DOP-C02 SDLC Automation Practice Test 24 — 15 Questions

Question 1

A team uses AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Test stage runs integration tests against a staging environment. Occasionally, the tests fail due to environment issues, not code issues. The team wants to automatically retry the Test stage up to two times if it fails, but not the Deploy stage. How can this be achieved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch Events rule that triggers a Lambda function to retry the failed stage.. The correct approach is to use Amazon EventBridge (formerly CloudWatch Events) to detect a stage failure in CodePipeline and trigger an AWS Lambda function that calls the RetryStageExecution API. This provides automatic retries without manual intervention. CodePipeline's built-in retry setting on a stage action is not automatic; it only allows manual retries via the console or API. Option D (Step Functions) is a valid alternative but adds unnecessary complexity for this use case.

Answer

Configure the Retry setting in the Test stage's action configuration.

Answer

Enable the 'Retry on failure' option in the CodePipeline pipeline settings.

Answer

Use AWS Step Functions to orchestrate the pipeline and implement retries.

Question 2

During a deployment using AWS CodeDeploy, the deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment group is configured with a minimum healthy instances of 75%. What could be the cause?

Accepted Answer

More than 25% of the instances failed the deployment.. The error message explicitly states that too many individual instances failed deployment and too few healthy instances are available. With a minimum healthy instances setting of 75%, the deployment fails when more than 25% of the instances in the deployment group fail their deployment. This is a built-in safety mechanism in AWS CodeDeploy to prevent cascading failures and ensure application availability.

Answer

The deployment configuration timeout is too short.

Answer

The CodeDeploy service role does not have sufficient permissions.

Answer

The instances are not running the CodeDeploy agent.

Question 3

An IAM policy is attached to a user. The user is trying to push a commit to the 'main' branch of the 'MyRepo' repository. The push is denied. What is the most likely reason?

Accepted Answer

The condition key 'codecommit:References' is not correctly formatted for an array value.. The condition key 'codecommit:References' must be formatted as an array value when used in an IAM policy to restrict pushes to specific branches. If the policy uses a string value instead of an array (e.g., 'refs/heads/main' instead of ['refs/heads/main']), the condition fails to match, and the push is denied even if the user has the 'codecommit:GitPush' action allowed. This is a common misconfiguration in IAM policies for CodeCommit.

Answer

The user does not have permission to push to any branch.

Answer

The policy does not allow the 'codecommit:GitPush' action for the main branch.

Answer

The resource ARN is incorrect.

Question 4

A DevOps engineer is setting up a CI/CD pipeline for a Node.js application. The application must be built, tested, and deployed to an Amazon ECS cluster. The team wants to use AWS CodeBuild to run unit tests and package the application as a Docker image, and AWS CodePipeline to orchestrate the workflow. Which artifact type should CodeBuild output to be used by a subsequent CodePipeline action?

Accepted Answer

A JSON file with the image details.. CodePipeline's ECS deploy action requires an input artifact containing an imagedefinitions.json file that specifies the image URI. CodeBuild should produce this JSON file as its output artifact, not merely push the image to ECR. The subsequent deploy action reads the JSON file to determine which image to use, so the correct artifact type is a JSON file with image details.

Answer

A Docker image pushed to Amazon ECR.

Answer

A zip file containing the application source code.

Answer

A tarball stored in Amazon S3.

Question 5

A company uses AWS CodePipeline with a GitHub source action. They want to automatically start the pipeline when a pull request is merged to the main branch. However, the pipeline also starts on every push to any branch. How can they limit the pipeline to only trigger on push events to the main branch?

Accepted Answer

Configure the source action's 'Branch' field to 'main' and set 'PollForSourceChanges' to false, and use a webhook with filters.. It configures the source action to only respond to push events on the main branch by setting the 'Branch' field to 'main' and disabling polling ('PollForSourceChanges': false), while using a webhook with branch filters. This ensures that only pushes to the main branch trigger the pipeline, not pushes to any other branch.

Answer

Use a Lambda function as a source action instead of GitHub.

Answer

Create a GitHub webhook manually and point it to a Lambda function that starts the pipeline only for main branch pushes.

Answer

Add a condition in the pipeline's first stage to check the branch name.

Question 6

A company is using AWS CodeBuild to compile a Java application. The build takes over 30 minutes, causing timeouts. The team has already increased the build timeout to the maximum. Which action would MOST effectively reduce the build time?

Accepted Answer

Enable dependency caching in the buildspec file.. Enabling dependency caching in the buildspec file allows CodeBuild to reuse previously downloaded dependencies (e.g., Maven or Gradle artifacts) across builds, significantly reducing the time spent on dependency resolution and download. Since the build already times out at the maximum timeout, caching directly addresses the bottleneck of repeated dependency fetching, which is a common cause of long build times in Java applications.

Answer

Use a smaller instance type to reduce provisioning time.

Answer

Use a larger compute type in CodeBuild.

Answer

Split the build into multiple parallel CodeBuild projects.

Question 7

A company is using AWS CodeBuild to run integration tests. The tests require access to an Amazon RDS instance in a private subnet. The CodeBuild project is configured with a VPC ID, subnet IDs, and security group IDs. However, the tests fail with a connection timeout. What is the MOST likely cause?

Accepted Answer

The security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group.. The most likely cause is that the security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group. CodeBuild runs inside the VPC using the specified security group, so it sends traffic to the RDS instance on port 3306 (or the appropriate database port). If the RDS security group's inbound rules do not explicitly permit traffic from the CodeBuild security group (or its CIDR), the connection is dropped, resulting in a timeout.

Answer

The CodeBuild project does not have internet access to download packages.

Answer

The CodeBuild project is not associated with a VPC.

Answer

The RDS instance is not publicly accessible and requires a NAT gateway.

Question 8

A DevOps team uses AWS CodePipeline with a multi-branch strategy. The pipeline should deploy to production only from the 'main' branch, but run unit tests for all branches. How should the team configure the pipeline?

Accepted Answer

Configure the pipeline source stage to trigger on all branches, use branch-specific logic in the test stage, and add a manual approval step for production deployment only when the branch is 'main'.. AWS CodePipeline supports branch filtering in the source stage to trigger on all branches, and you can use a condition in the deploy stage (e.g., via a Lambda function or a manual approval step) to restrict production deployment to the 'main' branch only. This approach avoids duplicating pipelines while ensuring unit tests run for every branch, meeting the multi-branch strategy requirement efficiently.

Answer

Use an AWS Lambda function to check the branch name and invoke different CodePipeline executions for testing and deployment.

Answer

Create one pipeline with two source stages: one for 'main' and one for all other branches, each with its own test and deploy actions.

Answer

Create a separate pipeline for each branch, each with identical test and deploy stages.

Question 9

A development team uses AWS CodeCommit for source control. They want to enforce that all commits include a JIRA issue key in the commit message. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CodeCommit trigger that invokes an AWS Lambda function on every push to validate commit messages.. CodeCommit triggers can invoke an AWS Lambda function on every push event, allowing real-time validation of commit messages against a required pattern (e.g., JIRA issue key). This serverless approach enforces the policy centrally without relying on client-side configurations, making it the most efficient and reliable method for a team using AWS CodeCommit.

Answer

Use Amazon CloudWatch Events to detect new commits and invoke a Lambda function to validate the commit message.

Answer

Implement a pre-commit hook in each developer's local repository.

Answer

Configure a branch policy on the repository that requires commit message format.

Question 10

A company runs a critical application on Amazon ECS with Fargate. They use blue/green deployments via AWS CodeDeploy. During a recent deployment, the new task set failed health checks and CodeDeploy automatically rolled back. However, the old task set also became unhealthy shortly after rollback. What could explain this?

Accepted Answer

The new application version changed the database schema, which broke the old version after rollback.. A backward-incompatible database schema change (e.g., a column removal or renaming) applied by the new application version can corrupt or invalidate the data that the old version relies on. When CodeDeploy rolls back to the old task set, the old application cannot function correctly with the altered schema, causing it to fail health checks. This is a classic rollback failure scenario where the deployment changes shared state (the database) that persists beyond the task set lifecycle.

Answer

The CloudWatch alarm that triggered the rollback also stopped the old task set.

Answer

CodeDeploy did not drain connections from the Application Load Balancer before terminating the old task set.

Answer

The ECS service auto-scaling policy reduced the desired count of the old task set during the deployment.

Question 11

A company uses AWS CloudFormation to deploy a multi-tier application. The stack creation fails with a 'CREATE_FAILED' error for a resource. The engineer wants to troubleshoot the issue. Which TWO steps should the engineer take? (Choose TWO.)

Accepted Answer

Use the 'describe-stack-events' AWS CLI command to view the events.. The 'describe-stack-events' AWS CLI command retrieves all stack events, including the specific event for the failed resource. This event contains the 'ResourceStatusReason' field, which provides the detailed error message from CloudFormation explaining why the resource creation failed. Option C is correct because checking the 'ResourceStatusReason' field in the stack events directly reveals the underlying error. Option B is incorrect because CloudFormation does not automatically create a CloudWatch Logs log group for stack errors; resource-specific logs are only available if the resource itself writes to CloudWatch. During a stack creation failure, there may be no such logs to review. Option D is incorrect because deleting the stack would lose the event history and prevent effective troubleshooting. Option E is incorrect because 'describe-stacks' only returns stack outputs and status, not failure details.

Answer

Review the CloudWatch Logs log group for the stack to find detailed error logs.

Answer

Run 'delete-stack' to remove the failed stack and start over.

Answer

Use the 'describe-stacks' AWS CLI command to get the stack outputs.

Question 12

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The pipeline has a source stage that pulls from a CodeCommit repository, a build stage using AWS CodeBuild, and a deploy stage that uses AWS CodeDeploy to deploy to an EC2 Auto Scaling group. The team notices that the pipeline frequently fails at the deploy stage with the error 'The deployment failed because the deployment group's deployment configuration specifies a minimum healthy host count of 1, but 0 healthy hosts are available.' What is the MOST likely cause of this issue?

Accepted Answer

The CodeDeploy agent is not installed or is not running on the EC2 instances.. The error message indicates that the CodeDeploy deployment is failing because zero healthy hosts are available in the deployment group. The most common cause is that the CodeDeploy agent is not installed or not running on the EC2 instances, preventing them from reporting their health status to the CodeDeploy service. Without a healthy agent, the instances cannot execute the deployment lifecycle hooks, and CodeDeploy considers them unhealthy, leading to the failure.

Answer

The IAM role for CodePipeline does not have sufficient permissions to access the CodeCommit repository.

Answer

The build artifacts are not being stored in an S3 bucket.

Answer

The EC2 instances are not registered with a Classic Load Balancer.

Question 13

A team uses AWS CodePipeline to deploy a containerized application to Amazon ECS. The pipeline uses a source stage from CodeCommit, a build stage that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that updates an ECS service. The team wants to add a manual approval step before the deploy stage to allow QA to verify the image. What is the BEST way to implement this?

Accepted Answer

Add a manual approval stage in CodePipeline between the build and deploy stages, and configure SNS to notify approvers.. CodePipeline natively supports manual approval actions that pause the pipeline at a specified stage and wait for an approver to manually approve or reject the transition. By adding a manual approval stage between the build and deploy stages, the pipeline will automatically halt after the build completes, and you can configure Amazon SNS to notify the QA team via email or other endpoints when their approval is required. This approach requires no custom infrastructure, integrates directly with the pipeline's state machine, and provides a built-in audit trail of approvals.

Answer

Configure an AWS Lambda function in the pipeline that checks a DynamoDB table for approval status and pauses until approved.

Answer

Use an Amazon SNS topic to send a notification to QA, and have them manually trigger the deploy stage by clicking a link in the email.

Answer

Use Amazon CloudWatch Events to trigger a custom action that waits for an approval signal.

Question 14

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). Recently, deployments have been failing intermittently during the deploy stage with the error: 'The service has reached its maximum number of running tasks.' How should a DevOps engineer resolve this issue?

Accepted Answer

Update the ECS service configuration to increase the maximum number of tasks. The error 'The service has reached its maximum number of running tasks' indicates that the ECS service's desired count or maximum tasks (if using a placement constraint) has been hit. Updating the ECS service configuration to increase the maximum number of tasks (or the desired count) allows the deployment to proceed by accommodating the new tasks during a rolling update. This directly resolves the capacity limit that CodeDeploy encounters when trying to launch new tasks.

Answer

Increase the memory reservation for the task definition

Answer

Configure an Amazon ECS Service Auto Scaling policy to scale out

Answer

Increase the number of concurrent deployments allowed in CodeDeploy

Question 15

A development team is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a Source stage connected to an Amazon S3 bucket, a Build stage using AWS CodeBuild, and a Deploy stage that deploys to an Amazon ECS cluster. The team notices that the pipeline fails intermittently during the Build stage with a 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE' error. What is the most likely cause?

Accepted Answer

The CodeBuild project is configured to run in a VPC without a NAT gateway, and the build image is pulled from a public registry.. The 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE' error in AWS CodeBuild indicates that the build environment cannot pull the specified Docker image from its registry. When a CodeBuild project is configured to run in a VPC without a NAT gateway, it lacks outbound internet access, which is required to pull images from public registries like Docker Hub or Amazon ECR public. This is the most likely cause because the error is intermittent (e.g., if the image is cached locally sometimes) and directly relates to network connectivity.

Answer

The CodeBuild project is in a different AWS Region than the CodePipeline pipeline.

Answer

The S3 bucket where the source code is stored has a bucket policy denying access to the CodeBuild service role.

Answer

The CodeBuild project does not have enough memory or vCPU allocated.