DOP-C02 SDLC Automation Practice Test 20 — 15 Questions

Question 1

Your company has a CI/CD pipeline for a Java web application using AWS CodePipeline, CodeBuild, and CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy to EC2 instances in an Auto Scaling group). Recently, after a change to the buildspec, the Build stage succeeds but the Deploy stage fails with the error 'The deployment failed because the deployment group exceeded the minimum healthy host count.' The CodeDeploy deployment configuration uses a 'OneAtATime' deployment with a minimum healthy host count of 1. The Auto Scaling group has a minimum size of 2 and a maximum size of 4. The application runs on Amazon Linux 2 instances. The CodeDeploy agent is installed and running on all instances. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The new build artifact is larger, causing the instances to run out of disk space during deployment, which prevents the CodeDeploy agent from completing the deployment.. A larger build artifact can exhaust disk space on the instances during deployment. With a OneAtATime deployment and minimum healthy host count of 1, if the instance being deployed runs out of disk space, the CodeDeploy agent fails, marking the instance as unhealthy. Since the Auto Scaling group has a minimum size of 2, there are at least 2 instances initially. However, if the deployment fails on one instance, the remaining healthy instances may drop below the required minimum (1 healthy), causing the deployment to fail. Option A is wrong: if the agent were stopped, the error would occur on specific instances but not necessarily exceed the healthy host count, and the agent status can be checked. Option B is wrong: a different AMI would cause instances to fail at launch, not during deployment via CodeDeploy. Option D is wrong: the CodeDeploy service role needs permissions to describe the Auto Scaling group to track instances; if missing, the deployment would fail earlier with a different error, not the healthy host count exceeded error.

Answer

The CodeDeploy agent on some instances has been stopped or is not responding.

Answer

The Auto Scaling group is using a different Amazon Machine Image (AMI) that lacks the CodeDeploy agent.

Answer

The CodeDeploy service role does not have permission to describe the Auto Scaling group.

Question 2

You are a DevOps engineer for a company that runs a containerized microservices application on Amazon ECS with Fargate. The CI/CD pipeline uses AWS CodePipeline, with CodeBuild for building Docker images and pushing them to Amazon ECR, and CodeDeploy for deploying to ECS. The pipeline has a manual approval step before production deployment. Recently, the production deployment failed after approval, with the error: 'The service my-service could not be deployed because the task definition arn:aws:ecs:us-east-1:123456789012:task-definition/my-task:5 references an image that does not exist in the repository.' The image was built and pushed successfully in the Build stage. The task definition is updated by CodeDeploy to reference the new image URI. The ECS service is configured with 'deploymentController: CODE_DEPLOY' and uses a blue/green deployment. The CodeDeploy deployment group uses a 'Lambda' compute platform (incorrectly set). The pipeline uses the default CodeDeploy provider for ECS. What is the most likely cause of the failure?

Accepted Answer

The CodeDeploy deployment group's compute platform is set to 'Lambda' instead of 'ECS'.. CodeDeploy for ECS requires the compute platform to be 'ECS' (or 'Server' for EC2), not 'Lambda'. Setting it to 'Lambda' causes the deployment to fail because CodeDeploy then expects a Lambda function instead of an ECS service, leading to the error that the task definition references a non-existent image. Option B is incorrect because the manual approval step does not change the task definition ARN. Option C is incorrect because the image was built and pushed successfully, and no lifecycle policy expired it. Option D is incorrect because the pipeline is configured to use the CodeDeploy provider for ECS (the default provider).

Answer

The manual approval step changed the task definition ARN to a previous version.

Answer

The ECR repository has a lifecycle policy that expired the image tag before deployment.

Answer

The CodePipeline is not configured to use the CodeDeploy provider for ECS.

Question 3

A development team uses AWS CodePipeline with multiple stages including source, build, and deploy. The pipeline uses an Amazon S3 source action that triggers on changes to a specific bucket. Recently, the pipeline stopped triggering automatically. The IAM role for CodePipeline has the necessary permissions. What is the most likely cause?

Accepted Answer

AWS CloudTrail is not configured to deliver S3 data events to CloudWatch Logs.. CodePipeline's S3 source action does not rely on S3 event notifications to trigger pipeline executions. Instead, it uses Amazon CloudWatch Events (now Amazon EventBridge) to detect changes to the S3 bucket. For this to work, AWS CloudTrail must be configured to deliver S3 data events (specifically `PutObject` API calls) to CloudWatch Logs, which then generates the event that triggers the pipeline. Without CloudTrail data event logging, CodePipeline cannot detect object uploads, even if the IAM role has proper permissions.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The S3 bucket policy denies access to CodePipeline.

Answer

The S3 bucket does not have event notifications configured.

Question 4

A company is implementing a blue/green deployment strategy for a microservice hosted on AWS Elastic Beanstalk. They want to minimize downtime and be able to quickly roll back in case of issues. The deployment must support traffic shifting gradually. Which configuration should they use?

Accepted Answer

Use a blue/green deployment with a Classic Load Balancer and swap environment URLs.. Elastic Beanstalk's blue/green deployment with a Classic Load Balancer and environment URL swap allows you to shift traffic gradually by pre-warming the new environment and then swapping the CNAME records. This minimizes downtime and provides a straightforward rollback by swapping back to the original environment URL. The URL swap is atomic and does not require DNS propagation delays, enabling rapid recovery.

Answer

Use immutable updates with a fixed percentage of instances.

Answer

Use rolling updates with a batch size of 100%.

Answer

Use canary deployments by configuring the Elastic Load Balancer listener rules.

Question 5

A DevOps engineer needs to automate the creation of an Amazon ECS cluster using AWS CloudFormation. The cluster will run a web application that requires a load balancer. Which resource should be used to define the ECS cluster?

Accepted Answer

AWS::ECS::Cluster. The AWS::ECS::Cluster resource is the correct CloudFormation resource to define an ECS cluster, which serves as the logical grouping of container instances or Fargate tasks. The question specifically asks for the resource that defines the cluster itself, not the services or tasks running within it. A load balancer can be associated with the cluster via an AWS::ECS::Service resource, but the cluster definition is solely handled by AWS::ECS::Cluster.

Answer

AWS::ECS::Service

Answer

AWS::ECS::TaskDefinition

Answer

AWS::ECS::ContainerInstance

Question 6

A DevOps engineer wants to automate the creation and cleanup of temporary development environments on AWS. Each environment consists of an Amazon EC2 instance and an Amazon RDS database. The environments should be isolated and cost-effective. Which AWS service is best suited for this?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is best suited because it allows you to define the entire temporary environment—EC2 instance and RDS database—as infrastructure as code (IaC) in a single template. You can create and delete the entire stack with one API call, ensuring isolation via separate stacks and cost-effectiveness by automating cleanup when the stack is deleted.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

Amazon ECS

Question 7

A company uses AWS CodePipeline with a GitHub source action. The pipeline is configured to trigger on changes to the main branch. After a recent commit, the pipeline did not trigger. The DevOps engineer verified that the webhook is configured correctly and the IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The GitHub personal access token used for authentication has expired.. The most likely cause is that the GitHub personal access token used for authentication has expired. CodePipeline uses this token to authenticate with GitHub and trigger the webhook; when the token expires, GitHub rejects the webhook call, preventing the pipeline from starting even though the webhook configuration and IAM permissions are correct.

Answer

The pipeline is set to manual execution only.

Answer

The source action's branch filter is set to a different branch.

Answer

The GitHub webhook endpoint URL is incorrect.

Question 8

A company is using AWS CodeBuild to compile a Java application. The build takes over 30 minutes, which is too long. The project uses the standard build environment. The source code is stored in an S3 bucket. What is the most effective way to reduce build time?

Accepted Answer

Enable local caching for dependencies in the buildspec.yml.. Enabling local caching in the buildspec.yml allows CodeBuild to reuse previously downloaded dependency files (e.g., Maven .m2 repository) across builds, significantly reducing the time spent on dependency resolution. Since the build takes over 30 minutes, caching avoids re-downloading dependencies on every build, which is the most effective optimization for a standard build environment.

Answer

Use a custom build environment with pre-installed Java.

Answer

Store the source code in AWS CodeCommit instead of S3.

Answer

Increase the compute type to a larger instance.

Question 9

A DevOps engineer needs to deploy a serverless application using AWS CodeDeploy with a Lambda deployment group. The application uses AWS Lambda functions. The engineer wants to shift 10% of traffic to the new version initially, then gradually increase to 100%. Which deployment configuration should be used?

Accepted Answer

CodeDeployDefault.LambdaCanary10Percent5Minutes. The requirement is to initially shift 10% of traffic to the new Lambda version and then gradually increase to 100%. CodeDeployDefault.LambdaCanary10Percent5Minutes shifts 10% of traffic immediately to the new version and, after 5 minutes, automatically shifts the remaining 90% to complete the deployment. This matches the described canary deployment pattern.

Answer

CodeDeployDefault.LambdaAllAtOnce

Answer

CodeDeployDefault.LambdaCanary10Percent10Minutes

Answer

CodeDeployDefault.LambdaLinear10PercentEvery10Minutes

Question 10

A company has a CI/CD pipeline that builds a Docker image and pushes it to Amazon ECR. The build step uses AWS CodeBuild. The engineer wants to ensure that the ECR repository has a lifecycle policy to expire untagged images after 14 days. Which TWO actions are required? (Choose 2.)

Accepted Answer

Create an ECR lifecycle policy for the repository.. ECR lifecycle policies are configured at the repository level, not in CodeBuild or buildspec files. Option E is correct because the rule must specifically target untagged images and set an expiration of 14 days using the `expire` action with `sinceImagePushed` and `countType` set to `sinceImagePushed` and `countNumber` set to 14. Together, these two actions ensure the lifecycle policy exists and contains the correct rule to expire untagged images after 14 days.

Answer

Use the docker tag command to tag images with a timestamp.

Answer

Add a lifecycle policy rule in the buildspec.yml file.

Answer

Configure the lifecycle policy in the CodeBuild project settings.

Question 11

A company is migrating to a microservices architecture on Amazon ECS with AWS Fargate. They want to automate the deployment process using AWS CodePipeline. The pipeline should build a Docker image, push it to Amazon ECR, and deploy the updated service to ECS. Which THREE components are required in the pipeline? (Choose 3.)

Accepted Answer

Deploy stage with AWS CodeDeploy to ECS.. AWS CodeDeploy is the native deployment service that integrates with Amazon ECS to perform blue/green deployments, rolling updates, and traffic shifting. In a CodePipeline, the Deploy stage uses CodeDeploy to orchestrate the ECS service update, ensuring zero-downtime deployments by managing task set creation and load balancer target group routing.

Answer

Manual approval stage.

Answer

Test stage with AWS CodeBuild to run unit tests.

Question 12

A DevOps engineer is designing a CI/CD pipeline for a Python application using AWS CodeBuild and AWS CodeDeploy. The application is deployed to an Auto Scaling group of EC2 instances. The engineer wants to ensure that the deployment does not impact availability. Which TWO strategies can be used? (Choose 2.)

Accepted Answer

Rolling deployment with a small batch size.. Rolling deployment with a small batch size (Option B) updates a limited number of instances at a time, ensuring that the majority of the Auto Scaling group remains available throughout the deployment. Blue/green deployment (Option D) creates a separate, fully-provisioned environment (green) and switches traffic to it only after validation, which eliminates downtime during the cutover. Both strategies directly preserve application availability by avoiding full-scale disruption.

Answer

In-place deployment with a large batch size.

Answer

Immutable deployment.

Answer

Canary deployment.

Question 13

You are a DevOps engineer at a company that runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed using AWS CodeDeploy with an in-place deployment strategy. The deployment group contains 10 EC2 instances in an Auto Scaling group. Recently, a deployment failed with the error 'The overall deployment failed because too many individual instances failed deployment.' You check the CodeDeploy agent logs on one of the failed instances and see the error 'Script at /opt/codedeploy-agent/deployment-root/deployment-logs/scripts/application_start.sh failed with exit code 1.' The application_start.sh script is part of the AppSpec file. The script attempts to restart the web server. You notice that the script uses a path that exists only on some instances. What should you do to resolve this issue and prevent future failures?

Accepted Answer

Modify the application_start.sh script to check for the existence of the path before running the restart command.. The error occurs because the application_start.sh script attempts to restart the web server using a path that does not exist on all instances. This is a script logic issue, not a timeout or agent issue. The best solution is to modify the script to check for the existence of the path before executing the restart command, making the script robust. Option A is incorrect because increasing the timeout does not fix the script failure. Option C is incorrect because removing the script would bypass necessary post-installation steps. Option D is incorrect because reinstalling the agent does not address the script path issue.

Answer

Increase the deployment timeout in CodeDeploy.

Answer

Remove the application_start.sh script from the AppSpec file.

Answer

Reinstall the CodeDeploy agent on all instances.

Question 14

Your organization uses AWS CodePipeline to orchestrate a multi-stage pipeline for a Java application. The pipeline has a source stage (Amazon S3), a build stage (CodeBuild), and a deploy stage (CodeDeploy to EC2). Recently, the build stage started failing with the error 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE'. The build project uses a managed image for Java. You checked the CodeBuild project settings and confirmed that the image is correct. No changes were made to the build project. What is the most likely cause?

Accepted Answer

The Docker image specified in the build project is no longer available or the registry is unreachable.. The managed image may have been updated and the pull failed due to network issues. Option A is wrong because the source is S3, not CodeCommit. Option B is wrong because environment variables are not related to the image pull error. Option D is wrong because the buildspec.yml syntax does not affect image pulling.

Answer

The S3 bucket policy has been changed to deny access.

Answer

The build project's environment variables are incorrectly configured.

Answer

The buildspec.yml file contains invalid syntax.

Question 15

A startup is using AWS CloudFormation to manage their infrastructure. They have a stack that creates an Amazon S3 bucket and an Amazon DynamoDB table. The stack was created successfully, but when they try to update the stack to add a new S3 bucket, the update fails with the error 'CREATE_FAILED - S3 bucket already exists'. The new bucket name is unique and does not exist. The template uses the same AWS::S3::Bucket resource type. What is the most likely cause?

Accepted Answer

The S3 bucket name was previously used and is still in the process of being deleted (bucket name not yet released).. The error 'CREATE_FAILED - S3 bucket already exists' despite using a unique bucket name indicates that the bucket name was previously used and is still in a deletion state. S3 bucket names are globally unique and cannot be reused immediately after deletion; there is a waiting period for the name to be released. Option B is correct because the bucket name is not yet available. Option A is incorrect because the IAM user likely has sufficient permissions if the bucket creation fails only during update. Option C is incorrect because the region would not cause this specific error. Option D is incorrect because the resource type is appropriate.

Answer

The IAM user does not have permission to create S3 buckets.

Answer

The stack is in a different region than where the bucket is being created.

Answer

The CloudFormation template uses the wrong resource type for the bucket.