DOP-C02 SDLC Automation Practice Test 19 — 15 Questions

Question 1

A company uses AWS CodeCommit for source control. Developers need to automatically run tests on every push to a feature branch, but only if the push includes changes to the 'src/' directory. Which TWO AWS services can be used together to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CodePipeline. AWS CodePipeline can be configured to trigger a pipeline execution when a push occurs to a specific branch in CodeCommit, and it supports path-based filtering using the 'PathFilter' condition in the source action. By combining CodePipeline with AWS Lambda, you can run custom validation logic (e.g., checking if changes are within the 'src/' directory) before invoking further actions like tests. This pair allows you to conditionally run tests only when the push includes changes to 'src/'.

Answer

Amazon CloudWatch Logs

Answer

AWS CodeDeploy

Answer

AWS CodeBuild

Question 2

A company uses AWS CloudFormation to manage infrastructure. The development team wants to promote changes from a development environment to a production environment using change sets. They need to ensure that the production stack is not updated if there are any changes to the stack's IAM policies. Which approach should the team use?

Accepted Answer

Create a ChangeSet from the updated template, review the changes for IAM modifications, and execute only if no IAM changes are present.. AWS CloudFormation change sets allow you to review the proposed changes to a stack before executing them. By creating a change set from the updated template, the team can inspect the list of changes and specifically look for any modifications to IAM resources (e.g., AWS::IAM::Role, AWS::IAM::Policy). If the change set contains IAM-related changes, they can choose not to execute it, thereby preventing unintended updates to the production stack's IAM policies.

Answer

Enable drift detection on the production stack and compare with the development stack.

Answer

Use AWS CloudFormation StackSets to deploy to multiple accounts and use stack instance filters.

Answer

Use a custom resource in the template that checks for IAM changes and fails the update.

Question 3

A developer is using AWS CodeBuild to compile code. The build takes a long time because dependencies are downloaded each time. What can the developer do to reduce build time?

Accepted Answer

Enable caching in the build project to store dependencies in Amazon S3.. Enabling caching in AWS CodeBuild allows the build project to store frequently downloaded dependencies (e.g., Maven, npm, pip packages) in an Amazon S3 bucket. On subsequent builds, CodeBuild retrieves the cached dependencies from S3 instead of re-downloading them from the internet, which significantly reduces build time. This is the most direct and efficient solution for the described problem of repeated dependency downloads.

Answer

Split the build into multiple parallel build actions.

Answer

Use multiple build environments to distribute the work.

Answer

Use a larger compute type for the build project.

Question 4

A company runs a critical e-commerce application on AWS. They use AWS CodePipeline to manage deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy to an Auto Scaling group). Recently, a deployment caused a 5-minute outage because the new application version had a bug that caused the health checks to fail. The Auto Scaling group marked instances as unhealthy and replaced them, but during the replacement, traffic was routed to the remaining instances, which also failed health checks, causing a full outage. The company wants to implement a deployment strategy that prevents any traffic from being routed to unhealthy instances and automatically rolls back if the deployment fails. They also want to minimize deployment time and cost. Which solution should the DevOps team implement?

Accepted Answer

Use CodeDeploy blue/green deployment with automatic rollback enabled. The correct solution is to use a blue/green deployment with CodeDeploy and automatic rollback enabled. In a blue/green deployment, a new Auto Scaling group (green) is created alongside the existing one (blue). Traffic is shifted to the green group only after all health checks pass. If health checks fail, the deployment is automatically rolled back by terminating the green group, ensuring no traffic is routed to unhealthy instances. This prevents any outage. Option B (in-place deployment with rollback) updates instances in place, which can cause downtime if instances fail health checks, as the Auto Scaling group replaces them sequentially, potentially routing traffic to unhealthy instances. Option A (manual approval) slows down deployment and does not automate rollback based on health checks. Option D (increasing health check grace period) only delays detection of failures and does not prevent traffic from being routed to unhealthy instances.

Answer

Add a manual approval step in CodePipeline before deploy

Answer

Use CodeDeploy in-place deployment with automatic rollback enabled

Answer

Increase the health check grace period in the Auto Scaling group

Question 5

A company uses AWS CloudFormation to manage infrastructure as code. They have a stack that creates an Amazon RDS database instance. The database password is stored as a parameter in AWS Systems Manager Parameter Store. The CloudFormation template references the parameter using the 'resolve:ssm' dynamic reference. Recently, a security audit found that the password was exposed in plaintext in the CloudFormation stack outputs. The team wants to prevent sensitive information from being displayed in stack outputs or logs. Which approach should be taken?

Accepted Answer

Remove the output from the CloudFormation stack. The exposure occurred because the sensitive value was placed in the CloudFormation stack Outputs section, which is always visible in plaintext via the console, CLI (describe-stacks), and API regardless of NoEcho or KMS. The only reliable fix is to remove the sensitive value from Outputs entirely and instead surface it through a secure channel such as Secrets Manager, SSM Parameter Store (SecureString), or a custom resource. NoEcho only masks parameter values in the console/API during stack operations — it does not protect Outputs.

Answer

Set the 'NoEcho' property to 'true' for the parameter in the template

Answer

Store the password in AWS Secrets Manager and reference it in the template

Answer

Encrypt the output value using AWS KMS

Question 6

An organization uses AWS CodePipeline to deploy a web application. The pipeline includes a test stage that runs integration tests using AWS CodeBuild. The tests are flaky and sometimes fail due to external dependencies. The team wants to automatically retry failed tests before marking the stage as failed. How should this be achieved?

Accepted Answer

Configure the CodeBuild project to automatically retry the build on failure.. AWS CodeBuild natively supports automatic retries on build failure through the 'auto retry limit' configuration. By setting this limit (e.g., 3), CodeBuild will automatically re-run the build if it fails, which directly addresses flaky tests without requiring additional pipeline stages or external event handling. This keeps the retry logic within the same pipeline execution, ensuring that the test stage only fails after exhausting all retry attempts.

Answer

Add a manual approval step after the test stage.

Answer

Use Amazon CloudWatch Events to listen for test failures and trigger a new pipeline execution.

Answer

Create a second pipeline that triggers only on test failures.

Question 7

A startup is using AWS CodeBuild to build and test their application. The build process takes about 10 minutes. Recently, they noticed that some builds are failing randomly with the error 'Could not download dependencies'. The build environment uses a custom Docker image stored in Amazon ECR. The team suspects that the issue is due to network connectivity problems when pulling the Docker image or dependencies from the internet. They want to ensure reliable and faster builds. Which solution should they implement?

Accepted Answer

Configure CodeBuild to use a VPC with a NAT gateway. To improve reliability and speed, configure CodeBuild to use a VPC with a NAT gateway. This provides consistent internet access for pulling dependencies and Docker images, and allows using VPC endpoints for Amazon ECR, reducing network failures. Option D is correct. Option A (using a public Docker Hub) does not address the underlying network issues and may introduce additional points of failure. Option B (increasing build timeout) does not fix the root cause of connectivity problems. Option C (using a larger compute type) does not resolve network connectivity issues.

Answer

Switch to using a public Docker image from Docker Hub

Answer

Increase the build timeout in CodeBuild project settings

Answer

Use a larger compute type for the CodeBuild project

Question 8

A company uses AWS CodeCommit and wants to enforce that all commits to the 'main' branch are signed with a GPG key. Which steps should the DevOps engineer take to enforce this?

Accepted Answer

Create an IAM policy that denies git push actions unless the commit is signed.. AWS CodeCommit integrates with IAM to evaluate policies at the time of a `git push`. By creating an IAM policy that uses the `codecommit:GitPush` action with a `ForAnyValue:StringLike` condition key `codecommit:References` set to `refs/heads/main` and a `Bool` condition on `codecommit:IsSigned` set to `true`, you can deny pushes that are not signed. This enforces GPG signature verification at the IAM authorization layer, blocking unsigned commits before they reach the repository.

Answer

Use the AWS CLI to verify commit signatures and reject pushes.

Answer

Enable CloudWatch Logs to monitor commits and trigger a Lambda to rollback.

Answer

Configure a pre-receive hook in CodeCommit to reject unsigned commits.

Question 9

A DevOps engineer is tasked with automating the deployment of a microservices architecture. Each service is packaged as a Docker container. The team wants to use AWS CodePipeline and AWS CodeBuild to build Docker images and push them to Amazon ECR, then deploy to Amazon ECS. What should the CodeBuild buildspec file include to push the image to ECR?

Accepted Answer

Docker build and docker push commands with AWS CLI to authenticate to ECR.. To push a Docker image to Amazon ECR, the buildspec must first authenticate Docker to the ECR registry using the AWS CLI's `aws ecr get-login-password` command piped to `docker login`, then build the image with `docker build`, tag it with the ECR repository URI, and finally push it with `docker push`. CodeBuild does not have a built-in 'ecr-push' action; it relies on executing these standard Docker and AWS CLI commands in the build phases.

Answer

A call to the AWS CodeDeploy API to push the image.

Answer

An invocation of the AWS ECS RunTask API.

Answer

A buildspec phase with 'ecr-push' action.

Question 10

A company is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from GitHub, a build stage using AWS CodeBuild, and a deploy stage using AWS Elastic Beanstalk. The team wants to ensure that the pipeline only proceeds if the code quality checks pass and unit tests are successful. Which TWO actions should be taken?

Accepted Answer

Add a test stage in the pipeline with a CodeBuild action that runs code quality and unit tests.. Adding a dedicated test stage with a CodeBuild action allows the pipeline to explicitly run code quality checks and unit tests as a separate, visible step. This ensures the pipeline only proceeds to deployment if these tests pass, as CodeBuild can be configured to fail the action on non-zero exit codes from test commands. Option C is also correct because modifying the buildspec file in the existing build stage to include test commands and setting the build to fail on test failures integrates quality gates directly into the build process, which is a common and valid approach for enforcing test success before deployment.

Answer

Add a manual approval step before the deploy stage.

Answer

Configure the source stage to use an S3 bucket and add a test action.

Answer

Use AWS CloudFormation to create a test environment and run tests.

Question 11

A DevOps team is using AWS CodeBuild to run integration tests against a test database. The database is an Amazon RDS instance in a private subnet. The CodeBuild project is configured to run in a VPC. Which THREE steps are required to allow CodeBuild to access the RDS instance?

Accepted Answer

Ensure the security group attached to the RDS instance allows inbound traffic from the CodeBuild security group.. The security group attached to the RDS instance must explicitly allow inbound traffic from the security group associated with the CodeBuild project's elastic network interfaces. This is a fundamental network access control in AWS: security groups act as virtual firewalls, and without an inbound rule permitting traffic from the CodeBuild security group on the database port (e.g., 3306 for MySQL), the connection will be blocked regardless of other network configurations.

Answer

Place the RDS instance in a public subnet with a public IP.

Answer

Attach a NAT gateway to the VPC so that CodeBuild can route to RDS.

Question 12

A DevOps team uses AWS CodePipeline with an S3 source action and CodeBuild as a build provider. The pipeline has a manual approval step before deployment. Recently, the team noticed that the pipeline automatically starts when a new object is uploaded to the S3 bucket, even if the object is not the source code. They want to ensure that the pipeline only triggers on changes to the source code directory. What is the MOST efficient solution?

Accepted Answer

Configure the S3 event notification to use a prefix filter that matches the source code directory.. S3 event notifications support prefix and suffix filters, allowing you to specify that only objects uploaded to a particular directory (e.g., 'source-code/') trigger the event. By configuring the S3 event notification with a prefix filter matching the source code directory, the pipeline will only start when a new object is uploaded to that specific path, ignoring uploads to other directories. This is the most efficient solution as it avoids unnecessary pipeline executions without adding extra components or manual intervention.

Answer

Use Amazon CloudWatch Events to create a custom rule that matches the source code path and triggers the pipeline.

Answer

Enable versioning on the S3 bucket and configure the pipeline to use the latest version.

Answer

Disable the S3 trigger and manually start the pipeline after each code commit.

Question 13

An organization uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild that minifies assets), and a deploy stage (S3 deployment). The team wants to add a stage for running security vulnerability scans on the code. Which TWO options are viable?

Accepted Answer

Add a custom action in the pipeline that invokes a third-party scanning service via AWS Lambda.. AWS CodePipeline supports custom actions that can invoke external services via AWS Lambda. By creating a custom action, the team can integrate a third-party security scanning service directly into the pipeline, allowing the scan to run as a distinct stage between build and deploy. This approach ensures that the pipeline fails if vulnerabilities are detected, preventing insecure code from reaching the S3 bucket.

Answer

Enable AWS Shield Advanced to scan for vulnerabilities.

Answer

Use Amazon Inspector to scan the source code.

Answer

Add an S3 event notification to trigger a Lambda function that scans the S3 bucket.

Question 14

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration uses a linear traffic shifting with a 10-minute interval. The application logs show that the new version of the application crashes on startup. What is the MOST effective way to handle this situation to ensure successful future deployments?

Accepted Answer

Add a script in the AppSpec file's 'Validate Service' lifecycle hook to check the application health and fail the deployment if the application does not start successfully.. The 'Validate Service' lifecycle hook in the AppSpec file runs after the application is installed and started, allowing you to execute a custom script that verifies the application is healthy. If the script detects that the new version crashes on startup, it can return a non-zero exit code, which causes CodeDeploy to mark that instance as failed and trigger the deployment failure. This provides an early, automated validation that prevents the deployment from proceeding with a broken application, directly addressing the root cause of the crash.

Answer

Increase the interval in the linear traffic shifting to 30 minutes to allow more time for instances to stabilize.

Answer

Configure the deployment to automatically roll back when a failure occurs and ignore the error.

Answer

Switch to a blue/green deployment strategy to minimize the impact on existing instances.

Question 15

A company is using AWS CodeBuild to compile and test code. The buildspec.yml file includes a pre_build phase that installs dependencies and a build phase that runs the compilation. The tests are run in the post_build phase. The team wants to improve the security of the build process by ensuring that sensitive information such as database passwords is not exposed in the build logs. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Use AWS Systems Manager Parameter Store to store the secrets and reference them in the buildspec using the 'parameter-store' field.. Option A is correct because CodeBuild natively supports the 'parameter-store' field in buildspec.yml, which retrieves values from AWS Systems Manager Parameter Store at build time and injects them as environment variables without printing them in the logs; the build's service role needs ssm:GetParameters permissions. Option B is correct because CodeBuild also supports the 'secrets-manager' field, which fetches secrets from AWS Secrets Manager during the build and masks them in the logs, requiring secretsmanager:GetSecretValue permissions. Option C is not correct because restricting who can view logs does not prevent secrets from being written into the logs in the first place, so the exposure risk remains. Option D is not correct because S3 encryption at rest protects stored log objects but does not stop secrets from appearing in plaintext within the logs. Option E is not correct because plain-text environment variables are visible in the CodeBuild console and can be echoed into build logs, directly exposing the sensitive values.

Answer

Restrict access to the build logs by using IAM policies to only allow specific users to view them.

Answer

Enable encryption at rest for the CodeBuild project's S3 logs.

Answer

Store the secrets as plain-text environment variables in the CodeBuild project.