DOP-C02 SDLC Automation Practice Test 23 — 15 Questions

Question 1

A DevOps engineer is designing a CI/CD pipeline for a serverless application using AWS Lambda and Amazon API Gateway. The team wants to automate deployment across multiple environments (dev, test, prod) with environment-specific configuration. Which approach should the engineer use?

Accepted Answer

Use the AWS Serverless Application Model (SAM) with CodePipeline, and pass environment parameters as CloudFormation parameter overrides.. Option D is correct because AWS SAM supports environment parameterization and is designed for serverless. Option A is not environment-aware. Option B requires manual variable managing. Option C lacks environment-specific config.

Answer

Use CodeBuild to package the Lambda code and then use CloudFormation with parameters for each environment.

Answer

Use CodeDeploy with a deployment configuration that deploys to all environments sequentially.

Answer

Use CodePipeline with separate CodeBuild projects for each environment.

Question 2

A company uses AWS CodePipeline to orchestrate builds and deployments. The build stage uses CodeBuild to run unit tests and generate a report. The team wants to fail the pipeline if the test coverage drops below 80%. How should the engineer configure this?

Accepted Answer

Configure CodeBuild to fail the build if the test report indicates coverage below 80% using the buildspec's reports section.. Option B is correct because CodeBuild can be configured to fail based on test report criteria. Option A requires custom scripting. Option C uses CodePipeline condition, which is not for test reports. Option D is not a CodeBuild feature.

Answer

Add a post-build action in the buildspec that checks coverage and exits with non-zero if below threshold.

Answer

Enable CodeBuild's 'Test Reporting' feature and set a threshold in the CodeBuild project configuration.

Answer

Use a CodePipeline condition to check the test report artifact and fail the pipeline if coverage is low.

Question 3

A company uses AWS CodeCommit for source control and wants to enforce that all commits to the main branch are signed. The DevOps team has configured Git commit signing using GPG keys. However, some developers are able to push unsigned commits to main. What should the engineer do to enforce signed commits?

Accepted Answer

Use an AWS CodeCommit trigger with an AWS Lambda function that validates commit signatures and rejects unsigned commits.. Option C is correct because CodeCommit repository policies can require commit signing. Option A does not enforce signing. Option B is not a repository setting. Option D is a CodeCommit feature for notifications, not enforcement.

Answer

Set the 'requireSignedCommits' parameter in the repository configuration to 'true'.

Answer

Configure branch protection rules in IAM to deny push access to main unless the commit is signed.

Answer

Create a repository policy that denies git push actions unless the condition 'codecommit:References' and 'codecommit:SourceIp' match.

Question 4

A team uses AWS CodeBuild to build Docker images and push them to Amazon ECR. The buildspec.yml includes a post_build step that runs a security scan. The team wants to ensure that only images that pass the security scan are tagged as 'latest'. Which approach should be used?

Accepted Answer

In the post_build phase, run the security scan, and if it passes, tag the image with 'latest' and push.. Option A is correct because it tags the image only after successful scan. Option B tags before scan. Option D tags all images, not just passing. Option C uses ECR lifecycle, not relevant.

Answer

Build the image with the 'latest' tag first, then run the security scan. If it fails, delete the 'latest' tag.

Answer

Use ECR lifecycle policies to remove images that do not pass the security scan.

Answer

Tag the image with 'latest' only after the build phase, regardless of scan results.

Question 5

A company is implementing a CI/CD pipeline for a containerized application using AWS CodePipeline, CodeBuild, and Amazon ECS. The pipeline should automatically deploy to a staging environment and then, after manual approval, to production. The production environment uses an ECS service with rolling update deployment. Which TWO actions are necessary to achieve this?

Accepted Answer

Add a manual approval stage in CodePipeline between staging and production.. Option B is correct because a manual approval stage is needed between staging and production. Option D is correct because the ECS deploy action in CodePipeline can perform rolling updates. Option A is not necessary; CodeBuild can push to ECR directly. Option C is not required for rolling update. Option E is incorrect because CodePipeline does not support CloudFormation for ECS rolling updates directly.

Answer

Use CloudFormation to deploy the ECS service with a rolling update policy.

Answer

Set up an ECS task definition with a sidecar container for health checks.

Answer

Configure CodeBuild to push the Docker image to Amazon ECR.

Question 6

A DevOps engineer is building a CI/CD pipeline for a PHP application that uses Amazon RDS for MySQL. The pipeline must run database migrations as part of the deployment. The team wants to ensure that if a migration fails, the deployment is rolled back and the database is restored to its previous state. Which THREE steps should the engineer implement?

Accepted Answer

Take a snapshot of the RDS database before the migration.. Option A is correct because a snapshot provides a restore point. Option B is correct because CodeDeploy can run scripts, including migration scripts. Option D is correct because rollback can be configured in CodeDeploy. Option C is not typically used for database migrations. Option E is not a standard practice for rollback.

Answer

Use CloudFormation with a custom resource to run the migration.

Answer

Use AWS Database Migration Service (DMS) to replicate the database continuously.

Question 7

A company uses AWS CodePipeline to deploy a static website to Amazon S3 and CloudFront. The pipeline currently uses CodeBuild to run tests and then deploys to an S3 bucket. The team wants to add a stage that invalidates the CloudFront cache after deployment. Which TWO actions achieve this?

Accepted Answer

Use the AWS CLI command 'aws cloudfront create-invalidation' in a CodeBuild build step.. Option A is correct because CloudFront has an invalidation API. Option C is correct because CodePipeline can have a Lambda invocation as a stage action. Option B is not a native integration. Option D is an alternative but not a CodePipeline action. Option E is not a standard action.

Answer

Configure CodePipeline to directly invalidate CloudFront using a built-in action.

Answer

Create a CodePipeline stage with a deploy action to CloudFront.

Answer

Use CloudFront to automatically invalidate based on S3 events.

Question 8

Refer to the exhibit. An IAM policy is attached to a CodePipeline service role. When the pipeline tries to start a CodeBuild project, it fails with an 'AccessDenied' error. The CodeBuild project uses a different service role (arn:aws:iam::123456789012:role/CodeBuildServiceRole2). What is the MOST likely cause?

Accepted Answer

The policy only allows iam:PassRole for a specific role ARN, but the CodeBuild project uses a different role.. Option B is correct because the policy explicitly allows iam:PassRole only for one specific role ARN. Since the CodeBuild project uses a different role, the pass role fails. Option A is incorrect because codebuild:StartBuild is allowed. Option C is incorrect because the policy allows s3:GetObject. Option D is incorrect because the policy does not have a condition on s3 actions.

Answer

The policy has a condition on the s3 actions that is not satisfied.

Answer

The policy does not allow codebuild:StartBuild for the specific project.

Answer

The policy does not allow s3:GetObject on the artifact bucket.

Question 9

Refer to the exhibit. A CodeBuild project uses this buildspec.yml to build and push a Docker image to Amazon ECR. The build fails at the pre_build phase with the error 'Error: Cannot perform an interactive login from a non TTY device'. What is the MOST likely issue?

Accepted Answer

The CodeBuild project's IAM role does not have permission to call ecr:GetAuthorizationToken.. Option C is correct because aws ecr get-login-password outputs the password to stdout, and docker login reads from stdin. The pipe (|) should work. However, the error indicates that docker login is trying interactive mode, which suggests that the command is not receiving the password correctly. But the real issue is that the ECR login command requires AWS credentials, and if the CodeBuild project does not have proper permissions to call ecr:GetAuthorizationToken, it will fail. Option A is not relevant because the error is about interactive login. Option B is not the cause. Option D is incorrect because the region is specified via environment variable.

Answer

The AWS_DEFAULT_REGION environment variable is not set in CodeBuild.

Answer

The buildspec.yml is missing the 'docker login' command.

Answer

The Docker daemon is not running on the CodeBuild instance.

Question 10

Refer to the exhibit. A CloudTrail log shows a failed GitPush event to a CodeCommit repository by the IAM user 'jenkins'. The DevOps engineer has attached the following IAM policy to the user: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "codecommit:*",
      "Resource": "*"
    }
  ]
}
What is the MOST likely reason for the failure?

Accepted Answer

The user has not generated a Git credential for CodeCommit in the IAM console.. Option C is correct because CodeCommit requires an inline policy or managed policy to allow Git operations, but the user may be trying to push using HTTPS with a Git credential that is not associated with the IAM user, or the SSH key is not configured. However, the error says the user is not authorized, which suggests that the IAM policy is not effective because CodeCommit requires a specific Git credentials or SSH key to authenticate, not just an IAM policy. Actually, the IAM policy should allow the action. The most common issue is that the user has not created a Git credential in IAM for CodeCommit. Option A is about permissions boundary. Option B is about IP restriction. Option D is about HTTPS vs SSH.

Answer

The user is trying to push via HTTPS but the repository only allows SSH.

Answer

The user's IAM policy includes a condition that restricts access based on source IP, and the push originates from a different IP.

Answer

The policy is attached but the user has a permissions boundary that denies codecommit:GitPush.

Question 11

A development team is using AWS CodeCommit as the source for a CI/CD pipeline. They want to automatically run unit tests when a pull request is created, but only for changes to the 'src' directory. Which approach should they use?

Accepted Answer

Create an AWS CodeBuild project with a source provider of CodeCommit and configure 'WEBHOOK' events with a filter for pull requests and path filter for 'src/**'.. Option B is correct because AWS CodeBuild can be triggered by a pull request event with a path filter. Option A is wrong because CodePipeline does not natively trigger on pull requests. Option C is wrong because Lambda alone cannot trigger on CodeCommit events without an additional trigger. Option D is wrong because EventBridge can trigger on pull request events, but the path filtering should be done in the CodeBuild project configuration for efficiency.

Answer

Use an AWS Lambda function that polls CodeCommit for new pull requests and invokes CodeBuild when changes in 'src' directory are detected.

Answer

Set up an Amazon EventBridge rule that matches CodeCommit pull request events and invoke CodeBuild. Add a condition in the CodeBuild buildspec to check if changes are in 'src' directory.

Answer

Configure an AWS CodePipeline with a Source stage for CodeCommit and a Test stage for CodeBuild. Use a manual approval step to trigger on pull requests.

Question 12

A company uses AWS CodeBuild to compile Java applications. The builds often fail due to insufficient memory. The buildspec currently specifies 'compute-type: BUILD_GENERAL1_SMALL'. What is the most cost-effective solution to resolve the memory issues without changing the build logic?

Accepted Answer

Change the compute-type to 'BUILD_GENERAL1_MEDIUM' or 'BUILD_GENERAL1_LARGE' in the buildspec.. Option C is correct because increasing the compute type to a larger size provides more memory. Option A is wrong because enabling local caching does not increase memory. Option B is wrong because CodeBuild does not support memory overprovisioning. Option D is wrong because using multiple build environments in parallel does not help a single build's memory needs.

Answer

Enable Amazon S3 caching for the build artifacts to reduce memory usage.

Answer

Split the build into multiple parallel CodeBuild actions in the pipeline, each compiling a subset of the code.

Answer

Set the environment variable 'MEMORY_OVERPROVISION=2' in the buildspec.

Question 13

A DevOps engineer is designing a deployment pipeline for a microservices application on Amazon ECS. The team wants to use blue/green deployments with automatic rollback if CloudWatch alarms are triggered during the deployment. Which combination of services and configurations should the engineer use?

Accepted Answer

Use AWS CodeDeploy with a blue/green deployment configuration on the ECS service, and configure automatic rollback when CloudWatch alarms are breached.. Option D is correct because CodeDeploy supports blue/green deployments on ECS with automatic rollback based on CloudWatch alarms. Option A is wrong because ECS service auto scaling is for scaling, not deployment. Option B is wrong because CloudFormation does not natively support blue/green with automatic rollback based on alarms. Option C is wrong because CodeBuild is for building, not deploying.

Answer

Use AWS CloudFormation with a ChangeSet and a custom rollback Lambda function triggered by CloudWatch alarms.

Answer

Use AWS CodeBuild to run a build that creates a new task definition, then update the ECS service manually, and use CloudWatch alarms to trigger a rollback via a Lambda function.

Answer

Use Amazon ECS service auto scaling with step scaling policies based on CloudWatch alarms.

Question 14

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a Source stage from CodeCommit and a Deploy stage that syncs the contents to an S3 bucket. The deployment fails intermittently with a 'BucketNotEmpty' error. What is the most likely cause?

Accepted Answer

The S3 bucket has versioning enabled, and the deploy action is trying to delete the bucket before syncing.. Option B is correct because the error 'BucketNotEmpty' indicates the bucket has versioning enabled and the sync command does not delete previous versions. Option A is wrong because S3 bucket policies do not cause this error. Option C is wrong because CodePipeline does not enforce bucket deletion. Option D is wrong because the source stage is unrelated to the bucket's state.

Answer

The source artifact from CodeCommit contains a 'delete' manifest that instructs S3 to remove all files.

Answer

The CodePipeline service role does not have permission to list the bucket contents.

Answer

The S3 bucket has a bucket policy that denies DeleteObject permissions.

Question 15

A team uses AWS CloudFormation to manage infrastructure. They want to automatically update the stack when a new version of a Docker image is pushed to Amazon ECR. Which approach should they use?

Accepted Answer

Configure an Amazon EventBridge rule to detect ECR image pushes and invoke an AWS Lambda function that calls 'UpdateStack' with the new image URI.. Option C is correct because Amazon ECR events can trigger a Lambda function that updates the CloudFormation stack. Option A is wrong because CodeBuild does not directly update CloudFormation stacks. Option B is wrong because CodeDeploy does not update CloudFormation stacks. Option D is wrong because Amazon SNS cannot directly update CloudFormation stacks.

Answer

Create a CodeBuild project that triggers on ECR push, and have the build execute an 'aws cloudformation update-stack' command.

Answer

Use AWS CodeDeploy with a trigger on ECR push to deploy the new image to a target group, and have the target group update the stack.

Answer

Set up an Amazon SNS topic subscribed to ECR image push events, and have the SNS topic send a notification to an AWS CloudFormation stack update endpoint.