DOP-C02 SDLC Automation Practice Test 20 — 15 Questions

Question 1

Refer to the exhibit. A DevOps engineer runs the command to get the pipeline definition. The pipeline has a source stage from an S3 bucket and a build stage with CodeBuild. The CodeBuild project is configured to output artifacts to a specific S3 bucket. However, the pipeline fails at the build stage with an error: 'Artifact 'BuildArtifact' is not found'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CodeBuild project is not configured to output the expected artifact named 'BuildArtifact'.. The error 'Artifact 'BuildArtifact' is not found' indicates that CodePipeline expects an artifact named 'BuildArtifact' from the CodeBuild project, but the project's output artifact configuration does not include that name. In CodePipeline, the build stage must produce an artifact with the exact name specified in the pipeline definition; if the CodeBuild project's artifacts section (in buildspec.yml or console) omits or misnames it, the pipeline fails at that stage.

Answer

The source stage is using CodeCommit instead of S3.

Answer

The source artifact is not being passed to the build stage.

Answer

The IAM role for CodePipeline does not have permissions to read from the S3 bucket.

Question 2

A company uses AWS CloudFormation to provision infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the stack to change the DB instance class from db.t2.micro to db.t3.medium. Which THREE of the following must be true for the update to succeed? (Choose three.)

Accepted Answer

The stack must not be in a state that prevents updates, such as ROLLBACK_COMPLETE.. CloudFormation stacks in a terminal failure state like ROLLBACK_COMPLETE cannot be updated; they must be deleted and recreated. This is a fundamental constraint of the CloudFormation service, as the stack is considered non-functional and unable to process further operations.

Answer

Deletion protection must be disabled on the DB instance.

Answer

A change set must be created and executed for the update.

Question 3

Refer to the exhibit. An IAM policy is attached to a CodeBuild service role. The CodeBuild project is used to build code from a CodeCommit repository and output artifacts to an S3 bucket. However, the build fails with an error: 'Unable to download source from CodeCommit'. What is the missing permission?

Accepted Answer

Permissions to read from the CodeCommit repository.. The error 'Unable to download source from CodeCommit' indicates that the CodeBuild service role lacks the necessary permissions to read the source code from the CodeCommit repository. CodeBuild uses the service role to interact with CodeCommit via Git, which requires the `codecommit:GitPull` action (or broader read permissions like `codecommit:Get*` and `codecommit:List*`). Without these permissions, the build process cannot clone or fetch the source code, causing the failure.

Answer

Permissions to create CloudWatch Logs for build output.

Answer

Permissions to decrypt the KMS key used to encrypt artifacts.

Answer

Permissions to write to the S3 artifact bucket.

Question 4

Refer to the exhibit. A DevOps engineer created a CloudFormation stack that includes a Lambda function. The stack creation failed and rolled back. The error message for the Lambda function says 'Resource creation cancelled'. What is the most likely cause?

Accepted Answer

The stack rollback was triggered due to a failure in another resource, and the Lambda creation was cancelled.. CloudFormation creates resources in a specific order, and if a dependency fails or another resource fails, CloudFormation cancels the creation of subsequent resources and initiates a rollback. The error 'Resource creation cancelled' indicates that the Lambda function was never actually attempted to be created; instead, its creation was aborted due to a failure in a preceding or parallel resource. This is a standard CloudFormation behavior when a stack operation is interrupted by a failure in another resource.

Answer

The Lambda function's IAM role does not have sufficient permissions.

Answer

The Lambda function's code is missing from the S3 bucket.

Answer

The Lambda function creation timed out.

Question 5

A company uses AWS CodeCommit as a Git repository and CodeBuild for continuous integration. The buildspec.yml file includes steps to run unit tests and package the application. The team wants to ensure that only code from the main branch is deployed to production. They have set up a CodePipeline that triggers on changes to any branch. The pipeline includes a build stage that runs CodeBuild, and then a deploy stage that deploys to production. The team noticed that code from feature branches is being deployed to production accidentally. The team wants to modify the pipeline to prevent this. What is the MOST effective solution?

Accepted Answer

In the CodePipeline source stage, configure the branch filter to only allow the main branch to trigger the pipeline.. The most effective fix is to configure the CodePipeline source stage with a branch filter that only allows the main branch to trigger the pipeline. This prevents feature-branch commits from ever entering the pipeline, stopping the accidental production deployment at the source rather than downstream.

Answer

Use IAM policies to restrict developers from pushing to the main branch.

Answer

Add a manual approval step before the deploy stage and require approval from a senior engineer.

Answer

Modify the CodeBuild project to only build the main branch by specifying the branch in the source configuration.

Question 6

A DevOps team uses AWS CodePipeline to deploy a microservices application. The pipeline includes a CodeBuild project that runs unit tests. Recently, builds have been failing intermittently due to test timeouts. The team wants to improve the reliability of the pipeline without increasing the build timeout. Which action should the team take?

Accepted Answer

Configure the CodeBuild project to run tests in parallel by using separate build environments or test splits.. Running unit tests in parallel using separate build environments or test splits directly addresses intermittent timeouts by reducing the total execution time without increasing the build timeout. This approach leverages CodeBuild's ability to run multiple build jobs concurrently, distributing the test load and improving pipeline reliability.

Answer

Increase the build timeout to the maximum allowed value of 8 hours.

Answer

Use AWS CodeDeploy to run the unit tests on EC2 instances with more CPU and memory.

Answer

Modify the unit tests to be non-flaky by adding retries for network calls.

Question 7

A developer is using AWS CloudFormation to deploy a stack that includes an AWS Lambda function. The Lambda function code is stored in an S3 bucket. The CloudFormation template references the S3 bucket and object key. The developer wants to update the Lambda function code by uploading a new zip file to S3 and then updating the stack. The developer updates the S3 object with a new version, but the stack update does not automatically use the new code. What should the developer do to ensure the stack update uses the new code?

Accepted Answer

Upload the new code to a different S3 key or specify a new version ID in the CloudFormation template.. CloudFormation only detects changes to S3 objects if the S3 key or version changes. By uploading the new code with a different key or specifying a new version ID in the template, CloudFormation will recognize the change and update the Lambda function. Option A is incorrect because S3 event notifications do not automatically trigger stack updates for code changes; they are typically used for other automation. Option B is incorrect because stack policies control whether resources can be updated, but they do not cause CloudFormation to detect the code change; the template reference itself must indicate a new version. Option C is incorrect because deleting and recreating the stack is unnecessary and disruptive; a simple stack update with a new version ID is sufficient.

Answer

Enable S3 event notifications to trigger a CloudFormation stack update when the object is updated.

Answer

Modify the CloudFormation stack policy to allow updates to the Lambda function.

Answer

Delete the stack and recreate it with the new code.

Question 8

An organization uses AWS CloudFormation to manage infrastructure across multiple accounts using AWS Organizations. They want to enforce that all S3 buckets are encrypted with SSE-S3. A DevOps engineer creates a service control policy (SCP) to deny the creation of any S3 bucket without encryption. However, CloudFormation stack creation fails with an access denied error even when the template includes encryption. What is the most likely cause?

Accepted Answer

The CloudFormation template specifies SSE-KMS encryption, which is not allowed by the SCP.. The SCP denies the creation of S3 buckets without encryption, but it specifically allows only SSE-S3 encryption. If the CloudFormation template specifies SSE-KMS encryption, the SCP will deny the request, causing an access denied error—even though encryption is present. This mismatch between the encryption type required by the SCP (SSE-S3) and what the template requests (SSE-KMS) is the most likely cause of the failure.

Answer

The SCP is denying the s3:PutBucketPublicAccessBlock action, which is required for all bucket creation requests.

Answer

The SCP is incorrectly scoped to the management account instead of the member accounts.

Answer

The CloudFormation service role does not have permissions to create buckets in the target account.

Question 9

A company uses AWS CodePipeline to automate the deployment of a static website hosted on Amazon S3. The pipeline includes a source stage that pulls from a CodeCommit repository and a deploy stage that uses CodeBuild to sync the files to an S3 bucket. The team noticed that the website is not updating after a successful pipeline run. The CodeBuild logs show that the 'aws s3 sync' command completed successfully. However, the website still shows the old content. What is the MOST likely cause?

Accepted Answer

The website is fronted by Amazon CloudFront, which is caching the old content.. The most likely cause is that Amazon CloudFront is caching the old content at edge locations. Even though CodeBuild successfully synced new files to S3, CloudFront continues to serve cached objects until the TTL expires or an invalidation is created. The pipeline must include a CloudFront invalidation step (or use versioned object keys) to force edge locations to fetch the updated content.

Answer

The CodeBuild project does not have permission to write to the S3 bucket.

Answer

The S3 bucket is not configured for static website hosting.

Answer

The S3 bucket policy is blocking public access to the updated objects.

Question 10

A company uses AWS CodeCommit for source control. Developers frequently push large binary files, causing the repository size to exceed the recommended limit. What is the most efficient way to manage this situation?

Accepted Answer

Use Git LFS (Large File Storage) and configure it to store binaries in S3.. Git LFS (Large File Storage) replaces large binary files in the repository with lightweight text pointers, while the actual binary content is stored in an external storage backend such as Amazon S3. This keeps the CodeCommit repository small and within recommended limits, and developers continue to use standard Git commands without performance degradation.

Answer

Increase the repository size limit in CodeCommit settings.

Answer

Periodically run a script to remove large files from the commit history.

Answer

Use S3 directly for storing binaries and reference them in code.

Question 11

A company uses AWS Systems Manager Automation to patch EC2 instances. The automation document 'AWS-RunPatchBaseline' runs successfully but some instances are not patched because they are not managed by Systems Manager. What is the most likely reason?

Accepted Answer

The instances do not have the AWS Systems Manager Agent (SSM Agent) installed and the required IAM role attached.. Systems Manager Automation can only patch instances that are managed by Systems Manager. For an instance to be managed, it must have the SSM Agent installed and running, and it must have an IAM role that grants the necessary permissions (e.g., AmazonSSMManagedInstanceCore) to communicate with the Systems Manager service. Without these prerequisites, the instance is not registered as a managed node, so the automation document cannot target or patch it.

Answer

The instances are running Windows Server 2012 or older.

Answer

The instances are in a VPC without internet access.

Answer

The automation document is not compatible with the instance's operating system.

Question 12

A DevOps team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with a 'HealthCheckFailed' error. The application is running, but the health check endpoint returns HTTP 500. What should the team do to resolve this issue?

Accepted Answer

Modify the application to handle the health check endpoint correctly and return HTTP 200.. The health check endpoint returns HTTP 500, indicating the application is not functioning correctly despite running. CodeDeploy uses the health check endpoint to verify the application is healthy after deployment; returning HTTP 200 is required for the deployment to succeed. The team must fix the application code to properly handle the health check endpoint and return a successful status.

Answer

Change the deployment configuration to use AllAtOnce to avoid health checks.

Answer

Increase the health check grace period in the Auto Scaling group.

Answer

Disable the health check in the CodeDeploy deployment configuration.

Question 13

A company uses AWS CloudFormation to create a stack with a Lambda function that uses a VPC. The stack creation fails with 'CREATE_FAILED: The provided execution role does not have permissions to call ec2:CreateNetworkInterface on the resource'. What is the likely cause?

Accepted Answer

The Lambda execution role is missing the ec2:CreateNetworkInterface permission.. When a Lambda function is configured to run inside a VPC, it requires the `ec2:CreateNetworkInterface` permission to create an Elastic Network Interface (ENI) in the VPC subnets. The error message explicitly states that the execution role lacks this permission, which is a required IAM action for VPC-enabled Lambda functions. Without this permission, CloudFormation cannot provision the ENI, causing the stack creation to fail.

Answer

The VPC does not have a subnet with internet access.

Answer

The CloudFormation template does not specify a security group.

Answer

The Lambda function code has a syntax error.

Question 14

A development team uses AWS CodeBuild to compile a Java application. The build fails during the 'Install' phase with an error: 'Error: JAVA_HOME is not set'. How should the team fix this?

Accepted Answer

Set the environment variable 'JAVA_HOME' in the buildspec file's 'env' section.. The error 'JAVA_HOME is not set' indicates that the build environment lacks the required environment variable pointing to the Java installation. In AWS CodeBuild, the buildspec file's 'env' section allows you to define environment variables, including 'JAVA_HOME', which can be set to the path of the Java runtime (e.g., '/usr/lib/jvm/java-11-openjdk-amd64'). This ensures the variable is available during the Install phase, resolving the error without altering the build image or adding installation steps.

Answer

Use the managed image 'aws/codebuild/standard:5.0' which has Java pre-installed.

Answer

Install Java in the pre_build phase using a command.

Answer

Use a custom Docker image that has Java pre-installed.

Question 15

A company uses AWS CodePipeline to automate deployments. The pipeline consists of Source, Build, and Deploy stages. The Build stage uses CodeBuild, and the Deploy stage uses CodeDeploy. Recently, the pipeline failed at the Deploy stage with an error: 'The deployment group does not exist'. Which TWO actions should the team take to resolve this issue?

Accepted Answer

Verify that the deployment group name specified in the pipeline's Deploy stage matches the actual deployment group name in CodeDeploy.. The error 'The deployment group does not exist' directly indicates a mismatch between the deployment group name specified in the CodePipeline Deploy stage configuration and the actual deployment group name defined in CodeDeploy. The pipeline's Deploy stage action references a deployment group by name; if that name does not match an existing group in CodeDeploy, the deployment fails. Verifying and correcting this name resolves the issue.

Answer

Increase the timeout for the Deploy stage to allow more time for the deployment group to be created.

Answer

Ensure that the CodeBuild project has permissions to access the CodeDeploy deployment group.

Answer

Check that the CodeDeploy application exists in the same AWS account as the pipeline.