DOP-C02 SDLC Automation Practice Test 2 — 15 Questions

Question 1

A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline. The source stage is AWS CodeCommit, and the build stage uses AWS CodeBuild. The pipeline must only trigger on changes to the main branch. However, the engineer notices that the pipeline is also triggering on changes to feature branches that are merged via pull requests. What configuration change should the engineer make to ensure the pipeline only triggers on direct commits to the main branch?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a branch filter in the CloudWatch Events rule that triggers the pipeline, specifying only the main branch.. AWS CodePipeline pipelines are triggered by CloudWatch Events rules that monitor CodeCommit repository events. By default, the rule may trigger on all branch changes. Adding a branch filter in the CloudWatch Events rule that specifies only the main branch ensures that only direct commits to main trigger the pipeline, ignoring feature branch merges.

Answer

Configure the CodeCommit repository to disable events for all branches except main.

Answer

Modify the pipeline's source stage to use a branch name filter, which will ignore events from other branches.

Answer

Use a Lambda function as a source action to check the branch before starting the build.

Question 2

A company uses AWS CodeDeploy for deploying applications to an Auto Scaling group of Amazon EC2 instances. The deployment is failing with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which two actions should the DevOps engineer take to troubleshoot and resolve the issue? (Choose two.)

Accepted Answer

Check the CodeDeploy agent logs on the failed instances to identify script errors or missing dependencies.. The CodeDeploy agent logs on each EC2 instance contain detailed error messages about script failures, missing dependencies, or permission issues that cause the deployment to fail. Checking these logs is the first step in diagnosing why individual instances are failing, as the agent executes the AppSpec lifecycle hooks and reports back to the CodeDeploy service.

Answer

Increase the size of the Auto Scaling group to ensure more instances are available.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce' to bypass the error.

Answer

Redeploy the application using a different revision.

Question 3

A DevOps engineer is managing a CI/CD pipeline using AWS CodePipeline with multiple stages: Source (CodeCommit), Build (CodeBuild), Test (CodeBuild), and Deploy (CodeDeploy). The engineer wants to add manual approval steps before the Test and Deploy stages. Additionally, the pipeline should automatically roll back the deployment if the Deploy stage fails. Which two actions should the engineer take to implement these requirements? (Choose two.)

Accepted Answer

Insert a new stage between Build and Test, and add an Approval action to that stage.. Manual approval actions in AWS CodePipeline must be added as a separate stage, not within an existing stage. By inserting a new stage between Build and Test and adding an Approval action, the pipeline pauses before the Test stage, allowing manual review. Option C is correct because CodeDeploy deployment groups support automatic rollback on deployment failure, which can be enabled in the deployment group configuration to revert to the last known good revision.

Answer

Add an Approval action in the Test stage before the Test build action.

Answer

Add a Lambda function in the pipeline that triggers a rollback if the Deploy stage fails.

Answer

Configure the pipeline's Deploy stage to have a 'Rollback' action that runs on failure.

Question 4

Which AWS service is a fully managed source control service?

Accepted Answer

AWS CodeCommit. AWS CodeCommit is a fully managed source control service that hosts Git repositories. It eliminates the need to manage your own source control system. AWS CodeBuild is a build service that compiles code, CodeDeploy automates deployments, CodePipeline orchestrates release pipelines, CloudFormation provides infrastructure as code, and EventBridge is a serverless event bus.

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Answer

AWS CodePipeline

Answer

AWS CloudFormation

Answer

Amazon EventBridge

Question 5

Drag and drop the steps to configure an AWS Elastic Load Balancer (ALB) with HTTPS listeners and target groups.

Accepted Answer

Create target group, Create ALB, Configure HTTPS listener, Register targets, Add redirect rule. First create the target group, then create the ALB, then configure HTTPS listener, then register targets, then add redirect rule.

Answer

Create ALB, Create target group, Configure HTTPS listener, Register targets, Add redirect rule

Answer

Create target group, Create ALB, Register targets, Configure HTTPS listener, Add redirect rule

Answer

Configure HTTPS listener, Create target group, Create ALB, Register targets, Add redirect rule

Question 6

Match each AWS deployment strategy to its description.

Accepted Answer

Blue/Green: Deploy new version to a separate environment and switch traffic.. Blue/Green uses separate environments, Rolling replaces instances gradually, Canary tests with a subset first, and All-at-once updates all at once. Common confusions include swapping Blue/Green with Canary or Rolling.

Answer

Blue/Green: Deploy to a small subset first, then gradually.

Answer

Rolling: Deploy to a separate environment and switch.

Question 7

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage to Elastic Beanstalk. Recently, deployments started failing with an error: 'The deployment failed because the Elastic Beanstalk environment is in an UPDATE_ROLLBACK_IN_PROGRESS state.' What is the MOST likely cause?

Accepted Answer

A previous deployment failed and triggered an automatic rollback, leaving the environment in an unstable state. The error indicates the Elastic Beanstalk environment is stuck in an UPDATE_ROLLBACK_IN_PROGRESS state, which occurs when a previous deployment failed and Elastic Beanstalk automatically rolled back the changes. This leaves the environment in an unstable state that prevents new deployments until the rollback completes or is manually resolved. CodePipeline cannot proceed because Elastic Beanstalk rejects any new update operations while in this state.

Answer

The buildspec.yml file contains an invalid command that prevents artifact generation

Answer

A CloudWatch alarm is blocking the deployment due to high error rates

Answer

Insufficient IAM permissions for CodePipeline to pull source code from CodeCommit

Question 8

A team uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that creates an S3 bucket and a DynamoDB table. The S3 bucket name must be unique across all AWS accounts. Which CloudFormation intrinsic function should be used to generate a unique bucket name?

Accepted Answer

!Sub 'mybucket-${AWS::AccountId}'. The `!Sub 'mybucket-${AWS::AccountId}'` intrinsic function substitutes the AWS::AccountId pseudo parameter, which is guaranteed to be unique per AWS account. Since S3 bucket names must be globally unique across all AWS accounts, appending the account ID ensures the generated name does not conflict with buckets in other accounts. This approach is a common pattern for creating unique resource names in CloudFormation.

Answer

!Ref 'AWS::StackName'

Answer

!GetAtt S3Bucket.Arn

Answer

!Select [0, !Split ['-', !Ref 'AWS::Region']]

Question 9

A company uses AWS CodePipeline to orchestrate a multi-stage deployment. The pipeline has a source, build, test, and deploy stage. The test stage runs integration tests against a temporary environment. The team wants to ensure that the deploy stage only runs if the test stage succeeds. What configuration is needed?

Accepted Answer

No additional configuration needed; the pipeline will not proceed to deploy if the test stage fails. In AWS CodePipeline, each stage has a status (Succeeded, Failed, InProgress, etc.). By default, the pipeline transitions to the next stage only if the current stage completes with a status of Succeeded. If the test stage fails, the pipeline stops and does not proceed to the deploy stage. Therefore, no additional configuration is required to enforce this behavior.

Answer

Add a manual approval action in the test stage that requires a developer to confirm success

Answer

Set the test stage to retry on failure three times before allowing deploy to proceed

Answer

Configure the deploy stage to skip if the test stage fails using a condition

Question 10

A company deploys a serverless application using AWS SAM. The application includes an API Gateway REST API and multiple Lambda functions. The team wants to implement canary deployments for the API to gradually shift traffic to a new version. Which SAM template configuration should be used?

Accepted Answer

Use the CanaryDeployment property on the Serverless::Function resource with a DeploymentPreference. AWS SAM's `CanaryDeployment` property on the `AWS::Serverless::Function` resource, combined with a `DeploymentPreference` of type `Canary10Percent5Minutes`, enables gradual traffic shifting for API Gateway integrations. This configuration automatically creates a Lambda alias, publishes new versions, and shifts a percentage of API traffic to the new version over a specified time window, all without manual intervention.

Answer

Create multiple Lambda function versions and use API Gateway stage variables to switch between them

Answer

Define the Lambda function with AutoPublishAlias: live and set the API Gateway integration to point to the alias

Answer

Use AWS CloudFormation's UpdatePolicy with AutoScalingRollingUpdate

Question 11

A developer is setting up AWS CodeBuild to compile a Go application. The build fails with the error: 'go: command not found'. What is the MOST likely cause?

Accepted Answer

The build environment image does not have the Go runtime installed. The error 'go: command not found' indicates that the Go executable is not available in the build environment's PATH. CodeBuild uses a managed or custom build environment image (e.g., Ubuntu, Amazon Linux 2) to run build commands. If the image does not include the Go runtime, the shell cannot locate the 'go' binary, causing the build to fail. The most direct fix is to select a build environment image that has Go pre-installed or to install Go in the install phase of the buildspec.

Answer

The environment variables in buildspec.yml are incorrectly set

Answer

The build project does not have enough memory to compile Go code

Answer

The CodeBuild service role does not have permission to access the S3 bucket for artifacts

Question 12

Which TWO actions should a DevOps engineer take to implement a CI/CD pipeline that automatically deploys a containerized application to Amazon ECS using AWS CodePipeline and AWS CodeBuild? (Choose TWO.)

Accepted Answer

Use CodeBuild to build the Docker image and push it to Amazon ECR. AWS CodeBuild can be configured to build the Docker image from source code and then push it to Amazon ECR using the `post_build` phase with commands like `docker push`. This is a standard pattern for containerized CI/CD pipelines, as ECR serves as the private registry for storing and versioning container images. Option E is correct because CodePipeline can use Amazon ECR as a source action, which triggers the pipeline automatically when a new image is pushed to the specified repository, enabling continuous deployment to ECS.

Answer

Use AWS CloudFormation to deploy the ECS service

Answer

Use AWS CodeDeploy to deploy the container to ECS with a blue/green deployment

Answer

Store the Docker image in AWS CodeCommit

Question 13

Which THREE components are required to set up a fully automated CI/CD pipeline for a static website hosted on Amazon S3 using AWS CodePipeline? (Choose THREE.)

Accepted Answer

An AWS CodeBuild project to run build commands (e.g., minification). AWS CodeBuild is required to execute build commands such as minification, bundling, or transpilation of static website assets before deployment. In a fully automated CI/CD pipeline, CodeBuild processes the source code from the repository and produces the deployable artifacts that are then uploaded to the S3 bucket.

Answer

An Amazon CloudFront distribution for content delivery

Answer

An AWS Lambda function to invalidate CloudFront cache

Question 14

Which TWO best practices should be followed when configuring AWS CodeBuild projects to improve build performance and security? (Choose TWO.)

Accepted Answer

Configure the build project to use a custom VPC to access resources like private Amazon RDS databases. Configuring a CodeBuild project to use a custom VPC allows it to access resources that are not publicly accessible, such as private Amazon RDS databases or internal services, which is essential for building applications that depend on those resources. This also enhances security by keeping traffic within the VPC and avoiding exposure to the public internet.

Answer

Run builds as the root user to avoid permission errors

Answer

Use the AWS managed policy 'AdministratorAccess' for the CodeBuild service role to avoid permission issues

Answer

Always use the 'latest' tag for the build environment image to ensure up-to-date software

Question 15

A DevOps engineer is reviewing the IAM policy attached to a CodeBuild service role. The policy allows starting builds and viewing logs. However, when CodeBuild tries to download artifacts from an S3 bucket in the same account, it fails with an access denied error. What is the missing permission?

Accepted Answer

s3:GetObject. The error occurs because CodeBuild needs to download artifacts from S3, which requires the s3:GetObject permission on the bucket or object. Without this permission, the service role cannot read the artifact files, even though it can start builds and view logs. The s3:GetObject action is the specific permission that grants read access to S3 objects.

Answer

kms:Decrypt

Answer

s3:PutObject

Answer

logs:DescribeLogGroups