DOP-C02 SDLC Automation Practice Test 22 — 15 Questions

Question 1

A company runs a critical application on Amazon EC2 instances managed by an Auto Scaling group behind an Application Load Balancer. They use AWS CodeDeploy for blue/green deployments. The deployment process creates a new Auto Scaling group (green) and routes traffic to it after a successful deployment. Recently, the deployment succeeded but the green instances are not receiving traffic; users are still served by the old (blue) instances. The deployment logs show that the 'AllowTraffic' step succeeded. The team checked the ALB target groups; the green target group has healthy instances but the ALB listener default action still points to the blue target group. What is the most likely cause and remediation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CodeDeploy deployment group is not configured to update the ALB listener rule. Update the deployment group to include the ALB listener ARN so that CodeDeploy can switch the listener to the green target group.. In a CodeDeploy blue/green deployment with an ALB, the deployment group must be configured with the ALB listener ARN to allow CodeDeploy to update the listener rule to point to the green target group. Without this configuration, the listener remains pointing to the blue target group, even if the 'AllowTraffic' step completes. Option A is incorrect because sticky sessions would not prevent the listener from being updated; they only affect session persistence. Option B is incorrect because deregistration delay affects how long it takes to drain connections from the old instances, but the listener rule update is independent. Option C is incorrect because 'AllAtOnce' traffic shifting is supported; the issue is the missing listener configuration.

Answer

The ALB has sticky sessions enabled, causing traffic to stick to the blue instances. Disable sticky sessions.

Answer

The deployment configuration uses 'AllAtOnce' traffic shifting, which is not supported for blue/green with an ALB. Change to 'Canary' or 'Linear'.

Answer

The deregistration delay on the blue target group is too long, preventing traffic from shifting. Reduce the deregistration delay to 0 seconds.

Question 2

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance with automated backups enabled. The DevOps team needs to modify the DB instance to use a larger instance type. They update the CloudFormation template and execute a stack update. The update fails with the error: 'Cannot modify DB instance class because the instance is in a state that does not allow modification.' The DB instance is in the 'available' state. The team needs to successfully update the instance type without data loss. What should the team do?

Accepted Answer

Delete the CloudFormation stack, create a new stack with the new instance type, and restore from the automated backup.. Deleting the CloudFormation stack removes the DB instance, but automated backups are retained for the backup retention period. You can then create a new stack with the desired instance type and restore from the automated backup, preserving all data. Option A is wrong because stopping a DB instance does not change its state for modification; RDS instances can only be stopped if not in a Multi-AZ configuration, and CloudFormation updates are not designed for external state changes. Option B is wrong because 'AllowMajorVersionUpgrade' applies to engine version upgrades, not instance class changes. Option C is wrong because 'UpdateReplacePolicy' is not a valid CloudFormation resource property; the correct way to force replacement with a snapshot is to use 'DeletionPolicy: Snapshot' in the template, but the option as written would cause an error.

Answer

Stop the RDS instance, then update the stack, then start it.

Answer

Add the 'AllowMajorVersionUpgrade' property to the DB instance in the template and update the stack.

Answer

Modify the CloudFormation template to change the 'DBInstanceClass' property and set 'UpdateReplacePolicy' to 'Snapshot', then update the stack. This will create a new DB instance and delete the old one after taking a snapshot.

Question 3

A company uses AWS CodePipeline to automate builds and deployments. The pipeline has a source stage (Amazon S3) and a build stage (AWS CodeBuild). The build stage is failing with the error: 'Error: Unable to download artifact from S3: Access Denied'. The artifacts are stored in an S3 bucket that is encrypted with AWS KMS. The CodeBuild service role has permissions to read from the S3 bucket and use the KMS key. The team checks that the S3 bucket policy and the KMS key policy allow the CodeBuild role. What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant 'kms:Decrypt' permission to the CodeBuild service role.. CodeBuild needs 'kms:Decrypt' permission to decrypt the artifact encrypted with AWS KMS. The error 'Access Denied' when downloading the artifact from S3 indicates that the CodeBuild service role can access the S3 bucket but cannot decrypt the KMS-encrypted object. Option A is incorrect because bucket versioning is not required for CodeBuild to retrieve artifacts; versioning is optional. Option C is incorrect because the pipeline service role does not interact directly with the artifact download; CodeBuild uses its own role. Option D is incorrect because using the same bucket for pipeline artifacts and source artifacts is allowed and does not cause access denied errors.

Answer

The S3 bucket does not have versioning enabled, so CodeBuild cannot retrieve the artifact.

Answer

The CodePipeline service role does not have permission to pass the artifact to CodeBuild.

Answer

The artifact is stored in the same S3 bucket used by CodePipeline for its artifacts, causing a conflict.

Question 4

A company is using AWS OpsWorks for configuration management. They have a stack with a PHP application layer and a MySQL layer. The DevOps team needs to update the PHP version across all instances. They create a custom Chef recipe that updates the PHP package and add it to the lifecycle events. After running the 'Setup' lifecycle event on the layer, the instances are updated but the application stops working because the new PHP version is incompatible with some custom PHP extensions. The team needs to roll back the PHP version to the previous one quickly and minimize downtime. The instances are in an Auto Scaling group with a desired count of 4. What should the team do?

Accepted Answer

Re-run the old 'Setup' recipe that installs the previous PHP version on the layer.. Re-running the old 'Setup' recipe on the layer will revert the PHP version to its previous state, leveraging Chef's idempotency and the OpsWorks lifecycle event system. This approach minimizes downtime as it only re-applies the old configuration without reprovisioning instances. Option B is incorrect because creating a new AMI and launching new instances takes time and may cause prolonged downtime. Option C is incorrect because OpsWorks does not have a built-in 'Rollback' feature; you must use recipes to revert changes. Option D is incorrect because manually SSHing into each instance is error-prone, not scalable, and not recommended for production environments.

Answer

Create a new AMI with the old PHP version, launch new instances, and terminate the old ones.

Answer

Use the OpsWorks 'Rollback' feature to revert the stack to a previous state.

Answer

Manually SSH into each instance and downgrade the PHP package, then restart the web server.

Question 5

Refer to the exhibit. A CodePipeline deployment fails at the CloudFormation stage. The Lambda function creation is cancelled. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role lacks permissions to create ENIs.. When a Lambda function is configured in a VPC, the Lambda service must create an Elastic Network Interface (ENI) in the VPC on behalf of the function. The function's execution role must have permissions for ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface. Without these permissions, the Lambda service cannot create the ENI, and the Lambda function creation fails. A missing NAT gateway or VPC endpoints only affects internet access for the running function, not the creation process. Therefore, Option C is the correct answer.

Answer

The buildspec.yml file contains an invalid command.

Answer

The Lambda function is configured in a VPC without a NAT gateway or VPC endpoints, causing deployment timeout.

Answer

The CodeCommit branch is not configured correctly in the pipeline.

Question 6

Refer to the exhibit. After a deployment at 10:00, the error rate increases steadily. What is the MOST likely cause?

Accepted Answer

A bug in the new release causes errors to accumulate over time.. The error count increases after deployment and continues to rise, suggesting a code defect or configuration issue introduced by the deployment that causes progressively more errors (e.g., memory leak, connection pool exhaustion).

Answer

An external dependency became unavailable after the deployment.

Answer

The database connection limit was reached immediately after deployment.

Answer

The deployment triggered a scaling event that overloaded the application.

Question 7

Refer to the exhibit. Why does the build fail?

Accepted Answer

The CodeBuild role does not have permission to create CloudFront invalidations.. The CodeBuild role lacks the cloudfront:CreateInvalidation permission. The error message clearly indicates AccessDenied for that action.

Answer

The S3 bucket policy denies write access to the CodeBuild role.

Answer

The CodeBuild project is not associated with the correct service role.

Answer

The CloudFront distribution ID is incorrect.

Question 8

Refer to the exhibit. Despite scaling up, CPU utilization remains high. What is the MOST likely cause?

Accepted Answer

The CloudWatch alarm is configured with a threshold different from the target tracking policy's target.. The scaling policy uses target tracking with a target of 50%, but the alarm triggers at 60%, which is inconsistent and may cause the scaling to not respond appropriately. Also, with target tracking, the ASG should scale to bring CPU to 50%, but it stays at 70%, suggesting the scaling policy is not being honored or there is an issue with the policy.

Answer

The instance type t2.micro is too small for the application.

Answer

The desired capacity is not updated by the scaling policy.

Answer

The user data script fails to start the application on new instances.

Question 9

Refer to the exhibit. A developer is using this buildspec.yml in AWS CodeBuild to build and push a Docker image to Amazon ECR. The build fails with the error: 'Error: No region specified'. Which change should the developer make to resolve this error?

Accepted Answer

Set the AWS_DEFAULT_REGION environment variable in the CodeBuild project's environment configuration.. The error occurs because the $AWS_DEFAULT_REGION environment variable is not set in the CodeBuild project. The developer must explicitly set the AWS_DEFAULT_REGION environment variable in the CodeBuild project configuration.

Answer

Add a pre_build command to export AWS_DEFAULT_REGION using the AWS CLI.

Answer

Replace $AWS_DEFAULT_REGION with a hardcoded region like us-east-1.

Answer

Use the AWS_REGION environment variable instead of AWS_DEFAULT_REGION in the buildspec.

Question 10

Refer to the exhibit. An IAM policy is attached to a user. The user tries to push a commit to the 'develop' branch of 'MyRepo' using Git. What is the outcome?

Accepted Answer

The push is denied because the user is not pushing to the 'main' branch.. The policy allows GitPull and GitPush on the repo, but denies GitPush when the reference is not 'refs/heads/main'. Since the user is pushing to 'develop', the condition is met, and the Deny applies. An explicit Deny overrides any Allow, so the push is denied.

Answer

The push is denied only if the user is pushing to the 'main' branch.

Answer

The push succeeds because the Allow statement grants GitPush.

Answer

The push is denied because the Deny statement blocks all GitPush actions.

Question 11

Refer to the exhibit. A CloudFormation stack has been deployed. A developer wants to use the S3 bucket name in a subsequent AWS CLI command. Which command will correctly retrieve the bucket name?

Accepted Answer

aws cloudformation describe-stacks --stack-name my-stack --query "Stacks[0].Outputs[?OutputKey=='BucketName'].OutputValue" --output text. The developer can use the --query parameter with the describe-stacks command to extract the OutputValue for the specific OutputKey 'BucketName'. Option C uses the correct JMESPath syntax with the filter [?OutputKey=='BucketName'] to select the matching output and then retrieves its OutputValue. Option A attempts to list all S3 buckets and grep for 'my-stack', which is unreliable and not the intended method. Option B uses describe-stack-resources but incorrectly assumes the bucket name is a physical resource ID when it is actually an output value. Option D uses incorrect JMESPath syntax (single bracket with equality) which is invalid.

Answer

aws s3 ls | grep my-stack

Answer

aws cloudformation describe-stack-resources --stack-name my-stack --logical-resource-id BucketName --query "StackResources[0].PhysicalResourceId" --output text

Answer

aws cloudformation describe-stacks --stack-name my-stack --query "Stacks[0].Outputs[OutputKey='BucketName'].OutputValue" --output text

Question 12

Refer to the exhibit. A developer creates an AWS SAM template with this EventBridge rule to invoke a Lambda function every 10 minutes. After deployment, the rule is created but the Lambda function is not invoked. What is the most likely cause?

Accepted Answer

The Lambda function does not have a resource-based policy allowing EventBridge to invoke it.. The most likely cause is that the Lambda function lacks a resource-based policy (Lambda permission) that allows EventBridge to invoke it. In AWS SAM, when you define an EventBridge rule as an event source for a Lambda function, you must also add an AWS::Lambda::Permission resource or use the 'FunctionName' property in the event source mapping to grant invocation permission. Without this, EventBridge receives the rule schedule but fails to invoke the function. Option A is incorrect because DeadLetterConfig is optional and not required for invocation. Option B is incorrect because if the rule were disabled, it would not be created or would be inactive; the problem states the rule is created. Option D is incorrect because 'rate(10 minutes)' is a valid schedule expression (both 'minute' and 'minutes' are accepted).

Answer

The DeadLetterConfig ARN is incorrect.

Answer

The rule is in DISABLED state.

Answer

The schedule expression 'rate(10 minutes)' is invalid; it should be 'rate(10 minute)'.

Question 13

Refer to the exhibit. A developer defines this AWS CodePipeline pipeline in a JSON file. The pipeline fails at the Deploy stage with an 'AccessDenied' error. Which missing permission is the most likely cause?

Accepted Answer

The pipeline's service role is missing s3:PutObject permission on the deploy bucket.. The Deploy action uses the S3 deploy provider, which requires the pipeline's service role to have s3:PutObject permission on the deploy bucket. The error 'AccessDenied' indicates that the role does not have sufficient permissions to upload to the bucket.

Answer

The Extract option is set to 'true' but the bucket does not support extraction.

Answer

The pipeline does not have permission to read from the source bucket.

Answer

The artifact name 'SourceArtifact' does not match between stages.

Question 14

A development team uses AWS CodeBuild to compile a Java application and run unit tests. The build takes 30 minutes, but the team wants to reduce build time. The codebase has not changed significantly, and dependencies are stable. Which action would be MOST effective in reducing build time?

Accepted Answer

Configure CodeBuild to cache dependencies in an Amazon S3 bucket.. Caching dependencies in an Amazon S3 bucket allows CodeBuild to reuse previously downloaded Maven/Gradle dependencies across builds, eliminating the need to re-download them each time. Since the codebase and dependencies are stable, this directly reduces the build time by avoiding repeated network transfers of large artifact repositories.

Answer

Move the build process to a local developer machine to avoid CodeBuild overhead.

Answer

Reduce the number of unit tests executed in the build phase.

Answer

Increase the compute type of the build environment to a larger instance.

Question 15

An organization uses AWS CodePipeline to orchestrate deployments to multiple environments (dev, test, prod). Each environment uses a different AWS account. The pipeline uses cross-account actions with IAM roles. Recently, the pipeline failed at the deploy stage for the prod account with the error 'Access Denied' when assuming the cross-account role. The role ARN is correct and the trust policy allows the pipeline's service role. What is the MOST likely cause?

Accepted Answer

The pipeline's service role lacks the `sts:AssumeRole` permission for the cross-account role.. The pipeline's service role must have an `sts:AssumeRole` permission on the cross-account role to perform the role assumption. Even if the trust policy on the cross-account role allows the pipeline's service role, the pipeline's service role itself needs an IAM policy granting `sts:AssumeRole` for the cross-account role ARN. Without this permission, the `AssumeRole` API call fails with 'Access Denied', which is the exact error described.

Answer

The EC2 instances in the prod account do not have an appropriate instance profile.

Answer

The cross-account role's permissions boundary denies the deploy action.

Answer

The pipeline's service role does not have permission to perform the deploy action in the prod account.