DOP-C02 SDLC Automation Practice Test 2 — 15 Questions

Question 1

An IAM policy is attached to a user who needs to manually start a CodePipeline execution. The pipeline uses an S3 bucket named 'my-artifact-bucket' for artifacts. The user reports that they cannot start the pipeline. Which action is missing from the policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

codepipeline:ListPipelines. The user needs to manually start a CodePipeline execution, which requires the `codepipeline:StartPipelineExecution` action. However, the question asks which action is missing from the policy, and the correct answer is `codepipeline:ListPipelines` because the user cannot even see the pipeline to start it. Without `codepipeline:ListPipelines`, the AWS Management Console or CLI will not return the pipeline in the list, preventing the user from selecting it to start execution. The other actions are either not directly required for starting a pipeline or are unrelated to the permission needed to list pipelines.

Answer

iam:PassRole

Answer

codepipeline:GetPipelineExecution

Answer

s3:PutObject

Question 2

A team uses AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. During a stack update, they need to modify the DB instance class but want to avoid downtime. Which update policy should they use?

Accepted Answer

Use a WaitCondition to delay the update until maintenance window.. Using a WaitCondition allows the stack update to be delayed until the RDS maintenance window. If the DB instance is in a Multi-AZ deployment, the instance class change occurs during the maintenance window, causing a failover that minimizes downtime. This approach balances the need to modify the instance class while avoiding significant downtime.

Answer

Use a CreationPolicy on the DB instance.

Answer

Use a stack policy to prevent replacement of the DB instance.

Answer

Use an UpdatePolicy with AutoScalingRollingUpdate.

Question 3

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot push to the 'MyRepo' repository. What is the likely reason?

Accepted Answer

The policy does not allow GitPush on the repository's branches.. The IAM policy shown in the exhibit likely includes a condition or resource restriction that limits the `codecommit:GitPush` action to specific branches, or the policy is missing the `codecommit:GitPush` action entirely. Without explicit permission to push to the repository's branches, the user will receive an access denied error when attempting to push changes. AWS CodeCommit uses IAM policies to control Git operations, and `GitPush` must be allowed on the repository ARN (e.g., `arn:aws:codecommit:region:account:MyRepo`) and optionally on specific branch references using conditions.

Answer

The user is not in the correct IAM group.

Answer

The user does not have GitPull permission on the repository.

Answer

The policy must include codecommit:CreateRepository action.

Question 4

Refer to the exhibit. A DevOps engineer runs the AWS CLI command to list deployments for an application. The output shows only 2 deployments, but the team knows there are more. How can the engineer retrieve the remaining deployments?

Accepted Answer

Use the --starting-token parameter with the value 'abc123' from the output.. The AWS CLI for `deploy list-deployments` uses pagination by default, returning only a subset of results (up to the `--max-items` limit, which defaults to 100 or fewer). The output includes a `NextToken` field (shown as `abc123` in the exhibit), which is an opaque token that must be passed to the `--starting-token` parameter in the next command to retrieve the subsequent page of deployments. This is the standard AWS pagination mechanism for listing APIs.

Answer

Increase the --max-items value to a larger number.

Answer

Run the command without --max-items to get all deployments.

Answer

Use the --no-paginate option.

Question 5

An organization uses AWS CodeBuild to run integration tests. The tests require a large amount of memory and CPU, and they often timeout after the default 60 minutes. What is the MOST efficient way to increase the timeout and allocate more resources?

Accepted Answer

Select a larger instance type in the CodeBuild project configuration, such as 'BUILD_GENERAL1_LARGE'.. In AWS CodeBuild, the compute type (e.g., BUILD_GENERAL1_LARGE) is a project-level configuration, not a buildspec override. To increase memory and CPU, you must select a larger compute type in the CodeBuild project settings. Additionally, the timeout can be increased in the project configuration or via the AWS CLI/API, not in the buildspec.yml. This approach is the most efficient and reliable way to allocate more resources and extend the timeout.

Answer

Use Amazon CloudWatch to monitor the build and automatically restart it if it times out.

Answer

Use AWS Lambda instead of CodeBuild, as it can run up to 15 minutes.

Answer

Modify the buildspec.yml file to include 'compute-type' and 'timeout-in-minutes' overrides.

Question 6

A company has a multi-account AWS environment using AWS Organizations. The DevOps team wants to deploy a CloudFormation stack set to all accounts in the organization. Which IAM permissions are REQUIRED for the stack set execution role?

Accepted Answer

iam:PassRole. The stack set execution role requires the `iam:PassRole` permission because CloudFormation uses this role to create, update, or delete stacks in target accounts. When deploying a stack set, the service passes the execution role ARN to the target accounts, and the calling principal must have `iam:PassRole` on that role to authorize the delegation. Without this permission, CloudFormation cannot assume the role in the target accounts to perform stack operations.

Answer

sts:AssumeRole

Answer

cloudformation:CreateStackSet

Answer

iam:*

Question 7

A company wants to enforce that all infrastructure changes go through a CI/CD pipeline. Which AWS service can be used to prevent direct changes to production resources?

Accepted Answer

AWS Config. AWS Config is a detective control: it records configuration state and can flag or remediate drift after a change has already happened, but it cannot block an API call in real time. To actually PREVENT direct changes to production resources, you need a preventive control such as an SCP or IAM policy that denies mutating actions on production resources except when the caller is the CI/CD pipeline's role (e.g. via an aws:PrincipalTag or aws:ViaAWSService condition). As given, none of the four options is a true preventive mechanism, so the 'correct' answer contradicts the stem's own requirement.

Answer

AWS Service Catalog

Answer

AWS IAM

Answer

AWS CloudTrail

Question 8

Refer to the exhibit. A developer runs this buildspec in CodeBuild to deploy a CDK application. The build succeeds, but the CDK stack is not deployed. What is the MOST likely reason?

Accepted Answer

The CDK application has not been bootstrapped in the target account.. The CDK stack was not deployed because the target AWS account and region must be bootstrapped before deploying CDK applications. Bootstrapping provisions the necessary resources (e.g., S3 bucket for assets, IAM roles) that CDK requires. Without bootstrapping, the `cdk deploy` command will fail silently or not execute the deployment, even if the build phase succeeds.

Answer

The 'npx cdk deploy' command should be in the build phase, not post_build.

Answer

The Node.js runtime version 14 is incompatible with the CDK version.

Answer

The IAM role for CodeBuild does not have permission to create CloudFormation stacks.

Question 9

Refer to the exhibit. A DevOps engineer sees this output when listing pipelines. The pipeline 'my-app-pipeline' has execution mode set to 'QUEUED'. The team reports that when multiple commits are pushed simultaneously, only the latest commit is deployed, and earlier ones are skipped. How should the pipeline execution mode be changed to ensure all commits are deployed?

Accepted Answer

Change the execution mode to 'PARALLEL'.. AWS CodePipeline execution modes: SUPERSEDED stops older in-progress/queued executions when a new one starts; QUEUED runs all executions sequentially in order; PARALLEL runs executions concurrently. With a QUEUED pipeline, all commits should deploy in order. Changing to PARALLEL would also deploy all commits, but it is unnecessary and does not fix a problem that cannot occur in QUEUED mode. The question should either state the current mode is SUPERSEDED, or ask which mode should be used to deploy all commits.

Answer

Change the execution mode to 'SUPERSEDED'.

Answer

Upgrade the pipeline to V2 type which supports 'QUEUED' mode.

Answer

Change the execution mode to 'SERIAL'.

Question 10

A company uses AWS CodePipeline with an S3 source action and a CodeBuild project. The pipeline fails intermittently during the build stage with an error indicating that the source code archive is corrupt. Which action should the DevOps engineer take to resolve this issue?

Accepted Answer

Enable versioning on the S3 bucket and use versioned objects in the pipeline.. The trap here is that candidates often assume the issue is with the build environment (timeout) or source type, rather than recognizing that without versioning, an overwritten S3 object destroys the previous archive with no way to recover a known-good version, causing the pipeline to fetch a corrupted or incomplete artifact.

Answer

Increase the timeout for the CodeBuild project.

Answer

Configure the pipeline to use AWS CodeCommit as the source instead of S3.

Answer

Add a manual approval step before the build stage.

Question 11

A company is using AWS CodePipeline to deploy a static website to Amazon S3. The pipeline includes a CodeBuild step that minifies JavaScript files. Recently, the build step started failing with an error: 'Error: ENOENT: no such file or directory, open 'index.js''. What is the most likely cause?

Accepted Answer

The CodeBuild project's working directory is not set to the source directory.. The error 'ENOENT: no such file or directory, open 'index.js'' indicates that CodeBuild cannot find the file in the current working directory. This typically happens when the working directory is not set to the source directory where the file resides. Option C correctly identifies this as the most likely cause. Option D is incorrect because the buildspec.yml file does not require a 'phases' section to run.

Answer

The source code was not uploaded to S3 correctly.

Answer

The S3 bucket policy is blocking access to the source code.

Answer

The buildspec.yml file is missing the 'phases' section.

Question 12

Which THREE steps are required to set up a cross-account CodePipeline that deploys to an EC2 instance in a target account? (Choose three.)

Accepted Answer

Create an IAM role in the target account with permissions to deploy to EC2.. Option A is correct because the pipeline, running under the pipeline account's service role, must assume a role in the target account that actually holds the permissions to act on the EC2 instance (for example, ec2:RunInstances, ec2:CreateDeployment, or SSM/CodeDeploy actions), so that role must exist in the target account. Option B is correct because that target-account role needs a trust policy whose Principal is the pipeline account (or the pipeline's service role) with sts:AssumeRole, otherwise the cross-account assumption will be denied. Option C is correct because the pipeline's service role in the pipeline account must itself be granted sts:AssumeRole permission for the target account role ARN; without this identity-based policy, the pipeline cannot call AssumeRole even if the trust policy allows it. Option D is not required because artifact encryption can use the pipeline account's own KMS key or the default AWS-managed key; using the target account's default KMS key is not a mandatory setup step. Option E is not required because a single CodePipeline in the pipeline (source) account can deploy cross-account by assuming the target role; you do not create a separate pipeline in the target account.

Answer

Configure the pipeline to use the target account's default KMS key for artifacts.

Answer

Create a CodePipeline in the target account.

Question 13

An organization has a AWS CodePipeline that deploys a critical application. The pipeline uses a manual approval step before deploying to production. The team wants to ensure that only authorized users can approve the deployment, and that the approval action is logged for compliance. Which combination of actions should the team take? (Select TWO.)

Accepted Answer

Configure the approval action to invoke an AWS Lambda function that validates the approver's IAM role tags.. AWS CodePipeline's manual approval action can be configured to invoke an AWS Lambda function that checks the approver's IAM role tags, ensuring only authorized users (e.g., those with a specific 'approver' tag) can approve. This provides fine-grained, custom authorization beyond basic IAM policies. Option B is correct because enabling AWS CloudTrail captures all approval API calls (e.g., PutApprovalResult) as audit logs, meeting compliance requirements for tracking who approved and when.

Answer

Use Amazon Simple Notification Service (SNS) to send approval notifications and allow any subscriber to approve.

Answer

Use AWS CodeCommit to manage approval permissions via repository policies.

Answer

Store approval logs in Amazon CloudWatch Logs for real-time monitoring.

Question 14

A company is implementing a blue/green deployment strategy for an application running on Amazon ECS with AWS Fargate. The team wants to use AWS CodeDeploy to orchestrate the deployment. What is the minimum IAM permissions needed for CodeDeploy to register the new task set and shift traffic?

Accepted Answer

ecs:RegisterTaskDefinition, ecs:UpdateService, iam:PassRole. The minimum IAM permissions required for AWS CodeDeploy to orchestrate a blue/green deployment on Amazon ECS with Fargate include ecs:RegisterTaskDefinition (to register the new task definition), ecs:UpdateService (to update the service to use the new task set), and iam:PassRole (to pass the task execution role and task role to ECS). The elasticloadbalancing:RegisterTargets is not required because CodeDeploy relies on ECS to register tasks with the load balancer. Therefore, option C is correct. Option A includes elasticloadbalancing:RegisterTargets which is not needed and omits iam:PassRole, making it insufficient. Option B misses both ecs:UpdateService and iam:PassRole. Option D uses ecs:CreateService (not needed) and a legacy load balancer action.

Answer

ecs:RegisterTaskDefinition, ecs:UpdateService, elasticloadbalancing:RegisterTargets

Answer

ecs:RegisterTaskDefinition, elasticloadbalancing:RegisterTargets

Answer

ecs:CreateService, ecs:UpdateService, elasticloadbalancing:RegisterInstancesWithLoadBalancer

Question 15

A company is migrating from Jenkins to AWS CodeBuild. They have hundreds of Jenkins jobs that run on a schedule. Some jobs take hours and must not overlap. What is the most efficient way to migrate these jobs to CodeBuild while ensuring no overlapping builds?

Accepted Answer

Configure the CodeBuild project with a concurrent build limit of 1.. It provides a robust, event-driven mechanism to prevent overlapping builds. By using Amazon CloudWatch Events to trigger a Lambda function that checks the current build status of the CodeBuild project before starting a new build, you can ensure that a new build is only initiated when no other build is running. This approach directly addresses the requirement that some jobs take hours and must not overlap, without relying on fragile timing or configuration limits that may not apply across multiple projects.

Answer

Create a buildspec file that includes a sleep command to stagger start times.

Answer

Set up a separate CodeBuild project for each job and use a custom retry policy.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that checks the build status before starting a new build.