DOP-C02 SDLC Automation Practice Test 23 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a critical application. The pipeline has a manual approval step before deployment. Which TWO actions should be taken to improve security and auditability? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail to log all approval actions.. Enabling AWS CloudTrail to log all approval actions provides a detailed, immutable audit trail of who approved or rejected a pipeline stage, when it happened, and from which IP address. This is essential for compliance and forensic analysis, as CloudTrail captures the `Approval` API calls made by CodePipeline, including the `approve` and `reject` actions, along with the IAM user or role identity. Without CloudTrail, there is no native logging of manual approval events, making it impossible to prove accountability.

Answer

Remove the approval step and rely on post-deployment monitoring.

Answer

Replace the manual approval with an automated approval based on test results.

Answer

Use a shared IAM user for all approvers to simplify management.

Question 2

Which THREE AWS services can be used as a source action in AWS CodePipeline? (Choose three.)

Accepted Answer

Amazon S3. Amazon S3 is a supported source action in AWS CodePipeline because you can configure a pipeline to use an S3 bucket as a source location for your application code or artifacts. When you upload a new version of a file to the specified S3 bucket, CodePipeline can automatically detect the change (via Amazon CloudWatch Events or S3 event notifications) and start the pipeline execution. This is commonly used for deploying static websites or integrating with third-party CI/CD tools that output artifacts to S3.

Answer

Amazon DynamoDB

Answer

AWS CloudFormation

Question 3

A DevOps team is designing a CI/CD pipeline for a containerized application. Which THREE components are essential for a complete pipeline? (Choose three.)

Accepted Answer

Artifact storage. Artifact storage (Option B) is essential because a complete CI/CD pipeline must store build outputs (e.g., Docker images, JAR files) in a durable, versioned repository. Without artifact storage, subsequent deployment stages cannot reliably retrieve the exact build artifact that passed testing, breaking traceability and rollback capabilities. Services like Amazon ECR or S3 serve this role, ensuring immutability and consistent delivery across environments.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Question 4

Refer to the exhibit. A developer runs the AWS CLI command to start a build in AWS CodeBuild. The build project 'my-project' uses an S3 bucket as the source. What is the MOST likely cause of the error?

Accepted Answer

The CodeBuild service role does not have s3:GetObject permission on the source bucket.. The error occurs because CodeBuild needs to download the source code from the S3 bucket during the build. The CodeBuild service role, not the developer's IAM user, makes the s3:GetObject API call to retrieve the source object. Without this permission on the service role, the build fails with an access denied error.

Answer

The S3 bucket name is misspelled in the build project configuration.

Answer

The developer's IAM user does not have s3:GetObject permission.

Answer

The S3 bucket is in a different region than the CodeBuild project.

Question 5

Refer to the exhibit. A team uses this buildspec.yml file in AWS CodeBuild. After the build, they expect the artifacts to be placed in a folder structure, but all files are in the root of the output artifact. What is the reason?

Accepted Answer

The 'discard-paths' option is set to 'yes', which flattens the directory structure.. The `discard-paths` option in the `artifacts` section of a buildspec.yml file, when set to `yes`, explicitly flattens the directory structure. This means that even if the `files` glob pattern `**/*` matches files in subdirectories, they are all placed at the root of the output artifact, discarding their original relative paths. Without this setting (or when set to `no`), the directory hierarchy would be preserved.

Answer

The 'files' section only includes '**/*' which does not preserve paths.

Answer

The 'base-directory' is not specified, so CodeBuild uses the root of the build output.

Answer

The 'name' property is missing, causing artifacts to be stored without structure.

Question 6

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The pipeline has a Source stage that polls the repository for changes. Recently, developers have noticed that the pipeline does not always trigger when code is pushed to the main branch. What is the most likely cause?

Accepted Answer

The number of pushes to the repository has exceeded the CodePipeline poll rate limit.. CodePipeline uses a polling mechanism to check for changes in CodeCommit repositories. When the number of pushes exceeds the default poll rate limit (typically one request per 15 seconds), the pipeline may miss some changes, leading to inconsistent triggering. This is a known limitation of polling-based detection, especially in high-velocity development environments.

Answer

The repository does not have a webhook configured to notify CodePipeline of changes.

Answer

The IAM role used by CodePipeline does not have permission to read from CodeCommit.

Answer

CloudWatch Events is not enabled for the repository.

Question 7

A company uses AWS CodeBuild to compile and test code. The buildspec.yaml includes a pre_build phase that runs 'aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com'. The build fails with 'Error: Cannot connect to the Docker daemon'. What is the most likely cause?

Accepted Answer

The CodeBuild project does not have privileged mode enabled.. The error 'Cannot connect to the Docker daemon' indicates that the Docker daemon is not running or inaccessible within the CodeBuild build environment. CodeBuild runs Docker commands inside a container that does not have a Docker daemon by default. To execute Docker commands (such as docker login or docker build), the CodeBuild project must be configured with privileged mode enabled, which grants the container elevated permissions to run its own Docker daemon. Without privileged mode, any attempt to interact with the Docker daemon will fail.

Answer

The region specified does not match the ECR repository region.

Answer

The Docker login command syntax is incorrect.

Answer

The AWS CLI is not installed in the CodeBuild environment.

Question 8

A DevOps engineer is setting up a CI/CD pipeline for a microservices application using AWS CodePipeline. The pipeline includes a Test stage that runs integration tests against a staging environment. The engineer wants to ensure that manual approval is required before deploying to production. Which action should be taken?

Accepted Answer

Add a manual approval action in the pipeline stage before production deployment.. AWS CodePipeline supports a manual approval action that can be added to any stage. By placing this action in the stage immediately before the production deployment, the pipeline will pause and require an authorized user to manually approve the transition, ensuring that integration tests have passed before any production release occurs.

Answer

Configure a CodeCommit approval rule template to block the merge.

Answer

Use CloudWatch Events to send a notification and wait for a custom signal.

Answer

Set the pipeline to only run on manual invocation.

Question 9

A team uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS instance. During an update, the stack fails with 'CREATE_FAILED' for the DB instance resource, and the error message indicates 'The DB instance already exists.' What is the most likely cause?

Accepted Answer

An RDS instance with the same identifier already exists in the account and region.. The error 'The DB instance already exists' indicates that CloudFormation is attempting to create a new RDS instance with a DB instance identifier that is already in use within the same AWS account and region. Since DB instance identifiers must be unique per account and region, the creation fails. This typically occurs when a stack update triggers a resource replacement (e.g., due to a property change that requires recreation) and the old instance was not deleted or its identifier is still reserved.

Answer

The stack update is trying to replace the DB instance without a proper UpdateReplace policy.

Answer

The stack has a DeletionPolicy of Retain on the RDS instance.

Answer

The RDS instance has deletion protection enabled.

Question 10

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment is set to 'AllAtOnce'. The application revision is a simple index.html. What is the most likely cause?

Accepted Answer

The CodeDeploy agent is not installed or running on the EC2 instances.. The error message indicates that too many instances failed deployment, which is typical when the CodeDeploy agent is not running on the EC2 instances. With an 'AllAtOnce' deployment, all instances are targeted simultaneously, so if the agent is missing on every instance, all will fail immediately, causing the overall deployment to fail. The simple index.html revision is not the issue; the agent is required to execute the AppSpec file and pull the revision from S3 or GitHub.

Answer

The IAM instance profile does not have permissions to download from Amazon S3.

Answer

The application revision is not a compressed archive.

Answer

The deployment configuration 'AllAtOnce' is incompatible with Auto Scaling groups.

Question 11

A developer wants to automate the testing of a serverless application built with AWS Lambda and Amazon API Gateway. Which AWS service is best suited for running integration tests as part of a CI/CD pipeline?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is best suited for running integration tests as part of a CI/CD pipeline because it is a fully managed continuous integration service that can compile source code, run tests, and produce software packages. For a serverless application using Lambda and API Gateway, CodeBuild can execute integration tests against deployed API endpoints, validate Lambda function responses, and integrate seamlessly with other AWS developer tools like CodePipeline. It supports custom build environments and can run test frameworks (e.g., Postman/Newman, Jest) directly in the pipeline.

Answer

AWS CodeDeploy

Answer

Amazon CloudWatch

Answer

AWS CloudFormation

Question 12

A company uses AWS Elastic Beanstalk for deploying a web application. The development team wants to implement a blue/green deployment strategy to minimize downtime. Which approach should they use?

Accepted Answer

Create a new Elastic Beanstalk environment and swap the environment CNAMEs.. In AWS Elastic Beanstalk, blue/green deployment is achieved by creating a separate environment (the green environment) alongside the existing one (the blue environment), deploying the new application version to it, and then swapping the CNAME records of the two environments. This swap is instantaneous at the DNS level, resulting in zero downtime because traffic is immediately redirected from the old environment to the new one without any instance replacement or gradual shifting.

Answer

Update the Auto Scaling group launch configuration and gradually replace instances.

Answer

Create a new CodeDeploy deployment group and use the blue/green deployment configuration.

Answer

Create a new target group and register instances from the old environment.

Question 13

A DevOps engineer is troubleshooting a CodePipeline that has a Build stage using AWS CodeBuild. The build logs show 'Error: No such file or directory' for a file that is present in the source repository. What is the most likely cause?

Accepted Answer

The buildspec.yaml specifies an incorrect path for the file relative to the source root.. The error 'No such file or directory' indicates that the build process is attempting to access a file at a path that does not exist relative to the source root. In AWS CodeBuild, the build runs in a temporary directory that contains the source code, and all paths in the buildspec.yaml are relative to the source root by default. If the buildspec.yaml specifies an incorrect relative path (e.g., using an absolute path or a wrong subdirectory), CodeBuild will fail to locate the file, even though it exists in the repository.

Answer

The build commands are not executed because the pre_build phase failed.

Answer

The artifact definition in the buildspec.yaml is incorrect.

Answer

The environment variables in CodeBuild are not set correctly.

Question 14

A company uses AWS CloudFormation to manage a stack that includes an Amazon SQS queue. The queue name must be unique. The developer wants to define the queue name in the CloudFormation template. Which intrinsic function should be used to generate a unique name?

Accepted Answer

Fn::Sub. A is correct because `Fn::Sub` can embed a pseudo parameter like `AWS::StackName` or `AWS::AccountId` into a string to generate a unique queue name. By using `Fn::Sub` with a reference to the stack name or a random string, you can create a name that avoids collisions across accounts or regions, satisfying the uniqueness requirement for SQS queue names.

Answer

Fn::Select

Answer

AWS::NoValue

Answer

Fn::GetAtt

Question 15

A company uses AWS CodePipeline with multiple stages. The pipeline includes a Beta stage that deploys to a test environment and a Prod stage. The team wants to require manual approval before the Prod stage. Which TWO actions should be taken to implement this? (Choose TWO.)

Accepted Answer

Ensure that the IAM user or role performing the approval has codepipeline:PutApprovalResult permissions.. Option D is correct because AWS CodePipeline implements manual gating through a dedicated approval action: you add a manual approval action to the stage (or a stage placed between Beta and Prod) so the pipeline pauses and waits for a human decision before continuing to Prod. Option A is correct because the person or role that approves the action must call the CodePipeline PutApprovalResult API, which requires the codepipeline:PutApprovalResult IAM permission; without it, the approval cannot be submitted and the pipeline stays blocked. Option B is not needed because CloudWatch Events/EventBridge with Lambda is a custom workaround, whereas CodePipeline natively supports manual approval actions. Option C is incorrect because CodePipeline stages do not have a 'manual invocation only' setting; approvals are handled by approval actions, not stage invocation modes. Option E is incorrect because CodeCommit approval rule templates govern pull-request merges in CodeCommit, not CodePipeline stage transitions.

Answer

Use CloudWatch Events to trigger a Lambda function that requires manual sign-off.

Answer

Set the Prod stage to only run on manual invocation.

Answer

Configure a CodeCommit approval rule template to require approval before merging.