DOP-C02 SDLC Automation Practice Test 17 — 15 Questions

Question 1

A company uses AWS CodeBuild to compile and test code. The buildspec.yaml includes a pre_build phase that runs 'aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com'. The build fails with 'Error: Cannot connect to the Docker daemon'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CodeBuild project does not have privileged mode enabled.. The error 'Cannot connect to the Docker daemon' indicates that the Docker daemon is not running or inaccessible within the CodeBuild build environment. CodeBuild runs Docker commands inside a container that does not have a Docker daemon by default. To execute Docker commands (such as docker login or docker build), the CodeBuild project must be configured with privileged mode enabled, which grants the container elevated permissions to run its own Docker daemon. Without privileged mode, any attempt to interact with the Docker daemon will fail.

Answer

The region specified does not match the ECR repository region.

Answer

The Docker login command syntax is incorrect.

Answer

The AWS CLI is not installed in the CodeBuild environment.

Question 2

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment is set to 'AllAtOnce'. The application revision is a simple index.html. What is the most likely cause?

Accepted Answer

The CodeDeploy agent is not installed or running on the EC2 instances.. The error message indicates that too many instances failed deployment, which is typical when the CodeDeploy agent is not running on the EC2 instances. With an 'AllAtOnce' deployment, all instances are targeted simultaneously, so if the agent is missing on every instance, all will fail immediately, causing the overall deployment to fail. The simple index.html revision is not the issue; the agent is required to execute the AppSpec file and pull the revision from S3 or GitHub.

Answer

The IAM instance profile does not have permissions to download from Amazon S3.

Answer

The application revision is not a compressed archive.

Answer

The deployment configuration 'AllAtOnce' is incompatible with Auto Scaling groups.

Question 3

A developer wants to automate the testing of a serverless application built with AWS Lambda and Amazon API Gateway. Which AWS service is best suited for running integration tests as part of a CI/CD pipeline?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is best suited for running integration tests as part of a CI/CD pipeline because it is a fully managed continuous integration service that can compile source code, run tests, and produce software packages. For a serverless application using Lambda and API Gateway, CodeBuild can execute integration tests against deployed API endpoints, validate Lambda function responses, and integrate seamlessly with other AWS developer tools like CodePipeline. It supports custom build environments and can run test frameworks (e.g., Postman/Newman, Jest) directly in the pipeline.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Answer

AWS CloudFormation

Question 4

A company uses AWS Elastic Beanstalk for deploying a web application. The development team wants to implement a blue/green deployment strategy to minimize downtime. Which approach should they use?

Accepted Answer

Create a new Elastic Beanstalk environment and swap the environment CNAMEs.. In AWS Elastic Beanstalk, blue/green deployment is achieved by creating a separate environment (the green environment) alongside the existing one (the blue environment), deploying the new application version to it, and then swapping the CNAME records of the two environments. This swap is instantaneous at the DNS level, resulting in zero downtime because traffic is immediately redirected from the old environment to the new one without any instance replacement or gradual shifting.

Answer

Update the Auto Scaling group launch configuration and gradually replace instances.

Answer

Create a new CodeDeploy deployment group and use the blue/green deployment configuration.

Answer

Create a new target group and register instances from the old environment.

Question 5

A DevOps engineer is troubleshooting a CodePipeline that has a Build stage using AWS CodeBuild. The build logs show 'Error: No such file or directory' for a file that is present in the source repository. What is the most likely cause?

Accepted Answer

The buildspec.yaml specifies an incorrect path for the file relative to the source root.. The error 'No such file or directory' indicates that the build process is attempting to access a file at a path that does not exist relative to the source root. In AWS CodeBuild, the build runs in a temporary directory that contains the source code, and all paths in the buildspec.yaml are relative to the source root by default. If the buildspec.yaml specifies an incorrect relative path (e.g., using an absolute path or a wrong subdirectory), CodeBuild will fail to locate the file, even though it exists in the repository.

Answer

The build commands are not executed because the pre_build phase failed.

Answer

The artifact definition in the buildspec.yaml is incorrect.

Answer

The environment variables in CodeBuild are not set correctly.

Question 6

A company uses AWS CloudFormation to manage a stack that includes an Amazon SQS queue. The queue name must be unique. The developer wants to define the queue name in the CloudFormation template. Which intrinsic function should be used to generate a unique name?

Accepted Answer

Fn::Sub. A is correct because `Fn::Sub` can embed a pseudo parameter like `AWS::StackName` or `AWS::AccountId` into a string to generate a unique queue name. By using `Fn::Sub` with a reference to the stack name or a random string, you can create a name that avoids collisions across accounts or regions, satisfying the uniqueness requirement for SQS queue names.

Answer

Fn::Select

Answer

AWS::NoValue

Answer

Fn::GetAtt

Question 7

A DevOps team uses AWS CloudFormation with nested stacks. They are experiencing stack update failures because changes to a nested stack cause resource conflicts. Which THREE best practices should they follow to manage nested stack updates? (Choose THREE.)

Accepted Answer

Apply a stack policy to prevent updates to critical resources in the nested stacks.. Applying a stack policy to nested stacks prevents updates to critical resources, avoiding conflicts during nested stack updates. Stack policies act as a guard to deny updates to specified resources, which is essential when changes to a nested stack might cause resource conflicts or unintended modifications. This best practice ensures that only intended changes are applied, reducing the risk of update failures.

Answer

Set the stack update to disable rollback to allow debugging of failures.

Answer

Use DependsOn to ensure nested stacks are updated in a specific order.

Question 8

A company uses AWS CodeBuild to run unit tests. The buildspec.yaml file includes commands to install dependencies and run tests. Which TWO environment variables are automatically set by CodeBuild and can be used in the build commands? (Choose TWO.)

Accepted Answer

CODEBUILD_SRC_DIR. A is correct because `CODEBUILD_SRC_DIR` is an environment variable automatically set by AWS CodeBuild that contains the absolute path to the directory where the source code is downloaded. This variable is essential for build commands that need to reference the source root, such as running tests or installing dependencies from a relative path.

Answer

AWS_REGION

Answer

CODEBUILD_BUILD_NUMBER

Answer

CI

Question 9

Refer to the exhibit. A developer has the IAM policy shown. The developer can push code to the CodeCommit repository and start the pipeline. However, the pipeline fails at the Source stage with an access denied error. What additional permission is needed?

Accepted Answer

codecommit:GitPull. The pipeline fails at the Source stage because CodePipeline needs to pull the source code from CodeCommit to start the build. The `codecommit:GitPull` permission is required for the pipeline's service role to perform a Git pull operation (fetching the repository contents). Without it, the pipeline cannot retrieve the source code, even though the developer has push and pipeline start permissions.

Answer

codecommit:GetBranch

Answer

codecommit:CreateCommit

Answer

codecommit:UploadArchive

Question 10

Refer to the exhibit. A DevOps engineer runs the CLI command to view stack events. The output shows that a Lambda function update was cancelled by the stack update. What is the most likely cause?

Accepted Answer

A concurrent stack update was initiated while a previous update was in progress.. When a stack update is in progress, AWS CloudFormation locks the stack to prevent concurrent operations. If a second update is initiated, CloudFormation cancels the first update and returns an error. The Lambda function update was cancelled because a concurrent stack update was started while the previous update was still running, which is a known limitation of CloudFormation's stack management.

Answer

The stack had a drift detection operation that overrode the update.

Answer

The IAM role for the Lambda function lacked permissions to update the function.

Answer

The Lambda function code exceeded the maximum size limit for inline code.

Question 11

Refer to the exhibit. A developer has a buildspec.yaml for a React application. The build completes successfully, but the artifacts output is empty. What is the most likely cause?

Accepted Answer

The base-directory specified does not exist after the build phase.. The most likely cause is that the `base-directory` specified in the `artifacts` section of the buildspec.yaml does not exist after the build phase completes. CodeBuild uses the `base-directory` to locate the files to package as artifacts; if the directory is missing (e.g., because the build output was written to a different path or the directory name was misspelled), no files are found, resulting in an empty artifacts output. This is a common misconfiguration when the build process generates files in a subdirectory that does not match the declared `base-directory`.

Answer

The install phase did not run because npm install is not in the correct phase.

Answer

The artifacts files pattern '**/*' is invalid.

Answer

The runtime version nodejs 14 is not supported by CodeBuild.

Question 12

A development team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They notice that a pipeline execution failed due to a code review rejection in the 'Approve' stage. The pipeline is configured with a manual approval action. What is the most likely cause of the failure?

Accepted Answer

An authorized user logged in to the CodePipeline console and rejected the approval request.. A manual approval action in CodePipeline explicitly requires a human reviewer to approve or reject the pipeline execution. If the pipeline failed due to a 'code review rejection,' the most direct cause is that an authorized user logged into the CodePipeline console and clicked the 'Reject' button on the approval request. This is the only mechanism by which a manual approval action can result in a rejection.

Answer

The IAM role for the pipeline does not have permission to invoke the approval action.

Answer

The CodeCommit repository has a branch policy that prevents direct commits.

Answer

The pipeline is not configured with a CloudWatch Events rule to trigger the approval.

Question 13

An organization uses AWS CodePipeline with a multi-branch strategy. They want to run unit tests on every push to any branch, but only deploy to production on pushes to the 'main' branch. What is the most efficient way to achieve this?

Accepted Answer

Configure a single pipeline with a source action that triggers on all branches, then use a 'branch' condition on the deployment stage to only proceed if the branch is 'main'.. AWS CodePipeline supports a single pipeline with a source action configured to trigger on all branches (e.g., using a webhook event filter for 'refs/heads/*'). You can then add a 'branch' condition on the deployment stage using a Lambda function or a manual approval action that checks the branch name, ensuring only pushes to 'main' proceed to production. This approach avoids duplicating pipelines while still running unit tests on every push.

Answer

Use a single pipeline with a source action that triggers on all branches, and deploy to a test environment for all branches, then promote to production manually.

Answer

Create separate pipelines for each branch, each with its own test and deploy stages.

Answer

Use a single pipeline with a source action that only triggers on the 'main' branch, and run tests in a separate system.

Question 14

A DevOps engineer needs to automate the creation of an AWS CodeStar project for a new microservice. The engineer wants to use AWS CloudFormation to define the project and its resources. Which CloudFormation resource should be used?

Accepted Answer

AWS::CodeStar::Project. AWS::CodeStar::Project is the correct CloudFormation resource because it directly creates an AWS CodeStar project, which is a project management hub that integrates AWS services like CodeCommit, CodeBuild, CodeDeploy, and CodePipeline for continuous delivery. This resource allows you to define the project template, source repository, and other settings in a single CloudFormation stack, automating the entire CodeStar project creation.

Answer

AWS::ServiceCatalog::CloudFormationProduct

Answer

AWS::CodePipeline::Pipeline

Answer

AWS::CodeBuild::Project

Question 15

A team is using AWS CodeCommit as their version control system. They want to ensure that all commits are signed with a GPG key. What is the simplest way to enforce this?

Accepted Answer

Enable the 'Require signed commits' option in the CodeCommit repository settings.. AWS CodeCommit provides a built-in repository setting called 'Require signed commits' that, when enabled, rejects any push containing unsigned commits at the server side. This is the simplest and most reliable enforcement mechanism because it does not rely on client-side configurations or custom scripts, and it leverages CodeCommit's native integration with GPG signature verification.

Answer

Use AWS CloudTrail to monitor unsigned commits and automatically revert them.

Answer

Use a pre-commit hook in the local repository to enforce signing.

Answer

Configure an IAM policy that denies PutFile if the commit is not signed.