DOP-C02 SDLC Automation Practice Test 19 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a static website to Amazon S3 and CloudFront. The pipeline currently uses CodeBuild to run tests and then deploys to an S3 bucket. The team wants to add a stage that invalidates the CloudFront cache after deployment. Which TWO actions achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the AWS CLI command 'aws cloudfront create-invalidation' in a CodeBuild build step.. You can use the AWS CLI command 'aws cloudfront create-invalidation' in a CodeBuild build step to programmatically invalidate the CloudFront cache after deployment. This approach integrates seamlessly into the existing pipeline by adding a build action that runs the CLI command, ensuring the cache is cleared for updated objects in the S3 bucket.

Answer

Configure CodePipeline to directly invalidate CloudFront using a built-in action.

Answer

Create a CodePipeline stage with a deploy action to CloudFront.

Answer

Use CloudFront to automatically invalidate based on S3 events.

Question 2

Refer to the exhibit. An IAM policy is attached to a CodePipeline service role. When the pipeline tries to start a CodeBuild project, it fails with an 'AccessDenied' error. The CodeBuild project uses a different service role (arn:aws:iam::123456789012:role/CodeBuildServiceRole2). What is the MOST likely cause?

Accepted Answer

The policy only allows iam:PassRole for a specific role ARN, but the CodeBuild project uses a different role.. The pipeline's service role has an iam:PassRole action constrained to a specific role ARN via a condition key. When the pipeline attempts to start the CodeBuild project, it needs to pass the CodeBuild service role (arn:aws:iam::123456789012:role/CodeBuildServiceRole2) to CodeBuild. Because the policy only allows iam:PassRole for a different role (not this one), the pass fails, resulting in an AccessDenied error. Option D correctly identifies this issue.

Answer

The policy has a condition on the s3 actions that is not satisfied.

Answer

The policy does not allow codebuild:StartBuild for the specific project.

Answer

The policy does not allow s3:GetObject on the artifact bucket.

Question 3

Refer to the exhibit. A CodeBuild project uses this buildspec.yml to build and push a Docker image to Amazon ECR. The build fails at the pre_build phase with the error 'Error: Cannot perform an interactive login from a non TTY device'. What is the MOST likely issue?

Accepted Answer

The CodeBuild project's IAM role does not have permission to call ecr:GetAuthorizationToken.. The error 'Cannot perform an interactive login from a non TTY device' occurs when the `docker login` command is invoked without receiving the password via stdin. In the buildspec, `aws ecr get-login-password` is used to retrieve the password and pipe it to `docker login`. If the CodeBuild project's IAM role lacks the `ecr:GetAuthorizationToken` permission, this command fails silently or returns an error, causing `docker login` to fall back to interactive mode. Since CodeBuild runs in a non‑interactive environment, it throws the TTY error. Option B is correct because the missing permission prevents the password retrieval, leading to the login failure. Options A, C, and D do not directly cause this specific error.

Answer

The AWS_DEFAULT_REGION environment variable is not set in CodeBuild.

Answer

The buildspec.yml is missing the 'docker login' command.

Answer

The Docker daemon is not running on the CodeBuild instance.

Question 4

Refer to the exhibit. A CloudTrail log shows a failed GitPush event to a CodeCommit repository by the IAM user 'jenkins'. The DevOps engineer has attached the following IAM policy to the user: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "codecommit:*",
      "Resource": "*"
    }
  ]
}
What is the MOST likely reason for the failure?

Accepted Answer

The user has not generated a Git credential for CodeCommit in the IAM console.. The IAM policy allows all codecommit actions, but for Git operations via HTTPS, the user must have Git credentials (username/password) generated in the IAM console. Without these credentials, the Git client cannot authenticate, resulting in a failed GitPush event even though the IAM policy is permissive. Option A correctly identifies this as the most likely cause.

Answer

The user is trying to push via HTTPS but the repository only allows SSH.

Answer

The user's IAM policy includes a condition that restricts access based on source IP, and the push originates from a different IP.

Answer

The policy is attached but the user has a permissions boundary that denies codecommit:GitPush.

Question 5

A development team is using AWS CodeCommit as the source for a CI/CD pipeline. They want to automatically run unit tests when a pull request is created, but only for changes to the 'src' directory. Which approach should they use?

Accepted Answer

Set up an Amazon EventBridge rule that matches CodeCommit pull request events and invoke CodeBuild. Add a condition in the CodeBuild buildspec to check if changes are in 'src' directory.. AWS CodeCommit does not support CodeBuild webhooks. The correct solution is to create an Amazon EventBridge rule that matches CodeCommit pull request creation events (e.g., 'codecommit: PullRequestCreated') and triggers an AWS CodeBuild project. The buildspec must include a condition to check that the PR contains changes under 'src/' before running unit tests. This meets the requirement without relying on invalid webhook configuration.

Answer

Use an AWS Lambda function that polls CodeCommit for new pull requests and invokes CodeBuild when changes in 'src' directory are detected.

Answer

Create an AWS CodeBuild project with a source provider of CodeCommit and configure 'WEBHOOK' events with a filter for pull requests and path filter for 'src/**'.

Answer

Configure an AWS CodePipeline with a Source stage for CodeCommit and a Test stage for CodeBuild. Use a manual approval step to trigger on pull requests.

Question 6

A company uses AWS CodeBuild to compile Java applications. The builds often fail due to insufficient memory. The buildspec currently specifies 'compute-type: BUILD_GENERAL1_SMALL'. What is the most cost-effective solution to resolve the memory issues without changing the build logic?

Accepted Answer

Change the compute-type to 'BUILD_GENERAL1_MEDIUM' or 'BUILD_GENERAL1_LARGE' in the buildspec.. The most direct and cost-effective way to resolve insufficient memory in AWS CodeBuild is to increase the compute type to a larger size (e.g., BUILD_GENERAL1_MEDIUM or BUILD_GENERAL1_LARGE), which provides more memory without altering the build logic. This change incurs additional cost only when builds run, and it avoids unnecessary complexity or invalid approaches.

Answer

Enable Amazon S3 caching for the build artifacts to reduce memory usage.

Answer

Split the build into multiple parallel CodeBuild actions in the pipeline, each compiling a subset of the code.

Answer

Set the environment variable 'MEMORY_OVERPROVISION=2' in the buildspec.

Question 7

A DevOps engineer is designing a deployment pipeline for a microservices application on Amazon ECS. The team wants to use blue/green deployments with automatic rollback if CloudWatch alarms are triggered during the deployment. Which combination of services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with a blue/green deployment configuration on the ECS service, and configure automatic rollback when CloudWatch alarms are breached.. AWS CodeDeploy natively supports blue/green deployments on Amazon ECS services, and you can configure automatic rollback when CloudWatch alarms are triggered, meeting the team's requirements. Option B is incorrect because CloudFormation ChangeSets do not provide native blue/green deployment with automatic rollback based on alarms; custom Lambda functions add complexity. Option C is incorrect because CodeBuild is used for building artifacts, not deploying; manually updating the ECS service and using a Lambda for rollback is not a streamlined solution. Option D is incorrect because ECS service auto scaling handles scaling based on demand, not deployment strategies like blue/green.

Answer

Use AWS CloudFormation with a ChangeSet and a custom rollback Lambda function triggered by CloudWatch alarms.

Answer

Use AWS CodeBuild to run a build that creates a new task definition, then update the ECS service manually, and use CloudWatch alarms to trigger a rollback via a Lambda function.

Answer

Use Amazon ECS service auto scaling with step scaling policies based on CloudWatch alarms.

Question 8

A company uses AWS CodePipeline to deploy a static website to Amazon S3 and CloudFront. The pipeline currently uses CodeBuild to run tests and then deploys to an S3 bucket. The team wants to add a stage that invalidates the CloudFront cache after deployment. Which TWO actions achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket has versioning enabled, and the deploy action is trying to delete the bucket before syncing.. The 'BucketNotEmpty' error occurs when attempting to delete an S3 bucket that still contains objects. With versioning enabled, the deploy action attempts to delete the bucket before syncing new content, but the bucket cannot be deleted because it contains versioned objects or delete markers. Options B, C, and D are incorrect: B describes a non-standard feature, C would cause an AccessDenied error, and D also results in AccessDenied, not BucketNotEmpty.

Answer

The source artifact from CodeCommit contains a 'delete' manifest that instructs S3 to remove all files.

Answer

The CodePipeline service role does not have permission to list the bucket contents.

Answer

The S3 bucket has a bucket policy that denies DeleteObject permissions.

Question 9

A team uses AWS CloudFormation to manage infrastructure. They want to automatically update the stack when a new version of a Docker image is pushed to Amazon ECR. Which approach should they use?

Accepted Answer

Configure an Amazon EventBridge rule to detect ECR image pushes and invoke an AWS Lambda function that calls 'UpdateStack' with the new image URI.. Amazon EventBridge can detect ECR image push events and invoke a Lambda function that calls the UpdateStack API with the new image URI. This provides a serverless, event-driven automation directly integrated with CloudFormation. Option B is incorrect because a CodeBuild project triggered on ECR push would add unnecessary overhead and complexity; it is not the simplest or most direct approach for updating a stack. Option C is incorrect because AWS CodeDeploy is designed for deploying to compute services (like EC2, Lambda, or ECS), not for updating CloudFormation stacks. Option D is incorrect because Amazon SNS cannot directly update a CloudFormation stack; it would require a subscriber (e.g., Lambda) to process the notification and call UpdateStack, making the direct integration nonexistent.

Answer

Create a CodeBuild project that triggers on ECR push, and have the build execute an 'aws cloudformation update-stack' command.

Answer

Use AWS CodeDeploy with a trigger on ECR push to deploy the new image to a target group, and have the target group update the stack.

Answer

Set up an Amazon SNS topic subscribed to ECR image push events, and have the SNS topic send a notification to an AWS CloudFormation stack update endpoint.

Question 10

A company has a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build stage runs unit tests and produces a JUnit report. The pipeline includes a test action that publishes results to an S3 bucket. Recently, the pipeline started failing with the error: 'The action could not be started because the artifact bucket policy is misconfigured.' What is the most likely cause?

Accepted Answer

The artifact bucket's bucket policy does not grant the necessary permissions to the CodePipeline service role.. AWS CodePipeline requires the artifact bucket's bucket policy to grant the CodePipeline service role (or the pipeline's assumed role) permissions to perform actions like s3:GetObject, s3:PutObject, and s3:GetBucketVersioning. When the bucket policy is misconfigured—for example, missing a principal or action—the pipeline's test action cannot start, resulting in the specific error message. This is a common IAM/permissions issue rather than a regional or encryption key problem.

Answer

The S3 bucket has Amazon S3 Transfer Acceleration enabled, which is not supported by CodePipeline.

Answer

The KMS key used to encrypt the bucket objects has been rotated, causing the pipeline to lose access.

Answer

The artifact bucket is in a different AWS Region than the pipeline, and cross-region replication is not enabled.

Question 11

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They want to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Accepted Answer

Change Sets. Change Sets allow you to preview the proposed changes to a CloudFormation stack before executing them. This enables the DevOps team to review and approve modifications, ensuring that only validated updates are applied. By creating a change set, you can see exactly which resources will be added, modified, or deleted, and then decide whether to execute it.

Answer

Drift detection

Answer

Stack policies

Answer

StackSets

Question 12

A company uses AWS CodePipeline with a manual approval stage before deploying to production. The approval notification is sent via Amazon SNS. The approvers report that they are not receiving the email notifications. What should the DevOps engineer check first?

Accepted Answer

Confirm that the email subscriptions to the SNS topic have been confirmed by clicking the link in the initial confirmation email.. Amazon SNS requires that email subscribers confirm their subscription by clicking the link in the initial confirmation email before they can receive notifications. If the approvers never confirmed the subscription, the SNS topic will not deliver any messages to them, even though the pipeline and IAM permissions are correctly configured. This is the most common cause of missing SNS email notifications and should be the first check.

Answer

Ensure that the IAM role for CodePipeline has permission to publish to the SNS topic.

Answer

Verify that the SNS topic's subscription has a filter policy that matches the approval event.

Answer

Check the email recipients' mailbox quota to see if it is full.

Question 13

A company is implementing a CI/CD pipeline for a microservices architecture on Amazon ECS. The pipeline must deploy to multiple environments (dev, test, prod) in sequence with manual approval gates between environments. Which two AWS services should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS CodePipeline. AWS CodePipeline (A) is correct because it provides the orchestration framework to model the CI/CD pipeline with sequential stages for dev, test, and prod environments, including built-in support for manual approval gates between stages. AWS CodeDeploy (D) is correct because it integrates directly with CodePipeline to handle the actual deployment of containerized applications to Amazon ECS, supporting blue/green deployments and traffic shifting for microservices.

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Question 14

A DevOps team is using AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer, an Auto Scaling group, and an RDS database. They want to update the stack to change the instance type of the Auto Scaling group without downtime. Which three steps should they take? (Choose THREE.)

Accepted Answer

Create a new Auto Scaling group with the new instance type and attach it to the load balancer, then delete the old group.. Creating a new Auto Scaling group with the new instance type and attaching it to the same Application Load Balancer allows traffic to be gradually shifted to the new instances without interrupting existing connections. Once the new group is healthy and serving traffic, the old group can be safely deleted, achieving a zero-downtime migration. This approach avoids modifying the existing Auto Scaling group's launch configuration while it is still running instances.

Answer

Modify the RDS instance type to match the new EC2 instance type for consistency.

Answer

Terminate all instances in the Auto Scaling group before updating the launch configuration.

Question 15

A company uses AWS CodePipeline to automate their software release process. They want to add a stage that runs security scanning on the code before deployment. Which two AWS services can be integrated into the pipeline for this purpose? (Choose TWO.)

Accepted Answer

Amazon Inspector. Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It can be integrated into a CodePipeline stage to perform automated security scanning on the code or infrastructure before deployment, helping to identify issues early in the SDLC.

Answer

Amazon GuardDuty

Answer

Amazon Detective

Answer

AWS CodeDeploy