DOP-C02 SDLC Automation Practice Test 21 — 15 Questions

Question 1

An organization uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The deployment is failing consistently with the error 'ScriptMissing' for the AppSpec lifecycle hook 'ApplicationStop'. The scripts are located in the /opt/scripts directory on the instances. What is the most likely cause of this error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The AppSpec file specifies a path to the script that does not exist on the instance.. The 'ScriptMissing' error in AWS CodeDeploy indicates that the deployment lifecycle hook (in this case, 'ApplicationStop') cannot find the script file at the path specified in the AppSpec file. Since the scripts are located in /opt/scripts, the most likely cause is that the AppSpec file's 'location' field for the ApplicationStop hook points to a path that does not match the actual file location on the instance, or the script file itself is missing from that directory.

Answer

The ApplicationStop hook is not defined in the AppSpec file.

Answer

The CodeDeploy agent is not the latest version.

Answer

The scripts have incorrect file permissions.

Question 2

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS instance. The stack creation fails with the error: 'The following resource(s) failed to create: [DBInstance]'. The CloudFormation template includes a parameter for the DB instance class. Which troubleshooting step should be taken FIRST?

Accepted Answer

Check the CloudFormation stack events for a detailed status message from the DBInstance resource.. The first step when a CloudFormation stack creation fails is to check the stack events in the CloudFormation console or via the AWS CLI. Each resource creation attempt generates a status message that includes a detailed reason for the failure, such as insufficient capacity, incorrect parameter values, or network configuration issues. For an RDS DBInstance, the event message will provide the specific error (e.g., 'DB instance class not supported in this Availability Zone'), enabling targeted troubleshooting without guesswork.

Answer

Increase the stack creation timeout to allow more time for the database to be created.

Answer

Verify that the VPC has at least two public subnets in different Availability Zones.

Answer

Use the Amazon RDS console to check if a DB instance with the same identifier already exists.

Question 3

A company is designing a CI/CD pipeline using AWS CodePipeline. They want to automatically run unit tests when a pull request is created in AWS CodeCommit. Which TWO actions should be taken to implement this?

Accepted Answer

Include a buildspec file in the repository that defines the unit test commands.. A buildspec file in the repository defines the unit test commands that CodeBuild will execute. When a webhook triggers CodeBuild on pull request creation, CodeBuild reads the buildspec from the source code, allowing the tests to run automatically as part of the CI/CD pipeline.

Answer

Configure a CodePipeline stage that uses the pull request source action.

Answer

Set up an Amazon CloudWatch Events rule to detect pull request creation and invoke an AWS Lambda function that starts CodeBuild.

Answer

Add a CodeDeploy deployment group to run the tests on an EC2 instance.

Question 4

A DevOps engineer is managing infrastructure as code using AWS CloudFormation. The engineer wants to automatically update a stack when changes are pushed to a Git repository. Which THREE services can be used together to achieve this?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the core service that manages the infrastructure as code stack. When combined with AWS CodeCommit as the Git repository and AWS CodePipeline as the CI/CD orchestrator, changes pushed to the repository trigger a pipeline that automatically updates the CloudFormation stack. CodePipeline can directly invoke CloudFormation actions (create, update, delete stacks) using its built-in deployment provider, eliminating the need for intermediate compute services.

Answer

Amazon CloudWatch Events

Answer

AWS CodeBuild

Question 5

An organization uses AWS CodeDeploy to deploy applications to Amazon EC2 instances. The deployment is failing consistently with the error 'ScriptMissing' for the AppSpec lifecycle hook 'ApplicationStop'. The scripts are located in the /opt/scripts directory on the instances. What is the most likely cause of this error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the security group of the new instances to allow outbound traffic to the database security group.. In a Blue/Green deployment, new instances are created with a new security group. If the database security group only allows inbound traffic from the old instances' security group, the new instances will be blocked. Updating the new instances' security group to allow outbound traffic to the database, or adding the new security group to the database's inbound rule, resolves the connectivity issue. Option C is incorrect; configuring the database to use a DNS name that resolves to the new instances would not help—the database's DNS name should resolve to the database itself, not to the instances. The issue is that the new instances cannot connect to the database, not the other way around.

Answer

Modify the CodeDeploy deployment group to include the database security group.

Answer

Configure the database to use a DNS name that resolves to the new instances after the deployment.

Answer

Increase the number of instances in the Auto Scaling group.

Answer

Reinstall the CodeDeploy agent on the new instances.

Question 6

Refer to the exhibit. An IAM policy is attached to a user who needs to start a CodePipeline pipeline and view its details. The user reports that they cannot see the pipeline in the AWS Management Console. What is the MOST likely reason?

Accepted Answer

The policy does not include the codepipeline:ListPipelines action, which is needed to view pipelines in the console.. The AWS Management Console requires the `codepipeline:ListPipelines` action to populate the pipeline list view. Without this permission, the console cannot display any pipelines, even if the user has permissions for specific pipeline actions like `StartPipelineExecution` or `GetPipeline`. The attached policy grants `codepipeline:StartPipelineExecution` and `codepipeline:GetPipeline`, but omits `ListPipelines`, which is why the user sees an empty pipeline list.

Answer

There is an explicit deny statement elsewhere that is overriding the allow.

Answer

The user does not have permission to start the pipeline execution.

Answer

The pipeline ARN is incorrect.

Question 7

Refer to the exhibit. A developer is troubleshooting a failed AWS CodeBuild build. The buildspec file contains the following build commands: 'pre_build' - run linting, 'build' - './gradlew build', 'post_build' - package artifact. The error occurs in the build phase. Which of the following is the MOST likely cause?

Accepted Answer

The Gradle build encountered compilation or test errors.. The error occurs in the build phase, which executes './gradlew build'. Gradle's build task compiles source code and runs tests by default. If compilation fails or tests fail, Gradle exits with a non-zero exit code, causing AWS CodeBuild to mark the build phase as failed. The error message in the build logs would typically show compilation errors or test failures.

Answer

The build environment ran out of disk space.

Answer

The artifact packaging step failed.

Answer

The linting step failed.

Question 8

A startup is using AWS CodeCommit to store their application code. They have set up a CI/CD pipeline with AWS CodePipeline and AWS CodeBuild. The pipeline consists of a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using AWS CodeDeploy to deploy to an Auto Scaling group of EC2 instances. Recently, a developer committed code that introduced a critical bug, and the pipeline automatically deployed the bug to production, causing an outage. The team wants to implement a manual approval step before production deployment. They also want to ensure that the approval step is only required for deployments to the production environment, not for development or testing. Which solution should they implement?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline before the production deployment stage. Configure the approval to require a designated approver.. CodePipeline supports manual approval actions that can be added as a stage before production deployment. By configuring separate pipelines or stages for different environments, the approval step can be limited to production. Option B is wrong because CodeDeploy does not have approval workflows. Option C is wrong because CloudWatch Events does not provide manual approval. Option D is wrong because SNS is for notifications, not approvals.

Answer

Configure the CodeDeploy deployment group to require approval before deploying to any instance.

Answer

Use Amazon Simple Notification Service (SNS) to send a notification to the team and have them manually stop the pipeline if needed.

Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an approval request via email and pauses the pipeline until approved.

Question 9

A large enterprise is using AWS CloudFormation to manage their infrastructure. They have a master template that orchestrates nested stacks for different components: VPC, application, and database. The VPC stack creates subnets, route tables, and security groups. The application stack creates EC2 instances and an Application Load Balancer. The database stack creates an RDS instance. The master template uses parameters to pass configuration values. Recently, when updating the application stack, the update failed because the security group ID from the VPC stack changed, and the application stack references the old security group ID. The team wants to ensure that when the VPC stack is updated, dependent stacks are automatically updated to use the new outputs. Which approach should they take?

Accepted Answer

Use the Fn::ImportValue intrinsic function in the application stack to import the security group ID from the VPC stack's exports.. Using Fn::ImportValue to import exported outputs from the VPC stack ensures that the application stack always gets the latest security group ID. When the VPC stack is updated, it exports the new security group ID, and the application stack automatically references the updated value during its next update. Option B (Fn::GetAtt) is incorrect because it can only reference resources within the same stack or directly from nested stacks (if the master template uses Fn::GetAtt to access outputs of nested stacks), but in this scenario, the stacks are separate nested stacks managed by the master template, and cross-stack references are best handled via exports/imports. Option C (hardcoding) is error-prone and not scalable. Option D is incorrect because CloudFormation does not automatically update nested stacks; the master template must be updated to trigger updates to dependent stacks, and using exports/imports ensures proper dependency resolution.

Answer

Use the Fn::GetAtt intrinsic function in the application stack to directly reference the security group from the VPC stack.

Answer

Hardcode the security group ID in the application template to avoid changes.

Answer

Configure the master template to automatically update all nested stacks whenever any output changes.

Question 10

A company uses AWS CodeBuild to compile and test their Java application. The build takes about 20 minutes. They have enabled Amazon S3 cache to store the Maven repository to speed up subsequent builds. However, they notice that the build time has not improved significantly. The buildspec file includes the 'cache' section with 'paths' pointing to '/root/.m2'. The CodeBuild project has cache type set to 'S3' and a valid bucket. The build logs show that the cache is being downloaded and uploaded, but the Maven dependencies are still being downloaded from the internet each time. What is the most likely cause?

Accepted Answer

The Maven dependencies are not being stored in the local repository path specified in the cache.. The cache is configured to store the Maven local repository at '/root/.m2', but Maven by default stores dependencies in the home directory of the user running the build (e.g., '/root/.m2'). However, the build may be running as a different user or Maven may be configured to use a different local repository path (e.g., via settings.xml or the 'maven.repo.local' property). If the dependencies are not being written to '/root/.m2', the cache will not capture them, and dependencies will be re-downloaded. Option A is incorrect because the cache is being downloaded and uploaded, but the issue is that the cache does not contain the dependencies. Option B is incorrect because S3 bucket region does not prevent cache download/upload, and logs show cache is being transferred. Option C is incorrect because the buildspec includes the cache section correctly, as shown by the cache operations in logs.

Answer

The cache is too large and takes as long to download as the build itself.

Answer

The S3 bucket is in a different region than the CodeBuild project.

Answer

The buildspec file does not include the 'cache' section correctly.

Question 11

A team is using AWS CodePipeline to deploy a serverless application using AWS Lambda and Amazon API Gateway. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild (which runs unit tests and packages the Lambda code), and a deploy stage using AWS CloudFormation to update a stack that contains the Lambda function and API Gateway. The deployment stage uses a CloudFormation template that creates the Lambda function and API Gateway. Recently, the deployment stage started failing with the error: 'The API Gateway deployment already exists'. The team has not changed the template. What is the most likely cause?

Accepted Answer

The CloudFormation template uses a fixed physical name for the deployment resource, causing a conflict when CloudFormation tries to create a new deployment with the same name.. The error 'The API Gateway deployment already exists' occurs because the CloudFormation template uses a fixed physical name for the deployment resource. When CodePipeline triggers a new deployment, CloudFormation tries to create a deployment with the same physical name, which conflicts with the existing one. This is a common issue when using a hardcoded name for an API Gateway deployment. Option A correctly identifies this cause. Option B is incorrect because permission errors would result in a different error message, such as 'Invalid permissions on Lambda function'. Option C is incorrect because API Gateway deployment limits are high (default 500 per API) and unlikely to be reached without notice. Option D is incorrect because changing the stage name would cause a different error, not the 'already exists' error, and the stage name is not being changed per the scenario.

Answer

The Lambda function does not have permission to be invoked by API Gateway.

Answer

The account has reached the limit for API Gateway deployments.

Answer

The API Gateway stage name is being changed in the template.

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. They have set up a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from GitHub (using the GitHub source action) and a deploy stage that deploys to Elastic Beanstalk. The deployment is configured to use the 'Immutable' deployment policy. Recently, the deployment started failing with the error: 'The environment is in an unhealthy state. The deployment failed.' The developer checks the Elastic Beanstalk environment and sees that the new instances are not passing health checks. The application logs show that the new instances cannot connect to the existing Amazon RDS database. What is the most likely cause?

Accepted Answer

The security group attached to the Elastic Beanstalk environment does not allow the new instances to connect to the RDS database.. With immutable deployments, Elastic Beanstalk launches new instances in a new Auto Scaling group. These new instances need to be able to connect to the existing RDS database. If the security group attached to the Elastic Beanstalk environment (or the RDS security group) does not allow inbound traffic from the new instances, they will fail to connect, causing health check failures. Option A is incorrect because the RDS database is existing and not being updated during deployment. Option B is incorrect because changing the deployment policy to 'Rolling' would not resolve the connectivity issue; rather, it might cause downtime. Option D is incorrect because the application code is unchanged, so a bug is unlikely to be introduced by the deployment itself.

Answer

The RDS database is not available because it is being updated during the deployment.

Answer

The deployment policy should be changed to 'Rolling' to ensure instances are updated in place.

Answer

The application code has a bug that causes the health check to fail.

Question 13

A DevOps team is implementing a CI/CD pipeline for a microservices application deployed on Amazon ECS. They want to automatically build, test, and deploy container images to Amazon ECR and then update the ECS service. Which TWO steps are essential to achieve this goal?

Accepted Answer

Use AWS CodeDeploy to update the ECS service with a new task definition.. AWS CodeDeploy is the native AWS service for managing ECS rolling or blue/green deployments. It orchestrates the creation of a new ECS task definition, registers it, and updates the ECS service to use the new task definition, ensuring zero-downtime deployments. Option C is correct because AWS CodeBuild can execute build commands from a buildspec.yml file to build a Docker image and push it to Amazon ECR using the built-in AWS CLI or Docker commands, which is a fundamental step in a CI/CD pipeline for containerized applications.

Answer

Use AWS Secrets Manager to store Docker credentials.

Answer

Use AWS X-Ray for tracing.

Answer

Use Amazon CodeGuru for code review.

Question 14

A company is using AWS CodePipeline with multiple stages: Source (GitHub), Build (CodeBuild), Test (CodeBuild), and Deploy (CloudFormation). The deployment stage is failing intermittently with a 'Rate exceeded' error. The team needs to reduce deployment failures. Which TWO actions should the team take?

Accepted Answer

Implement a manual approval step before deployment to stagger multiple pipeline executions.. Adding a manual approval step before the deployment stage introduces a gating mechanism that serializes pipeline executions. This prevents multiple concurrent deployments from hitting the CloudFormation API simultaneously, which is the root cause of the 'Rate exceeded' error (typically a 429 HTTP status from the AWS API due to throttling). By requiring human approval, the team can control the flow and reduce the likelihood of exceeding CloudFormation's API rate limits (e.g., 1 request per second per account per region for certain actions).

Answer

Increase the timeout of the deploy action.

Answer

Enable CloudWatch detailed monitoring for the deployed resources.

Answer

Change the deployment to use an in-place deployment type.

Question 15

A company uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. They want to enforce that every commit triggers a build, but only if the commit message contains a specific pattern 'BUILD:'. Which THREE steps are required?

Accepted Answer

Configure a webhook in CodeBuild that filters events by commit message pattern.. CodeBuild supports webhooks that can be configured to trigger builds based on specific Git events, including filtering by commit message patterns using regular expressions. This allows the company to enforce that only commits containing 'BUILD:' in their message trigger a build, without needing additional infrastructure like Lambda functions or custom scripts. Option E is correct because a buildspec.yml file can include a conditional phase that checks the commit message, allowing fine-grained control over whether the build proceeds. Option D is incorrect because CodeCommit triggers cannot directly invoke CodeBuild; they can only invoke Lambda or SNS. Option A is incorrect because using a Lambda function is overly complex and unnecessary. Option B is incorrect because CloudWatch Events can trigger CodeBuild on push, but cannot filter by commit message pattern.

Answer

Create an AWS Lambda function that processes the commit message and calls CodeBuild.

Answer

Create a CloudWatch Events rule to invoke CodeBuild on every push to CodeCommit.

Answer

Create a custom trigger in CodeCommit that invokes CodeBuild.