervention.

Answer

Use a CloudWatch Events rule to trigger a rollback when a deployment fails

Answer

Attach an IAM policy to the CodeDeploy service role that allows rollback actions

Answer

Specify a rollback revision in the AppSpec file

Question 15

An organization uses AWS CodePipeline to deploy a serverless application using AWS Lambda and Amazon API Gateway. The pipeline includes a manual approval action. The team wants to ensure that the approval email is sent to multiple approvers and that any one of them can approve or reject. How should the approval action be configured?

Accepted Answer

Create an Amazon SNS topic with multiple subscribers, and configure the approval action to use that SNS topic ARN.. AWS CodePipeline's manual approval action can be configured to send notifications through an Amazon SNS topic. By creating an SNS topic with multiple subscribers (e.g., email addresses), any one of the subscribers can receive the approval request and take action (approve or reject). This satisfies the requirement for multiple approvers where any single approver can act.

Answer

Specify multiple email addresses in the 'ApproverEmail' field of the approval action.

Answer

Set the 'Approvers' field in the approval action to a comma-separated list of IAM user ARNs.

Answer

Add multiple IAM users to the pipeline's service role.