DOP-C02 SDLC Automation Practice Test 24 — 15 Questions

Question 1

A DevOps team uses AWS CloudFormation with nested stacks. They are experiencing stack update failures because changes to a nested stack cause resource conflicts. Which THREE best practices should they follow to manage nested stack updates? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a stack policy to prevent updates to critical resources in the nested stacks.. Applying a stack policy to nested stacks prevents updates to critical resources, avoiding conflicts during nested stack updates. Stack policies act as a guard to deny updates to specified resources, which is essential when changes to a nested stack might cause resource conflicts or unintended modifications. This best practice ensures that only intended changes are applied, reducing the risk of update failures.

Answer

Set the stack update to disable rollback to allow debugging of failures.

Answer

Use DependsOn to ensure nested stacks are updated in a specific order.

Question 2

Refer to the exhibit. A developer has a buildspec.yaml for a React application. The build completes successfully, but the artifacts output is empty. What is the most likely cause?

Accepted Answer

The base-directory specified does not exist after the build phase.. The most likely cause is that the `base-directory` specified in the `artifacts` section of the buildspec.yaml does not exist after the build phase completes. CodeBuild uses the `base-directory` to locate the files to package as artifacts; if the directory is missing (e.g., because the build output was written to a different path or the directory name was misspelled), no files are found, resulting in an empty artifacts output. This is a common misconfiguration when the build process generates files in a subdirectory that does not match the declared `base-directory`.

Answer

The install phase did not run because npm install is not in the correct phase.

Answer

The artifacts files pattern '**/*' is invalid.

Answer

The runtime version nodejs 14 is not supported by CodeBuild.

Question 3

A development team uses AWS CodeCommit and AWS CodePipeline for CI/CD. They notice that a pipeline execution failed due to a code review rejection in the 'Approve' stage. The pipeline is configured with a manual approval action. What is the most likely cause of the failure?

Accepted Answer

An authorized user logged in to the CodePipeline console and rejected the approval request.. A manual approval action in CodePipeline explicitly requires a human reviewer to approve or reject the pipeline execution. If the pipeline failed due to a 'code review rejection,' the most direct cause is that an authorized user logged into the CodePipeline console and clicked the 'Reject' button on the approval request. This is the only mechanism by which a manual approval action can result in a rejection.

Answer

The IAM role for the pipeline does not have permission to invoke the approval action.

Answer

The CodeCommit repository has a branch policy that prevents direct commits.

Answer

The pipeline is not configured with a CloudWatch Events rule to trigger the approval.

Question 4

A company uses AWS CodeBuild to run integration tests as part of a pipeline. The tests require access to an Amazon RDS database. The RDS instance is in a private subnet with no public access. The CodeBuild project is configured with a VPC. Which additional configuration is necessary to ensure the build can connect to the database?

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic from the security group associated with the CodeBuild project.. The CodeBuild project is configured with a VPC, meaning it runs inside a private subnet and uses an elastic network interface (ENI) with an associated security group. To allow the build container to connect to the RDS instance, the RDS security group must have an inbound rule that permits traffic on port 3306 (or the appropriate database port) from the CodeBuild security group. This is a standard network-layer access control; no additional IAM or gateway is required for connectivity.

Answer

Add an IAM policy that grants the CodeBuild service role access to the RDS instance.

Answer

Create a VPC endpoint for Amazon RDS.

Answer

Attach a NAT gateway to the private subnet.

Question 5

A team wants to automate the deployment of a serverless application using AWS SAM. They have a template.yaml file defining Lambda functions, an API Gateway, and a DynamoDB table. Which command should they use to build and deploy the application?

Accepted Answer

sam build && sam deploy. The correct command sequence is `sam build && sam deploy` because AWS SAM requires the `sam build` command to transform the SAM template into an AWS CloudFormation template with the necessary artifact packaging, and then `sam deploy` to create or update the stack. Option C is the only choice that performs both the build (which resolves local dependencies and prepares deployment artifacts) and the deployment step, which is essential for a serverless application defined in a SAM template.

Answer

aws cloudformation deploy --template-file template.yaml

Answer

sam package --output-template-file packaged.yaml

Answer

sam deploy --guided

Question 6

An organization uses AWS CodePipeline with a multi-branch strategy. They want to run unit tests on every push to any branch, but only deploy to production on pushes to the 'main' branch. What is the most efficient way to achieve this?

Accepted Answer

Configure a single pipeline with a source action that triggers on all branches, then use a 'branch' condition on the deployment stage to only proceed if the branch is 'main'.. AWS CodePipeline supports a single pipeline with a source action configured to trigger on all branches (e.g., using a webhook event filter for 'refs/heads/*'). You can then add a 'branch' condition on the deployment stage using a Lambda function or a manual approval action that checks the branch name, ensuring only pushes to 'main' proceed to production. This approach avoids duplicating pipelines while still running unit tests on every push.

Answer

Use a single pipeline with a source action that triggers on all branches, and deploy to a test environment for all branches, then promote to production manually.

Answer

Create separate pipelines for each branch, each with its own test and deploy stages.

Answer

Use a single pipeline with a source action that only triggers on the 'main' branch, and run tests in a separate system.

Question 7

A company is using AWS CodeDeploy with a blue/green deployment strategy for an Amazon ECS service. After a deployment, the new task set fails health checks, and CodeDeploy automatically rolls back to the original task set. However, the rollback fails because the original task set's desired count is set to 0. What is the most likely cause?

Accepted Answer

The original task set's desired count was set to 0 during the blue/green deployment and the rollback is unable to restore it because the original task definition is no longer available.. During a blue/green deployment on ECS, CodeDeploy sets the original (blue) task set's desired count to 0 after the new (green) task set is created and begins serving traffic. If the green task set fails health checks and triggers an automatic rollback, CodeDeploy attempts to restore the original task set's desired count to its previous value. However, if the original task definition has been deregistered or deleted (e.g., due to lifecycle policies or manual cleanup), the rollback cannot scale the original task set back up, causing the rollback to fail.

Answer

The original task set's health checks are failing.

Answer

The original task set's CloudFormation stack was deleted during the deployment.

Answer

The original task set was deregistered from the target group.

Question 8

A DevOps engineer needs to automate the creation of an AWS CodeStar project for a new microservice. The engineer wants to use AWS CloudFormation to define the project and its resources. Which CloudFormation resource should be used?

Accepted Answer

AWS::CodeStar::Project. AWS::CodeStar::Project is the correct CloudFormation resource because it directly creates an AWS CodeStar project, which is a project management hub that integrates AWS services like CodeCommit, CodeBuild, CodeDeploy, and CodePipeline for continuous delivery. This resource allows you to define the project template, source repository, and other settings in a single CloudFormation stack, automating the entire CodeStar project creation.

Answer

AWS::ServiceCatalog::CloudFormationProduct

Answer

AWS::CodePipeline::Pipeline

Answer

AWS::CodeBuild::Project

Question 9

An organization uses AWS CodePipeline to deploy a web application to Amazon EC2 instances behind an Application Load Balancer. The deployment uses a CodeDeploy action with an in-place deployment configuration. After a recent deployment, some instances are running the old version while others are running the new version. What is the most likely cause?

Accepted Answer

The deployment group was configured with the 'AllAtOnce' deployment configuration, and the deployment failed partway through.. B is correct because the 'AllAtOnce' deployment configuration instructs CodeDeploy to deploy to all instances simultaneously. If the deployment fails partway through, some instances may have received the new version while others remain on the old version, resulting in a mixed state. This is the most likely cause given the symptom of a split between old and new versions across instances.

Answer

The deployment group is associated with an Auto Scaling group that launched new instances during the deployment.

Answer

A lifecycle hook is configured to pause the deployment until manual approval.

Answer

The deployment was configured to use a blue/green strategy, but the target group is misconfigured.

Question 10

A development team uses AWS CodeBuild to compile a Java application. The build takes 15 minutes on average, but recently it started taking over 30 minutes. The buildspec.yml file is unchanged. What is the most likely cause?

Accepted Answer

The cache for the build project was cleared, forcing a full dependency download.. The most likely cause is that the build project's cache was cleared, forcing a full dependency download. CodeBuild can cache dependencies (e.g., Maven local repository) to speed up builds. If the cache is invalidated or cleared, the build must re-download all dependencies from the internet, significantly increasing build time from 15 minutes to over 30 minutes, even though the buildspec.yml is unchanged.

Answer

The build environment was changed from a Linux to a Windows environment.

Answer

The build project's compute type was downgraded to a smaller instance.

Answer

The buildspec.yml file was updated to include more build commands.

Question 11

Which TWO actions can be used to improve the security of a CI/CD pipeline that uses AWS CodePipeline? (Choose two.)

Accepted Answer

Enable encryption for artifacts stored in the pipeline's S3 bucket.. AWS CodePipeline stores artifacts in an S3 bucket, and enabling default encryption (SSE-S3 or SSE-KMS) ensures that all objects at rest are encrypted, protecting sensitive build outputs and source code from unauthorized access if the bucket is compromised. This is a fundamental security best practice for data at rest in any CI/CD pipeline.

Answer

Configure the source action to poll for changes instead of using webhooks.

Answer

Store secrets in the pipeline environment variables in plain text.

Answer

Use a single IAM role for all pipeline actions to simplify permissions.

Question 12

Which THREE considerations are important when designing a CI/CD pipeline for a microservices architecture using AWS CodePipeline? (Choose three.)

Accepted Answer

Include automated integration tests that validate service-to-service interactions.. In a microservices architecture, automated integration tests are essential to validate that service-to-service interactions (e.g., API calls, event-driven communication) work correctly after changes. AWS CodePipeline can run these tests in a dedicated stage using AWS CodeBuild or third-party tools, catching integration failures before deployment to production.

Answer

All microservices should be deployed using a single pipeline to ensure consistency.

Answer

Use manual approval gates at every stage to ensure quality.

Question 13

Which TWO AWS services can be used as source actions in AWS CodePipeline to automatically trigger a pipeline when changes are made? (Choose two.)

Accepted Answer

Amazon S3. Amazon S3 is a valid source action in AWS CodePipeline because you can configure a pipeline to start when a new object is created or an existing object is updated in an S3 bucket. This is achieved by enabling Amazon S3 event notifications (via Amazon S3 Event Notifications) that send events to Amazon CloudWatch Events or directly to AWS CodePipeline using a CloudWatch Events rule, which then triggers the pipeline execution. This allows automatic pipeline runs on code or artifact changes stored in S3.

Answer

Amazon CloudWatch

Answer

Amazon EC2

Answer

AWS CloudFormation

Question 14

A development team is using AWS CodeCommit to store source code and AWS CodePipeline to automate builds and deployments. The team wants to ensure that builds and tests are triggered only when code is pushed to specific branches, and that manual approval is required before deploying to production. Which CodePipeline configuration should the team implement?

Accepted Answer

Configure the source action with a branch filter for main, and add a manual approval step before the production deployment stage.. CodePipeline source actions support branch filters that restrict which Git branches trigger the pipeline. By filtering on 'main', only pushes to that branch initiate the pipeline. Adding a manual approval step before the production deployment stage ensures that no code reaches production without explicit human sign-off, meeting both requirements precisely.

Answer

Configure the source action to trigger on all branches and add a manual approval step before the build stage.

Answer

Configure the source action with a branch filter for main, and add a manual approval step before the build stage.

Answer

Use a branch filter on the build action to run only for the main branch, and add a manual approval step before the deploy stage.

Question 15

A company uses AWS CodeBuild to compile a Java application. The buildspec.yml includes a pre_build phase that runs unit tests and a build phase that packages the application. Recently, builds have been failing intermittently with 'OutOfMemoryError' during the test phase. The build environment is set to 'BUILD_GENERAL1_SMALL'. What is the MOST cost-effective solution?

Accepted Answer

Change the build environment to 'BUILD_GENERAL1_MEDIUM' which has more memory.. The 'BUILD_GENERAL1_SMALL' environment provides only 3 GB of memory, which is insufficient for the unit tests, causing intermittent 'OutOfMemoryError'. Upgrading to 'BUILD_GENERAL1_MEDIUM' (7 GB) directly addresses the memory shortage without architectural changes, and it is the most cost-effective solution because it avoids the complexity and additional costs of parallel jobs or test splitting while still resolving the root cause.

Answer

Split the tests into smaller batches using CodeBuild test splitting.

Answer

Configure the buildspec to set MAVEN_OPTS='-Xmx512m' to reduce JVM heap usage.

Answer

Use multiple CodeBuild jobs to run tests in parallel.