DOP-C02 SDLC Automation Practice Test 18 — 15 Questions

Question 1

A company is implementing a CI/CD pipeline using AWS CodePipeline. The source code is stored in an AWS CodeCommit repository. The pipeline must automatically start whenever a change is pushed to any branch. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch Events rule that matches CodeCommit push events and targets the CodePipeline pipeline.. AWS CodePipeline can be triggered automatically by Amazon CloudWatch Events when a CodeCommit repository receives a push event. By creating a CloudWatch Events rule that matches the `codecommit:GitPush` event source and targets the pipeline, the pipeline starts automatically on any branch push without polling or manual intervention.

Answer

Add a branch creation trigger in CodeCommit that starts the pipeline.

Answer

Create an SNS topic and subscribe the pipeline to it, then configure CodeCommit to publish to the topic on push.

Answer

Configure the pipeline to poll the CodeCommit repository every few minutes.

Question 2

A DevOps engineer is creating an AWS CloudFormation template to deploy a stack that includes an Amazon EC2 instance. The instance needs to be launched in a specific subnet. How should the engineer reference the subnet ID in the template?

Accepted Answer

Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.. Defining a parameter of type `AWS::EC2::Subnet::Id` allows the CloudFormation template to accept a subnet ID as input at stack creation or update time, making the template reusable across different environments without modification. This approach follows infrastructure-as-code best practices by avoiding hardcoded values and enabling parameterized deployments.

Answer

Hardcode the subnet ID in the template.

Answer

Use a mapping (Mappings) to define the subnet ID based on the stack name.

Answer

Use the Fn::GetAtt function to retrieve the subnet ID from a VPC resource.

Question 3

A startup is using AWS CodePipeline to deploy a Python web application to AWS Elastic Beanstalk. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (Elastic Beanstalk). The build stage runs unit tests and creates a deployable zip file. The deploy stage uses the Elastic Beanstalk deploy provider. Recently, the deploy stage started failing with the error: 'The API call 'elasticbeanstalk:CreateApplicationVersion' failed with status 403.' The CodePipeline service role has the following permissions: 'elasticbeanstalk:DescribeApplications', 'elasticbeanstalk:DescribeEnvironments', 'elasticbeanstalk:UpdateEnvironment'. What should the DevOps engineer do to resolve the issue?

Accepted Answer

Add the 'elasticbeanstalk:CreateApplicationVersion' and 'elasticbeanstalk:DeleteApplicationVersion' permissions to the CodePipeline service role. The 403 error on elasticbeanstalk:CreateApplicationVersion indicates the CodePipeline service role lacks that specific IAM action. Elastic Beanstalk's deploy provider calls CreateApplicationVersion to register the new application revision, and it also calls DeleteApplicationVersion during cleanup of old revisions. Adding both permissions to the CodePipeline service role resolves the authorization failure without changing the pipeline architecture.

Answer

Change the deploy provider to use CodeDeploy instead of Elastic Beanstalk

Answer

Add 's3:PutObject' permission to the CodePipeline service role to allow it to upload the zip file to S3

Answer

Update the Elastic Beanstalk environment's service role to allow CodePipeline to deploy

Question 4

Which TWO actions should a DevOps engineer take to ensure that an AWS CodeBuild project's artifacts are automatically deployed to an Amazon S3 bucket with server-side encryption using AWS KMS? (Choose 2.)

Accepted Answer

In the buildspec.yaml, set the 'artifacts' section to include 'encryptionDisabled: false' and specify the KMS key ID.. Setting 'encryptionDisabled: false' in the buildspec.yaml artifacts section explicitly enables encryption for the build output, and specifying the KMS key ID ensures that the artifacts are encrypted with that specific AWS KMS key. This configuration directly instructs CodeBuild to use server-side encryption with AWS KMS when uploading artifacts to S3.

Answer

Enable versioning on the S3 bucket.

Answer

Configure the S3 bucket policy to require HTTPS for all uploads.

Answer

Enable default encryption on the S3 bucket using SSE-KMS.

Question 5

A development team is using AWS CodeCommit as a source control repository. They want to automate the creation of a new feature branch whenever a developer creates a new Jira issue with a specific label. Which AWS service should be used to listen for Jira webhooks and trigger the branch creation?

Accepted Answer

AWS Lambda with Amazon API Gateway to receive the webhook. AWS Lambda with Amazon API Gateway is the correct choice because API Gateway can expose a public HTTPS endpoint that Jira can send webhook POST requests to. The Lambda function then processes the incoming payload, checks for the specific label, and uses the AWS SDK to create a new branch in CodeCommit. This provides a real-time, event-driven integration without polling or scheduled checks.

Answer

Amazon EventBridge to schedule a rule every minute

Answer

AWS CodePipeline to poll for new Jira issues

Answer

AWS CodeBuild to run a build when a webhook is received

Question 6

A company uses AWS CodePipeline with multiple stages: source, build, test, and deploy. The test stage takes 45 minutes to complete. Developers complain that the pipeline takes too long to provide feedback. The team wants to run tests in parallel across multiple environments. Which approach should be taken to reduce the pipeline execution time?

Accepted Answer

Configure the test stage with parallel actions in CodePipeline. AWS CodePipeline supports parallel actions within a stage, allowing multiple test environments (e.g., different OS or browser configurations) to run simultaneously. This reduces the overall pipeline execution time from the sum of sequential tests to the duration of the longest single test (45 minutes), provided the parallel actions are independent. By configuring the test stage with parallel actions, the team can achieve faster feedback without altering the underlying test logic or infrastructure.

Answer

Increase the compute capacity of the test environment

Answer

Use AWS CodeBuild batch builds with a single buildspec

Answer

Create multiple pipelines, each running a subset of tests

Question 7

Which TWO criteria must be met for an AWS CloudFormation stack update to be successful? (Choose 2.)

Accepted Answer

The update template must be valid and must not contain any syntax errors.. AWS CloudFormation validates the template syntax and structure before initiating any stack update. If the template contains invalid JSON or YAML, references nonexistent resources, or violates intrinsic function rules, the update request is rejected immediately. This validation ensures that only syntactically correct templates proceed to the update operation.

Answer

The stack must be in a steady state with no previous failed updates.

Answer

A change set must be created and executed before the update.

Answer

The stack must have no drift detected.

Question 8

An organization is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target group is not configured correctly. Which CodeDeploy component is responsible for registering instances with the load balancer?

Accepted Answer

The deployment group configuration. The deployment group configuration in AWS CodeDeploy specifies the target group or load balancer for the deployment. CodeDeploy automatically registers instances in the Auto Scaling group with the specified target group as part of the deployment process. The AppSpec file hooks section defines custom lifecycle event hooks for scripts, but instance registration is handled by the CodeDeploy service based on the deployment group settings, not by hooks.

Answer

The CodeDeploy agent configuration

Answer

The AppSpec file hooks section

Answer

The application revision bundle

Question 9

A DevOps engineer is troubleshooting a failed AWS CloudFormation stack update. The stack contains an AWS::Lambda::Function resource. The update failed with the error 'Resource creation cancelled' after a timeout. The engineer wants to view the logs from the Lambda function during the stack update to diagnose the issue. What should the engineer do?

Accepted Answer

Access the CloudWatch Logs log group for the Lambda function. AWS Lambda automatically sends function execution logs to Amazon CloudWatch Logs. When a Lambda function is invoked during a CloudFormation stack update (e.g., via a custom resource or a function that runs as part of the update), all stdout, stderr, and logging statements are captured in a log group named /aws/lambda/<function-name>. Accessing this log group allows the engineer to view detailed error messages, stack traces, or timeout-related output that caused the 'Resource creation cancelled' failure.

Answer

Use AWS CodeBuild to build and test the function locally

Answer

Enable detailed CloudFormation logging in the stack template

Answer

Review the CloudFormation stack events in the AWS Management Console

Question 10

A development team is using AWS CodeCommit as a source repository and AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a build stage that runs on AWS CodeBuild. The team wants to automatically trigger the pipeline when changes are pushed to the 'develop' branch of the CodeCommit repository. Which configuration change should be made to the pipeline?

Accepted Answer

Configure the source action to use CodeCommit as the source provider and specify the 'develop' branch.. CodePipeline's source action can be configured to use CodeCommit as the source provider, and by specifying the 'develop' branch in the source action configuration, the pipeline will automatically start a new execution whenever a change is pushed to that branch. This is the native and recommended way to trigger a pipeline from a CodeCommit repository branch change, without needing additional webhooks or event notifications.

Answer

Enable S3 event notifications on the repository to invoke the pipeline.

Answer

Add a manual approval action before the build stage.

Answer

Create a CodeBuild webhook on the CodeCommit repository.

Question 11

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline deploys a static website to an S3 bucket. The deployment must ensure that the website is always available and that rollbacks happen automatically if the deployment fails. Which TWO actions should the company take?

Accepted Answer

Use a blue/green deployment strategy with two S3 buckets. A blue/green deployment strategy with two S3 buckets allows the company to maintain the current (blue) bucket serving the live website while deploying the new version to a separate (green) bucket. This ensures zero-downtime deployments and, if the deployment fails, traffic can simply remain pointed to the blue bucket, providing an automatic rollback without any manual intervention. Option D is correct because AWS CloudFormation can be configured with automatic rollback on failure, which will revert the stack to its last known good state if the deployment fails, ensuring the website remains available.

Answer

Use Amazon Route53 weighted routing to shift traffic

Answer

Use AWS CodeDeploy with an in-place deployment

Answer

Enable S3 bucket versioning to keep multiple versions

Question 12

A company uses AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The deployment consistently fails because the Lambda function's IAM role is not created before the function. The team uses a single CloudFormation template. Which action should be taken to resolve this dependency issue?

Accepted Answer

Add a DependsOn attribute in the CloudFormation template to ensure the IAM role is created before the Lambda function.. The CloudFormation template lacks an explicit dependency between the IAM role resource and the Lambda function resource. By adding a `DependsOn` attribute to the Lambda function resource, you ensure CloudFormation creates the IAM role first, resolving the deployment failure. This is the standard way to handle resource creation order within a single CloudFormation template.

Answer

Create the IAM role in a separate CodeBuild action before the deploy stage.

Answer

Add a wait condition in the CloudFormation template.

Answer

Separate the IAM role into a nested stack and reference it.

Question 13

An IAM policy is attached to a service role used by AWS CodePipeline. Which TWO statements about this policy are correct?

Accepted Answer

The policy allows starting a pipeline execution. The IAM policy attached to a CodePipeline service role must include permissions to allow the pipeline to start executions. The `codepipeline:StartPipelineExecution` action is required for the pipeline to be triggered by events or manual starts. Without this permission, the pipeline cannot initiate its execution flow.

Answer

The policy allows updating the pipeline definition

Answer

The policy allows starting any CodeBuild project

Answer

The policy allows reading and writing objects to any S3 bucket

Question 14

A DevOps engineer is setting up a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build environment requires specific software packages that are not available in the default CodeBuild environment. What is the MOST efficient way to customize the build environment?

Accepted Answer

Create a custom Docker image with the required software and push it to Amazon ECR.. Creating a custom Docker image with the required software and pushing it to Amazon ECR allows you to pre-configure the build environment with all necessary packages. This approach avoids the overhead of installing packages during each build, reduces build time, and ensures consistency across builds. AWS CodeBuild supports custom images from Amazon ECR, making this the most efficient method for customizing the environment.

Answer

Create a separate pipeline to pre-build the environment.

Answer

Add install commands in the buildspec file to install the packages during each build.

Answer

Modify the buildspec file to set environment variables that include the software packages.

Question 15

A DevOps team is implementing a CI/CD pipeline for a microservices architecture. Each microservice is built and deployed independently. The team wants to ensure that only one build runs per microservice at a time to avoid resource contention, and that the build artifacts are stored securely. Which THREE steps should the team take?

Accepted Answer

Enable versioning on the S3 bucket storing build artifacts. Option B is correct because enabling versioning on the S3 bucket preserves every revision of the build artifacts, allowing recovery of previous versions and protecting against accidental overwrites or deletions, which supports secure artifact storage. Option C is correct because configuring a concurrency limit in each microservice's CodeBuild project ensures only one build for that microservice runs at a time, directly preventing resource contention as required. Option E is correct because enabling server-side encryption on the S3 bucket encrypts artifacts at rest using AWS-managed or KMS keys, satisfying the requirement to store build artifacts securely. Option A is not correct because AWS CodeArtifact is a package/dependency repository for artifacts like npm, Maven, and PyPI packages, not the general build-artifact store used by CodePipeline, and the scenario's secure storage requirement is met by S3 with versioning and encryption. Option D is not correct because creating a separate CodePipeline per microservice supports independent deployment but does not by itself enforce one build at a time or secure artifact storage.

Answer

Store build artifacts in AWS CodeArtifact

Answer

Create a separate CodePipeline for each microservice