DOP-C02 SDLC Automation Practice Test 21 — 15 Questions

Question 1

A DevOps engineer is setting up a CI/CD pipeline for a microservices application using AWS CodePipeline. The pipeline includes a Test stage that runs integration tests against a staging environment. The engineer wants to ensure that manual approval is required before deploying to production. Which action should be taken?

Accepted Answer

Add a manual approval action in the pipeline stage before production deployment.. Option A is correct because a manual approval action in CodePipeline requires a reviewer to approve before proceeding to the next stage. Option B is wrong because CodeCommit does not provide approval workflows for pipeline stages. Option C is wrong because CloudWatch can monitor but not block. Option D is wrong because the pipeline can be triggered after approval, but the approval is a stage action.

Answer

Configure a CodeCommit approval rule template to block the merge.

Answer

Use CloudWatch Events to send a notification and wait for a custom signal.

Answer

Set the pipeline to only run on manual invocation.

Question 2

A team uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS instance. During an update, the stack fails with 'CREATE_FAILED' for the DB instance resource, and the error message indicates 'The DB instance already exists.' What is the most likely cause?

Accepted Answer

An RDS instance with the same identifier already exists in the account and region.. Option B is correct because if the stack was previously deleted without retaining the resource, the DB instance may have been left behind. Option A is wrong because RDS does not have a deletion policy that prevents deletion. Option C is wrong because UpdateReplace policy would replace but not cause 'already exists' error. Option D is wrong because deletion protection would prevent deletion but not cause 'already exists' if the stack is new.

Answer

The stack update is trying to replace the DB instance without a proper UpdateReplace policy.

Answer

The stack has a DeletionPolicy of Retain on the RDS instance.

Answer

The RDS instance has deletion protection enabled.

Question 3

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment is set to 'AllAtOnce'. The application revision is a simple index.html. What is the most likely cause?

Accepted Answer

The CodeDeploy agent is not installed or running on the EC2 instances.. Option D is correct because the CodeDeploy agent must be installed on each EC2 instance in the Auto Scaling group to receive and execute deployments. Option A is wrong because AllAtOnce means all instances deploy simultaneously. Option B is wrong because S3 permissions are needed but would cause a different error. Option C is wrong because the revision is a single file, not a zip, but CodeDeploy requires a revision format; however, the error message suggests instance failure.

Answer

The IAM instance profile does not have permissions to download from Amazon S3.

Answer

The application revision is not a compressed archive.

Answer

The deployment configuration 'AllAtOnce' is incompatible with Auto Scaling groups.

Question 4

A developer wants to automate the testing of a serverless application built with AWS Lambda and Amazon API Gateway. Which AWS service is best suited for running integration tests as part of a CI/CD pipeline?

Accepted Answer

AWS CodeBuild. Option C is correct because AWS CodeBuild can run integration tests in a managed environment; it supports custom test frameworks. Option A is wrong because CodeDeploy is for deployment, not testing. Option B is wrong because CloudFormation is for infrastructure provisioning. Option D is wrong because CloudWatch is for monitoring and logging, not running tests.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Answer

AWS CloudFormation

Question 5

A company uses AWS Elastic Beanstalk for deploying a web application. The development team wants to implement a blue/green deployment strategy to minimize downtime. Which approach should they use?

Accepted Answer

Create a new Elastic Beanstalk environment and swap the environment CNAMEs.. Option D is correct because Elastic Beanstalk supports blue/green deployments by swapping CNAME records between two environments. Option A is wrong because Elastic Beanstalk does not natively use CodeDeploy for blue/green; it has its own swap method. Option B is wrong because updating the Auto Scaling group is not a blue/green approach. Option C is wrong because updating the load balancer target group is more of a rolling update.

Answer

Update the Auto Scaling group launch configuration and gradually replace instances.

Answer

Create a new CodeDeploy deployment group and use the blue/green deployment configuration.

Answer

Create a new target group and register instances from the old environment.

Question 6

A DevOps engineer is troubleshooting a CodePipeline that has a Build stage using AWS CodeBuild. The build logs show 'Error: No such file or directory' for a file that is present in the source repository. What is the most likely cause?

Accepted Answer

The buildspec.yaml specifies an incorrect path for the file relative to the source root.. Option A is correct because CodeBuild uses a source code location; if the buildspec.yaml references a relative path that does not exist in the root, it may fail. Options B, C, and D are less likely because environment variables, build commands, and artifacts are not directly related to file existence in the source.

Answer

The build commands are not executed because the pre_build phase failed.

Answer

The artifact definition in the buildspec.yaml is incorrect.

Answer

The environment variables in CodeBuild are not set correctly.

Question 7

A company uses AWS CloudFormation to manage a stack that includes an Amazon SQS queue. The queue name must be unique. The developer wants to define the queue name in the CloudFormation template. Which intrinsic function should be used to generate a unique name?

Accepted Answer

Fn::Sub. Option C is correct because AWS::NoValue is not a function; AWS::StackName can be used to incorporate the stack name, but not generate a unique suffix. Option A is wrong because Fn::Select picks from a list. Option B is wrong because Fn::GetAtt gets attributes. Option D is correct because Fn::Sub can substitute a parameter like ${AWS::StackName} to create a unique name.

Answer

Fn::Select

Answer

AWS::NoValue

Answer

Fn::GetAtt

Question 8

A company uses AWS CodePipeline with multiple stages. The pipeline includes a Beta stage that deploys to a test environment and a Prod stage. The team wants to require manual approval before the Prod stage. Which TWO actions should be taken to implement this? (Choose TWO.)

Accepted Answer

Ensure that the IAM user or role performing the approval has codepipeline:PutApprovalResult permissions.. Options B and E are correct. The approval action must be added to the pipeline structure as a stage with an approval action, and the IAM policy must allow the approver to perform the approval. Option A is wrong because CodeCommit approval rules are for pull requests. Option C is wrong because CloudWatch Events does not provide manual approval. Option D is wrong because the pipeline must be configured to use the manual approval action, not just restrict triggers.

Answer

Use CloudWatch Events to trigger a Lambda function that requires manual sign-off.

Answer

Set the Prod stage to only run on manual invocation.

Answer

Configure a CodeCommit approval rule template to require approval before merging.

Question 9

A DevOps team uses AWS CloudFormation with nested stacks. They are experiencing stack update failures because changes to a nested stack cause resource conflicts. Which THREE best practices should they follow to manage nested stack updates? (Choose THREE.)

Accepted Answer

Apply a stack policy to prevent updates to critical resources in the nested stacks.. Options A, C, and D are correct. Using change sets previews changes; using stack policies protects critical resources; using resource import can avoid replacement. Option B is wrong because using DependsOn can cause circular dependencies. Option E is wrong because disabling rollback hides failures.

Answer

Set the stack update to disable rollback to allow debugging of failures.

Answer

Use DependsOn to ensure nested stacks are updated in a specific order.

Question 10

A company uses AWS CodeBuild to run unit tests. The buildspec.yaml file includes commands to install dependencies and run tests. Which TWO environment variables are automatically set by CodeBuild and can be used in the build commands? (Choose TWO.)

Accepted Answer

CODEBUILD_SRC_DIR. Options B and D are correct. CODEBUILD_BUILD_ID and CODEBUILD_SRC_DIR are automatically set by CodeBuild. Option A is wrong because AWS_REGION is automatically set, but it is an AWS CLI environment variable, not specific to CodeBuild. Option C is wrong because CODEBUILD_BUILD_NUMBER is not an automatic environment variable; it is exposed but not automatically set. Option E is wrong because CI is not automatically set by CodeBuild.

Answer

AWS_REGION

Answer

CODEBUILD_BUILD_NUMBER

Answer

CI

Question 11

Refer to the exhibit. A developer has the IAM policy shown. The developer can push code to the CodeCommit repository and start the pipeline. However, the pipeline fails at the Source stage with an access denied error. What additional permission is needed?

Accepted Answer

codecommit:GitPull. Option C is correct because CodePipeline needs permission to read from the source repository. The developer's policy allows GitPush but not codecommit:GitPull. Option A is wrong because codecommit:GetBranch is needed but not the main issue. Option B is wrong because codecommit:CreateCommit is not needed. Option D is wrong because codecommit:UploadArchive is not a CodeCommit action.

Answer

codecommit:GetBranch

Answer

codecommit:CreateCommit

Answer

codecommit:UploadArchive

Question 12

Refer to the exhibit. A DevOps engineer runs the CLI command to view stack events. The output shows that a Lambda function update was cancelled by the stack update. What is the most likely cause?

Accepted Answer

A concurrent stack update was initiated while a previous update was in progress.. Option B is correct because 'Resource update cancelled by stack update' indicates that a previous update to the Lambda function was interrupted by a newer stack update operation. Option A is wrong because a permissions error would show 'AccessDenied'. Option C is wrong because size limits would show a different error. Option D is wrong because drift detection does not cancel updates.

Answer

The stack had a drift detection operation that overrode the update.

Answer

The IAM role for the Lambda function lacked permissions to update the function.

Answer

The Lambda function code exceeded the maximum size limit for inline code.

Question 13

Refer to the exhibit. A developer has a buildspec.yaml for a React application. The build completes successfully, but the artifacts output is empty. What is the most likely cause?

Accepted Answer

The base-directory specified does not exist after the build phase.. Option D is correct because the base-directory is set to 'build' but the build command 'npm run build' likely outputs to a different directory (e.g., 'dist'). Option A is wrong because the install phase runs npm install. Option B is wrong because runtime version is valid. Option C is wrong because '**/*' matches all files.

Answer

The install phase did not run because npm install is not in the correct phase.

Answer

The artifacts files pattern '**/*' is invalid.

Answer

The runtime version nodejs 14 is not supported by CodeBuild.

Question 14

A development team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They notice that a pipeline execution failed due to a code review rejection in the 'Approve' stage. The pipeline is configured with a manual approval action. What is the most likely cause of the failure?

Accepted Answer

An authorized user logged in to the CodePipeline console and rejected the approval request.. Option D is correct because a manual approval action requires a user to approve before proceeding; if the approval is rejected, the pipeline fails. Option A is wrong because an IAM policy issue would likely cause a different error. Option B is wrong because CodeCommit repository settings do not directly block pipeline approval actions. Option C is wrong because a CloudWatch Events rule is not required for manual approvals.

Answer

The IAM role for the pipeline does not have permission to invoke the approval action.

Answer

The CodeCommit repository has a branch policy that prevents direct commits.

Answer

The pipeline is not configured with a CloudWatch Events rule to trigger the approval.

Question 15

A company uses AWS CodeBuild to run integration tests as part of a pipeline. The tests require access to an Amazon RDS database. The RDS instance is in a private subnet with no public access. The CodeBuild project is configured with a VPC. Which additional configuration is necessary to ensure the build can connect to the database?

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic from the security group associated with the CodeBuild project.. Option C is correct because CodeBuild needs security group rules that allow outbound traffic to the RDS instance and the RDS security group must allow inbound traffic from CodeBuild. Option A is wrong because NAT gateway is for internet access, not for database connectivity within VPC. Option B is wrong because VPC endpoints are for AWS services, not for RDS connectivity. Option D is wrong because IAM roles do not control network connectivity.

Answer

Add an IAM policy that grants the CodeBuild service role access to the RDS instance.

Answer

Create a VPC endpoint for Amazon RDS.

Answer

Attach a NAT gateway to the private subnet.