DOP-C02 SDLC Automation Practice Test 18 — 15 Questions

Question 1

An organization uses AWS CodePipeline to deploy a web application to Amazon EC2 instances behind an Application Load Balancer. The deployment uses a CodeDeploy action with an in-place deployment configuration. After a recent deployment, some instances are running the old version while others are running the new version. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The deployment group was configured with the 'AllAtOnce' deployment configuration, and the deployment failed partway through.. B is correct because the 'AllAtOnce' deployment configuration instructs CodeDeploy to deploy to all instances simultaneously. If the deployment fails partway through, some instances may have received the new version while others remain on the old version, resulting in a mixed state. This is the most likely cause given the symptom of a split between old and new versions across instances.

Answer

The deployment group is associated with an Auto Scaling group that launched new instances during the deployment.

Answer

A lifecycle hook is configured to pause the deployment until manual approval.

Answer

The deployment was configured to use a blue/green strategy, but the target group is misconfigured.

Question 2

A development team uses AWS CodeBuild to compile a Java application. The build takes 15 minutes on average, but recently it started taking over 30 minutes. The buildspec.yml file is unchanged. What is the most likely cause?

Accepted Answer

The cache for the build project was cleared, forcing a full dependency download.. The most likely cause is that the build project's cache was cleared, forcing a full dependency download. CodeBuild can cache dependencies (e.g., Maven local repository) to speed up builds. If the cache is invalidated or cleared, the build must re-download all dependencies from the internet, significantly increasing build time from 15 minutes to over 30 minutes, even though the buildspec.yml is unchanged.

Answer

The build environment was changed from a Linux to a Windows environment.

Answer

The build project's compute type was downgraded to a smaller instance.

Answer

The buildspec.yml file was updated to include more build commands.

Question 3

Which TWO actions can be used to improve the security of a CI/CD pipeline that uses AWS CodePipeline? (Choose two.)

Accepted Answer

Enable encryption for artifacts stored in the pipeline's S3 bucket.. AWS CodePipeline stores artifacts in an S3 bucket, and enabling default encryption (SSE-S3 or SSE-KMS) ensures that all objects at rest are encrypted, protecting sensitive build outputs and source code from unauthorized access if the bucket is compromised. This is a fundamental security best practice for data at rest in any CI/CD pipeline.

Answer

Configure the source action to poll for changes instead of using webhooks.

Answer

Store secrets in the pipeline environment variables in plain text.

Answer

Use a single IAM role for all pipeline actions to simplify permissions.

Question 4

Which THREE considerations are important when designing a CI/CD pipeline for a microservices architecture using AWS CodePipeline? (Choose three.)

Accepted Answer

Include automated integration tests that validate service-to-service interactions.. In a microservices architecture, automated integration tests are essential to validate that service-to-service interactions (e.g., API calls, event-driven communication) work correctly after changes. AWS CodePipeline can run these tests in a dedicated stage using AWS CodeBuild or third-party tools, catching integration failures before deployment to production.

Answer

All microservices should be deployed using a single pipeline to ensure consistency.

Answer

Use manual approval gates at every stage to ensure quality.

Question 5

Which TWO AWS services can be used as source actions in AWS CodePipeline to automatically trigger a pipeline when changes are made? (Choose two.)

Accepted Answer

Amazon S3. Amazon S3 is a valid source action in AWS CodePipeline because you can configure a pipeline to start when a new object is created or an existing object is updated in an S3 bucket. This is achieved by enabling Amazon S3 event notifications (via Amazon S3 Event Notifications) that send events to Amazon CloudWatch Events or directly to AWS CodePipeline using a CloudWatch Events rule, which then triggers the pipeline execution. This allows automatic pipeline runs on code or artifact changes stored in S3.

Answer

Amazon CloudWatch

Answer

Amazon EC2

Answer

AWS CloudFormation

Question 6

A company uses AWS CodeBuild to compile a Java application. The buildspec.yml includes a pre_build phase that runs unit tests and a build phase that packages the application. Recently, builds have been failing intermittently with 'OutOfMemoryError' during the test phase. The build environment is set to 'BUILD_GENERAL1_SMALL'. What is the MOST cost-effective solution?

Accepted Answer

Change the build environment to 'BUILD_GENERAL1_MEDIUM' which has more memory.. The 'BUILD_GENERAL1_SMALL' environment provides only 3 GB of memory, which is insufficient for the unit tests, causing intermittent 'OutOfMemoryError'. Upgrading to 'BUILD_GENERAL1_MEDIUM' (7 GB) directly addresses the memory shortage without architectural changes, and it is the most cost-effective solution because it avoids the complexity and additional costs of parallel jobs or test splitting while still resolving the root cause.

Answer

Split the tests into smaller batches using CodeBuild test splitting.

Answer

Configure the buildspec to set MAVEN_OPTS='-Xmx512m' to reduce JVM heap usage.

Answer

Use multiple CodeBuild jobs to run tests in parallel.

Question 7

A DevOps engineer is setting up a CI/CD pipeline for a microservices architecture. The team uses AWS CodeCommit, CodeBuild, and CodeDeploy. The engineer needs to ensure that the pipeline can automatically roll back the deployment if the health checks fail after deployment. Which action should the engineer take?

Accepted Answer

Configure the deployment group to roll back when a CloudWatch alarm is triggered.. CodeDeploy natively supports automatic rollbacks triggered by CloudWatch alarms. By configuring the deployment group to monitor a CloudWatch alarm (e.g., based on ELB health check metrics), CodeDeploy will automatically initiate a rollback to the last known good revision if the alarm enters the ALARM state, ensuring health check failures are handled without custom scripting.

Answer

Use AWS Lambda to monitor health checks and trigger a rollback via the CodeDeploy API.

Answer

Set up the deployment group to use blue/green deployment with traffic shifting.

Answer

Configure the pipeline to have a manual approval step after deployment.

Question 8

A company uses AWS CloudFormation to manage infrastructure. The DevOps engineer wants to implement a CI/CD pipeline that builds and tests a CloudFormation template and then deploys it across multiple AWS accounts. Which combination of services should the engineer use?

Accepted Answer

Use CodePipeline with separate CodeBuild projects for validation and CloudFormation deployment actions assuming IAM roles in target accounts.. It uses CodePipeline to orchestrate the CI/CD workflow, with separate CodeBuild projects for template validation (e.g., cfn-lint) and deployment actions that assume IAM roles in target accounts. This design ensures cross-account access via role assumption, which is the recommended pattern for multi-account deployments, and separates validation from deployment for better control and rollback.

Answer

Use CodeBuild to run cfn-lint and then use AWS Lambda to deploy stacks across accounts.

Answer

Use CodePipeline with CodeDeploy to deploy CloudFormation stacks across accounts.

Answer

Use CodePipeline with a single CodeBuild project to run cfn-lint and deploy to all accounts.

Question 9

An organization uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The engineer reviews the deployment logs and finds that the AppSpec file is correctly formatted and the scripts run successfully on some instances. What is the MOST likely cause?

Accepted Answer

The health check grace period for the Auto Scaling group is too short.. The error indicates that instances are failing the deployment health check after the AppSpec scripts run successfully. When the health check grace period for the Auto Scaling group is too short, instances may be marked unhealthy before the application has fully started and passed the target group health checks, causing CodeDeploy to consider them failed. This is the most likely cause because the scripts succeed on some instances but the overall deployment fails due to insufficient healthy instances.

Answer

The CodeDeploy agent is not installed on some instances.

Answer

The target group is not configured to route traffic to the instances.

Answer

The IAM role assigned to the EC2 instances does not have sufficient permissions.

Question 10

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda and Amazon API Gateway. The team wants to automate deployment across multiple environments (dev, test, prod) with environment-specific configuration. Which approach should the engineer use?

Accepted Answer

Use the AWS Serverless Application Model (SAM) with CodePipeline, and pass environment parameters as CloudFormation parameter overrides.. AWS SAM natively integrates with CodePipeline and allows passing environment-specific parameters as CloudFormation parameter overrides, enabling consistent and automated deployments across dev, test, and prod. Option B is less efficient as it requires manual handling of parameters in CodeBuild. Option C incorrectly relies on CodeDeploy, which is not designed for environment-specific parameters in a serverless context. Option D introduces unnecessary complexity with separate CodeBuild projects for each environment, whereas SAM can handle all environments with parameterization.

Answer

Use CodeBuild to package the Lambda code and then use CloudFormation with parameters for each environment.

Answer

Use CodeDeploy with a deployment configuration that deploys to all environments sequentially.

Answer

Use CodePipeline with separate CodeBuild projects for each environment.

Question 11

A company uses AWS CodePipeline to orchestrate builds and deployments. The build stage uses CodeBuild to run unit tests and generate a report. The team wants to fail the pipeline if the test coverage drops below 80%. How should the engineer configure this?

Accepted Answer

Configure CodeBuild to fail the build if the test report indicates coverage below 80% using the buildspec's reports section.. CodeBuild's `reports` section in the buildspec allows you to specify a `file-format` (e.g., Cobertura, JaCoCo) and set a `coverage` threshold under the `reports` group. When the coverage falls below the defined percentage, CodeBuild automatically marks the build as FAILED, which propagates to CodePipeline and stops the pipeline. This is the native, supported mechanism for failing builds based on test coverage without requiring custom scripting.

Answer

Add a post-build action in the buildspec that checks coverage and exits with non-zero if below threshold.

Answer

Enable CodeBuild's 'Test Reporting' feature and set a threshold in the CodeBuild project configuration.

Answer

Use a CodePipeline condition to check the test report artifact and fail the pipeline if coverage is low.

Question 12

A company uses AWS CodeCommit for source control and wants to enforce that all commits to the main branch are signed. The DevOps team has configured Git commit signing using GPG keys. However, some developers are able to push unsigned commits to main. What should the engineer do to enforce signed commits?

Accepted Answer

Use an AWS CodeCommit trigger with an AWS Lambda function that validates commit signatures and rejects unsigned commits.. AWS CodeCommit does not natively support a 'require signed commits' setting like GitHub or GitLab. To enforce signed commits, you must use a CodeCommit trigger that invokes an AWS Lambda function to validate the GPG signature of each commit pushed to the main branch. The Lambda function can parse the commit object, verify the signature using the developer's public key, and reject the push by returning an error if the commit is unsigned or the signature is invalid.

Answer

Set the 'requireSignedCommits' parameter in the repository configuration to 'true'.

Answer

Configure branch protection rules in IAM to deny push access to main unless the commit is signed.

Answer

Create a repository policy that denies git push actions unless the condition 'codecommit:References' and 'codecommit:SourceIp' match.

Question 13

A team uses AWS CodeBuild to build Docker images and push them to Amazon ECR. The buildspec.yml includes a post_build step that runs a security scan. The team wants to ensure that only images that pass the security scan are tagged as 'latest'. Which approach should be used?

Accepted Answer

In the post_build phase, run the security scan, and if it passes, tag the image with 'latest' and push.. It ensures that only images passing the security scan receive the 'latest' tag. By running the scan in the post_build phase and conditionally tagging only on success, the team avoids ever pushing a vulnerable image with the 'latest' tag. This approach follows the principle of atomic tagging, where the tag is applied only after all validation steps pass.

Answer

Build the image with the 'latest' tag first, then run the security scan. If it fails, delete the 'latest' tag.

Answer

Use ECR lifecycle policies to remove images that do not pass the security scan.

Answer

Tag the image with 'latest' only after the build phase, regardless of scan results.

Question 14

A company is implementing a CI/CD pipeline for a containerized application using AWS CodePipeline, CodeBuild, and Amazon ECS. The pipeline should automatically deploy to a staging environment and then, after manual approval, to production. The production environment uses an ECS service with rolling update deployment. Which TWO actions are necessary to achieve this?

Accepted Answer

Add a manual approval stage in CodePipeline between staging and production.. A manual approval stage in CodePipeline allows a human to review and approve the deployment before it proceeds to production, which is a common requirement for controlled rollouts. Option D is correct because the ECS-to-CodePipeline deploy action (using the ECS deploy provider) natively supports rolling update deployments by updating the ECS service with the new task definition, which aligns with the requirement for a rolling update strategy.

Answer

Use CloudFormation to deploy the ECS service with a rolling update policy.

Answer

Set up an ECS task definition with a sidecar container for health checks.

Answer

Configure CodeBuild to push the Docker image to Amazon ECR.

Question 15

A DevOps engineer is building a CI/CD pipeline for a PHP application that uses Amazon RDS for MySQL. The pipeline must run database migrations as part of the deployment. The team wants to ensure that if a migration fails, the deployment is rolled back and the database is restored to its previous state. Which THREE steps should the engineer implement?

Accepted Answer

Take a snapshot of the RDS database before the migration.. Taking a manual snapshot of the RDS database before the migration provides a reliable restore point. If the migration fails, you can restore the database from this snapshot to its previous state, ensuring data integrity and enabling a clean rollback.

Answer

Use CloudFormation with a custom resource to run the migration.

Answer

Use AWS Database Migration Service (DMS) to replicate the database continuously.