DOP-C02 SDLC Automation Practice Test 24 — 15 Questions

Question 1

A company has a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build stage runs unit tests and produces a JUnit report. The pipeline includes a test action that publishes results to an S3 bucket. Recently, the pipeline started failing with the error: 'The action could not be started because the artifact bucket policy is misconfigured.' What is the most likely cause?

Accepted Answer

The artifact bucket's bucket policy does not grant the necessary permissions to the CodePipeline service role.. Option A is correct because CodePipeline requires a bucket policy that allows cross-account access if the pipeline uses an artifact bucket in a different account. Option B is wrong because S3 transfer acceleration is not related. Option C is wrong because the bucket is already in use. Option D is wrong because KMS keys are not mentioned in the error.

Answer

The S3 bucket has Amazon S3 Transfer Acceleration enabled, which is not supported by CodePipeline.

Answer

The KMS key used to encrypt the bucket objects has been rotated, causing the pipeline to lose access.

Answer

The artifact bucket is in a different AWS Region than the pipeline, and cross-region replication is not enabled.

Question 2

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They want to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Accepted Answer

Change Sets. Option B is correct because Change Sets allow you to preview changes before executing. Option A is wrong because stack policies prevent updates to specific resources, not overall review. Option C is wrong because drift detection identifies differences, not updates. Option D is wrong because stack sets deploy across accounts, not preview changes.

Answer

Drift detection

Answer

Stack policies

Answer

StackSets

Question 3

A company uses AWS CodePipeline with a manual approval stage before deploying to production. The approval notification is sent via Amazon SNS. The approvers report that they are not receiving the email notifications. What should the DevOps engineer check first?

Accepted Answer

Confirm that the email subscriptions to the SNS topic have been confirmed by clicking the link in the initial confirmation email.. Option C is correct because SNS requires subscription confirmation; if not confirmed, emails are not delivered. Option A is wrong because SNS topics do not have inbound rules. Option B is wrong because the default mailbox quota is high and unlikely to be the issue. Option D is wrong because SNS does not use roles for email delivery.

Answer

Ensure that the IAM role for CodePipeline has permission to publish to the SNS topic.

Answer

Verify that the SNS topic's subscription has a filter policy that matches the approval event.

Answer

Check the email recipients' mailbox quota to see if it is full.

Question 4

A team uses AWS CodeBuild to run integration tests that require access to an Amazon RDS database. The database is in a private subnet. The CodeBuild project is configured to use a VPC. However, the builds are failing with a timeout connecting to the database. What could be the issue?

Accepted Answer

The security group for the RDS database does not allow inbound traffic from the security group assigned to the CodeBuild project.. Option B is correct because security group rules must allow inbound traffic from the security group associated with the CodeBuild project. Option A is wrong because CodeBuild VPC support requires subnets, not just the VPC ID. Option C is wrong because CodeBuild does not need an internet gateway for VPC-based builds; it can use VPC endpoints for AWS services. Option D is wrong because the security group for CodeBuild should allow outbound to the database, but the database's security group must allow inbound from CodeBuild.

Answer

The CodeBuild project's VPC configuration does not include the subnet IDs where the database resides.

Answer

The security group for the CodeBuild project does not allow outbound traffic to the RDS database.

Answer

The CodeBuild project does not have a route to the internet via an internet gateway, so it cannot reach the RDS endpoint.

Question 5

A company is implementing a CI/CD pipeline for a microservices architecture on Amazon ECS. The pipeline must deploy to multiple environments (dev, test, prod) in sequence with manual approval gates between environments. Which two AWS services should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS CodePipeline. Option A (CodePipeline) is correct because it orchestrates the pipeline stages. Option D (CodeDeploy) is correct because it handles the deployment to ECS with blue/green or rolling updates. Option B (CodeBuild) is for building, not deployment. Option C (CloudFormation) is for infrastructure, not deployment of microservices. Option E (Elastic Beanstalk) is a PaaS service, not suited for ECS microservices.

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Question 6

A DevOps team is using AWS CloudFormation to deploy a three-tier web application. The stack includes an Application Load Balancer, an Auto Scaling group, and an RDS database. They want to update the stack to change the instance type of the Auto Scaling group without downtime. Which three steps should they take? (Choose THREE.)

Accepted Answer

Create a new Auto Scaling group with the new instance type and attach it to the load balancer, then delete the old group.. Option A is correct because using a rolling update with a pause before replacing instances minimizes downtime. Option C is correct because updating the launch template with the new instance type is necessary. Option D is correct because creating a new Auto Scaling group first allows a blue/green approach. Option B is wrong because terminating all instances at once causes downtime. Option E is wrong because modifying the RDS instance type is not part of the change.

Answer

Modify the RDS instance type to match the new EC2 instance type for consistency.

Answer

Terminate all instances in the Auto Scaling group before updating the launch configuration.

Question 7

A company uses AWS CodePipeline to automate their software release process. They want to add a stage that runs security scanning on the code before deployment. Which two AWS services can be integrated into the pipeline for this purpose? (Choose TWO.)

Accepted Answer

Amazon Inspector. Option A (CodeBuild) is correct because it can run custom security scanning tools. Option D (Amazon Inspector) is correct because it can be integrated as a test action to scan for vulnerabilities. Option B (CodeDeploy) is for deployment, not scanning. Option C (GuardDuty) is for threat detection in the AWS environment, not code scanning. Option E (Detective) is for analyzing security findings, not scanning code.

Answer

Amazon GuardDuty

Answer

Amazon Detective

Answer

AWS CodeDeploy

Question 8

Your company has a CI/CD pipeline for a Java web application using AWS CodePipeline, CodeBuild, and CodeDeploy. The pipeline has three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy to EC2 instances in an Auto Scaling group). Recently, after a change to the buildspec, the Build stage succeeds but the Deploy stage fails with the error 'The deployment failed because the deployment group exceeded the minimum healthy host count.' The CodeDeploy deployment configuration uses a 'OneAtATime' deployment with a minimum healthy host count of 1. The Auto Scaling group has a minimum size of 2 and a maximum size of 4. The application runs on Amazon Linux 2 instances. The CodeDeploy agent is installed and running on all instances. What is the most likely cause of the failure?

Accepted Answer

The new build artifact is larger, causing the instances to run out of disk space during deployment, which prevents the CodeDeploy agent from completing the deployment.. Option B is correct because if the buildspec change introduced a new artifact that requires additional disk space, the instances may run out of space during deployment, causing the agent to fail and the deployment to stop, leading to insufficient healthy hosts. Option A is wrong because if the agent were missing, the error would be different. Option C is wrong because a different AMI would cause launch failures, not deployment failures. Option D is wrong because the CodeDeploy service role is used by CodeDeploy, not the pipeline; if it were missing, the pipeline would fail earlier.

Answer

The CodeDeploy agent on some instances has been stopped or is not responding.

Answer

The Auto Scaling group is using a different Amazon Machine Image (AMI) that lacks the CodeDeploy agent.

Answer

The CodeDeploy service role does not have permission to describe the Auto Scaling group.

Question 9

You are a DevOps engineer for a company that runs a containerized microservices application on Amazon ECS with Fargate. The CI/CD pipeline uses AWS CodePipeline, with CodeBuild for building Docker images and pushing them to Amazon ECR, and CodeDeploy for deploying to ECS. The pipeline has a manual approval step before production deployment. Recently, the production deployment failed after approval, with the error: 'The service my-service could not be deployed because the task definition arn:aws:ecs:us-east-1:123456789012:task-definition/my-task:5 references an image that does not exist in the repository.' The image was built and pushed successfully in the Build stage. The task definition is updated by CodeDeploy to reference the new image URI. The ECS service is configured with 'deploymentController: CODE_DEPLOY' and uses a blue/green deployment. The CodeDeploy deployment group uses a 'Lambda' compute platform (incorrectly set). The pipeline uses the default CodeDeploy provider for ECS. What is the most likely cause of the failure?

Accepted Answer

The CodeDeploy deployment group's compute platform is set to 'Lambda' instead of 'ECS'.. Option C is correct because CodeDeploy for ECS requires the compute platform to be 'ECS' (or 'Server' for EC2), not 'Lambda'. Setting it to 'Lambda' would cause the deployment to fail as it tries to use a Lambda deployment configuration. Option A is wrong because the image was pushed successfully. Option B is wrong because the pipeline does use CodeDeploy. Option D is wrong because the approval step is manual and would not cause image reference issues.

Answer

The manual approval step changed the task definition ARN to a previous version.

Answer

The ECR repository has a lifecycle policy that expired the image tag before deployment.

Answer

The CodePipeline is not configured to use the CodeDeploy provider for ECS.

Question 10

A development team uses AWS CodePipeline with multiple stages including source, build, and deploy. The pipeline uses an Amazon S3 source action that triggers on changes to a specific bucket. Recently, the pipeline stopped triggering automatically. The IAM role for CodePipeline has the necessary permissions. What is the most likely cause?

Accepted Answer

AWS CloudTrail is not configured to deliver S3 data events to CloudWatch Logs.. Option C is correct because CodePipeline uses Amazon CloudWatch Events to detect S3 events. If CloudTrail is not configured to deliver events to CloudWatch Logs, the pipeline won't trigger. Option A is wrong because S3 event notifications are not used for CodePipeline triggers. Option B is wrong because the pipeline role has permissions. Option D is wrong because the S3 bucket policy is not relevant for triggering.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The S3 bucket policy denies access to CodePipeline.

Answer

The S3 bucket does not have event notifications configured.

Question 11

A company is implementing a blue/green deployment strategy for a microservice hosted on AWS Elastic Beanstalk. They want to minimize downtime and be able to quickly roll back in case of issues. The deployment must support traffic shifting gradually. Which configuration should they use?

Accepted Answer

Use a blue/green deployment with a Classic Load Balancer and swap environment URLs.. Option B is correct because Elastic Beanstalk blue/green deployments with a Classic Load Balancer allow traffic shifting by swapping environment URLs or adjusting DNS weights. Option A is wrong because rolling updates are not blue/green. Option C is wrong because immutable updates replace all instances at once, not gradual. Option D is wrong because canary deployments are not natively supported by Elastic Beanstalk without additional tools.

Answer

Use immutable updates with a fixed percentage of instances.

Answer

Use rolling updates with a batch size of 100%.

Answer

Use canary deployments by configuring the Elastic Load Balancer listener rules.

Question 12

A DevOps engineer needs to automate the creation of an Amazon ECS cluster using AWS CloudFormation. The cluster will run a web application that requires a load balancer. Which resource should be used to define the ECS cluster?

Accepted Answer

AWS::ECS::Cluster. Option A is correct because AWS::ECS::Cluster is the CloudFormation resource for an ECS cluster. Option B is wrong because AWS::ECS::Service is for running tasks. Option C is wrong because AWS::ECS::TaskDefinition defines the task. Option D is wrong because AWS::ECS::ContainerInstance is not a resource; instances are managed by Auto Scaling.

Answer

AWS::ECS::Service

Answer

AWS::ECS::TaskDefinition

Answer

AWS::ECS::ContainerInstance

Question 13

A company uses AWS CodeBuild to run unit tests as part of their CI/CD pipeline. The tests are memory-intensive and occasionally fail due to insufficient memory. The buildspec.yml file uses the default compute type. What is the most cost-effective solution to resolve the memory issue?

Accepted Answer

Change the build project's compute type to a larger instance (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM).. Option C is correct because increasing the compute type to a larger instance provides more memory and is cost-effective compared to other options. Option A is wrong because splitting tests requires code changes and may not resolve memory issues. Option B is wrong because enabling caching does not increase memory. Option D is wrong because using a different build environment but same compute type does not increase memory.

Answer

Use a custom build environment with the same compute type.

Answer

Enable local caching in the build project to reduce disk I/O.

Answer

Split the tests into multiple build projects and run them in parallel.

Question 14

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The application is deployed to the instances using an in-place deployment. The instances are running Amazon Linux 2. What should the DevOps engineer check first?

Accepted Answer

Verify that the AWS CodeDeploy agent is installed and running on each EC2 instance.. Option A is correct because the CodeDeploy agent must be installed and running on the instances. If it is not, the deployment fails. Option B is wrong because security groups affect network access, not the agent. Option C is wrong because IAM instance profile permissions are needed but the agent must be running to use them. Option D is wrong because the application port is not directly related to the agent.

Answer

Check the security group rules for the EC2 instances.

Answer

Check the application's port availability.

Answer

Verify that the IAM instance profile associated with the instances has the correct permissions.

Question 15

A DevOps engineer wants to automate the creation and cleanup of temporary development environments on AWS. Each environment consists of an Amazon EC2 instance and an Amazon RDS database. The environments should be isolated and cost-effective. Which AWS service is best suited for this?

Accepted Answer

AWS CloudFormation. Option A is correct because AWS CloudFormation allows you to define infrastructure as code and easily create and delete stacks. Option B is wrong because AWS OpsWorks is configuration management, not ideal for temporary environments. Option C is wrong because AWS Elastic Beanstalk is a PaaS service that manages the environment, but not as flexible for cleanup. Option D is wrong because Amazon ECS is for containers, not EC2 and RDS directly.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

Amazon ECS