DOP-C02 SDLC Automation Practice Test 19 — 15 Questions

Question 1

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the 'ValidateService' lifecycle event. The CloudWatch Agent reports that the target process is running but the health check endpoint returns HTTP 503. The CodeDeploy agent logs show no errors. What is the most likely cause of the failure?

Accepted Answer

The application is not fully functional due to missing configuration files. Option B is correct because the health check is failing (HTTP 503) even though the process is running, indicating the application is not serving traffic properly, likely due to missing dependencies or configuration. Option A is incorrect because CodeDeploy agent logs showed no errors. Option C is incorrect because Auto Scaling group health checks are separate from CodeDeploy's validation. Option D is incorrect because the process is running.

Answer

The Auto Scaling group is not healthy

Answer

The CodeDeploy agent is not installed on the instances

Answer

The target process is not listening on the expected port

Question 2

A DevOps team uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild that generates the website files, and a deploy stage that copies files to an S3 bucket. The team wants to add a manual approval step before the deploy stage. What should the engineer do?

Accepted Answer

Add an approval action in the pipeline stage before deploy. Option C is correct because an approval action in CodePipeline pauses the pipeline until manually approved. Option A is incorrect because CodeBuild does not support manual approval. Option B is incorrect because S3 events cannot pause a pipeline. Option D is incorrect because the pipeline needs to pause, not just notify.

Answer

Use Amazon SNS to send a notification and rely on a Lambda function to resume

Answer

Add a CodeBuild action that waits for an SNS confirmation

Answer

Configure the S3 bucket to send an event to the pipeline after upload

Question 3

A company uses AWS CloudFormation to manage infrastructure. The DevOps engineer wants to ensure that stack updates are rolled back if a new Amazon RDS instance fails to be created. Which CloudFormation feature should the engineer use?

Accepted Answer

Add a CreationPolicy to the RDS instance with a timeout. Option D is correct because CreationPolicy with a timeout ensures that a resource is fully created before continuing; if it fails, the stack rolls back. Option A is incorrect because StackPolicy only prevents updates to specific resources. Option B is incorrect because WaitCondition is used for external signals, not for resource creation. Option C is incorrect because it does not force a rollback if creation fails.

Answer

Use a WaitCondition and a WaitHandle to pause creation

Answer

Set the RDS instance's DeletionPolicy to Retain

Answer

Define a StackPolicy that denies updates to the RDS instance

Question 4

A DevOps engineer is troubleshooting a slow AWS CodeBuild project. The build is a Java application that compiles source code and runs tests. The build environment uses a general1.large compute type. The build duration has increased from 5 minutes to 15 minutes over the past month. The engineer notices that the build logs show 'Downloading...' messages for Maven dependencies for several minutes. What is the most cost-effective way to reduce the build time?

Accepted Answer

Enable local caching in the CodeBuild project for dependencies. Option C is correct by enabling local caching for Maven dependencies, which eliminates repeated downloads. Option A is incorrect because increasing compute type might not solve the download bottleneck. Option B is incorrect because VPC peering does not affect dependency download speed from public repositories. Option D is incorrect because CodeArtifact would still require downloading from the repository.

Answer

Configure the build to use a VPC with a NAT gateway

Answer

Use AWS CodeArtifact as a proxy for Maven dependencies

Answer

Change the compute type to general1.2xlarge

Question 5

A company uses AWS CodeDeploy with a blue/green deployment configuration. The engineer wants to automatically roll back the deployment if the new instances fail the health check for 5 minutes. Which setting should the engineer configure?

Accepted Answer

Configure the deployment group to roll back when a CloudWatch alarm is triggered. Option B is correct because CodeDeploy blue/green deployments can automatically roll back based on CloudWatch alarms. Option A is incorrect because creating an alarm alone does not trigger rollback; CodeDeploy must be configured to use it. Option C is incorrect because Auto Scaling group health checks are separate. Option D is incorrect because CodeDeploy does not have a built-in timeout for health checks; it uses alarms.

Answer

Create a CloudWatch alarm that monitors the health check endpoint

Answer

Set the Auto Scaling group health check grace period to 5 minutes

Answer

Set the deployment configuration's 'timeout' to 5 minutes

Question 6

A development team uses AWS CodeCommit and wants to enforce that all commits include a JIRA issue key in the commit message. They want to reject any push that does not contain a valid JIRA key. Which approach should the engineer use?

Accepted Answer

Use a Lambda function triggered by CodeCommit push events that calls codecommit:PutRepositoryTriggers to reject. Option D is correct because CodeCommit can trigger a Lambda function on push events, and the Lambda can validate commit messages and reject the push. Option A is incorrect because pre-commit hooks are client-side and not enforced by AWS. Option B is incorrect because CodeCommit does not support server-side hooks natively. Option C is incorrect because CloudWatch Events can trigger Lambda but not reject pushes directly.

Answer

Create a CloudWatch Events rule that triggers a Lambda function on push

Answer

Use AWS CodeCommit hooks to validate commit messages

Answer

Configure a pre-commit hook in the Git client

Question 7

A company uses AWS CodePipeline with an Amazon S3 source action. The pipeline deploys to an Amazon ECS Fargate service. The engineer notices that the pipeline does not automatically start when a new object is uploaded to the S3 bucket. The S3 bucket versioning is enabled. What is the most likely cause?

Accepted Answer

The S3 bucket does not have event notifications configured for the pipeline. Option A is correct because CodePipeline S3 source action requires change detection via Amazon CloudWatch Events or S3 Event Notifications. If the S3 bucket does not have event notifications configured, the pipeline will not trigger automatically. Option B is incorrect because versioning is not required for triggering. Option C is incorrect because the pipeline can still start manually. Option D is incorrect because Fargate does not affect pipeline triggering.

Answer

The pipeline has manual approval required before the source stage

Answer

S3 versioning is not enabled on the bucket

Answer

The ECS service is not configured for blue/green deployments

Question 8

A DevOps engineer is designing a CI/CD pipeline for a containerized application using AWS CodeBuild and Amazon ECS. Which TWO actions will help reduce the frequency of Docker image pulls from the public Docker Hub registry?

Accepted Answer

Store the base image in Amazon ECR and use it in the build. Options A and B are correct. Option A: Using a VPC with a NAT gateway does not reduce pulls. Option C: CodeArtifact can cache images, reducing pulls from Docker Hub. Option D: CodeBuild local caching can cache layers, reducing pulls. Option E: ECR is a registry, not a cache for Docker Hub.

Answer

Create a Docker Hub access token and store it in AWS Secrets Manager

Answer

Enable CodeBuild local caching for the cache type 'LOCAL_DOCKER_LAYER_CACHE'

Answer

Configure CodeBuild to use a VPC with a NAT gateway

Question 9

A company uses AWS CloudFormation to deploy a multi-tier application. The engineer wants to ensure that the stack is not accidentally deleted and that critical resources like databases are retained even if the stack is deleted. Which THREE steps should the engineer take?

Accepted Answer

Create a StackPolicy that denies updates to the RDS instance. Options A, C, and D are correct. Option A: Enable termination protection to prevent stack deletion. Option C: Set DeletionPolicy to Retain on the RDS instance so it is not deleted. Option D: Use a StackPolicy to protect resources from updates. Option B is incorrect because stack policy does not prevent deletion. Option E is incorrect because nested stacks do not provide protection.

Answer

Use nested stacks to isolate the database

Answer

Use a StackPolicy to deny delete actions

Question 10

A DevOps team uses AWS CodePipeline with an Amazon S3 source action. The pipeline deploys a static website to an S3 bucket. The engineer wants to ensure that only approved changes are deployed to production. The team uses Git feature branches and wants to deploy only when a pull request is merged to the main branch. Which THREE actions should the engineer take?

Accepted Answer

Configure a CloudWatch Events rule to start the pipeline when a CodeCommit pull request is merged. Options A, C, and D are correct. Option A: Use CodeCommit as the source and configure a trigger for pull request merge events. Option C: Add a manual approval stage before deployment. Option D: Use a CloudWatch Events rule to trigger the pipeline on pull request merge. Option B is incorrect because it would deploy from any branch. Option E is incorrect because it does not enforce approval.

Answer

Use an S3 source and configure event notifications for all object uploads

Answer

Set the pipeline to execute on every push to any branch

Question 11

Refer to the exhibit. A DevOps engineer is troubleshooting a cross-account deployment where an AWS CodeBuild project in Account A needs to upload build artifacts to an S3 bucket in Account B. The engineer attaches this IAM policy to the CodeBuild service role in Account A. However, the upload fails. What is the most likely reason?

Accepted Answer

The condition requires bucket-owner-full-control ACL, but the bucket policy may not allow it. Option C is correct because the policy only allows PutObject with the condition that the ACL is 'bucket-owner-full-control'. If the bucket policy in Account B does not accept objects with that ACL, the upload might fail. Option A is incorrect because the action is PutObject. Option B is incorrect because GetObject is not needed for upload. Option D is incorrect because the bucket policy is not shown.

Answer

The bucket policy in Account B grants s3:PutObject to Account A

Answer

The policy does not include s3:PutObjectAcl permission

Answer

The policy does not include s3:GetObject permission

Question 12

Refer to the exhibit. A DevOps engineer runs the above commands. The build project 'my-project' uses an S3 bucket as source and another S3 bucket for artifacts. The build fails with an 'Access Denied' error when trying to download the source code. What is the most likely cause?

Accepted Answer

The service role does not have s3:GetObject permission on the source bucket. Option B is correct because the service role must have s3:GetObject permission on the source bucket. Option A is incorrect because the source type is S3, not CodeCommit. Option C is incorrect because the encryption key is the default S3 key, not a custom KMS key. Option D is incorrect because the source bucket is specified.

Answer

The encryption key is a KMS key that the role cannot access

Answer

The source type is S3, but the project expects CodeCommit

Answer

The source location is incorrect

Question 13

Refer to the exhibit. A DevOps engineer deploys this CloudFormation template. The EC2 instance launches, but the httpd service does not start. The engineer connects to the instance and finds that the user data script did not run. What is the most likely cause?

Accepted Answer

The AMI does not have yum installed. Option D is correct because the default AMI for t2.micro may be Amazon Linux 2, which uses 'dnf' or 'amazon-linux-extras' instead of 'yum'. Option A is incorrect because the syntax looks correct. Option B is incorrect because SystemD is used. Option C is incorrect because tags do not affect user data execution.

Answer

The UserData is not base64 encoded correctly

Answer

The tags prevent user data from executing

Answer

The AMI uses a different init system than systemd

Question 14

A company uses AWS CodePipeline with an Amazon S3 source, AWS CodeBuild, and AWS CodeDeploy. The deployment stage fails intermittently with the error 'Deployment failed because the deployment group does not exist'. The pipeline has been working for months. What is the MOST likely cause?

Accepted Answer

The pipeline's cross-region action configuration references the deployment group in a different region without specifying the region.. Option D is correct because the deployment group ARN is passed as a parameter; if the region is not specified, the default region may differ from the pipeline's region. Option A is wrong because IAM permissions are not tied to region. Option B is wrong because the deployment group name is not case-sensitive. Option C is wrong because the pipeline is not being recreated, only the deployment group reference changes.

Answer

The deployment group name contains a typo in the pipeline definition.

Answer

The IAM role for CodePipeline does not have sufficient permissions in all regions.

Answer

The pipeline was recreated without specifying the deployment group.

Question 15

A development team uses AWS CodeCommit as a source repository for their AWS CodePipeline. They want to automatically trigger a pipeline execution when a new branch is created. Which solution should they implement?

Accepted Answer

Use Amazon CloudWatch Events to trigger the pipeline on a CodeCommit 'Reference Created' event.. Option B is correct because CloudWatch Events can trigger on code commit events like branch creation. Option A is wrong because webhooks are for third-party sources. Option C is wrong because polling is inefficient and not best practice. Option D is wrong because S3 events are for S3 source, not CodeCommit.

Answer

Create an S3 event notification to invoke the pipeline when a branch is created.

Answer

Configure a webhook in CodePipeline to detect branch creation events.

Answer

Set up a polling mechanism in CodePipeline to check for new branches every minute.