DOP-C02 SDLC Automation Practice Test 25 — 15 Questions

Question 1

A DevOps engineer is setting up an AWS CodeBuild project that needs to access resources in a VPC, such as an Amazon RDS database. The engineer has configured the CodeBuild project to run in the VPC. Which additional configuration is required for CodeBuild to pull the build Docker image?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC interface endpoint for Amazon ECR and configure the CodeBuild project to use it.. When a CodeBuild project runs inside a VPC, it loses default internet access, so it cannot reach public endpoints like Amazon ECR (Docker Hub or ECR) to pull the build image. A VPC interface endpoint (powered by AWS PrivateLink) creates a private, highly available connection to Amazon ECR within the VPC, allowing CodeBuild to pull images without traversing the internet. This is the correct solution because it provides direct, secure access to ECR while keeping all traffic within the AWS network.

Answer

Create a VPC peering connection to another VPC that has internet access.

Answer

Configure a VPC gateway endpoint for Amazon ECR.

Answer

Attach an internet gateway to the VPC and add a default route to it.

Question 2

A company is using AWS CodePipeline with multiple stages that include source, build, and deploy. The pipeline uses an Amazon S3 bucket as the source action. The team notices that the pipeline is not automatically starting when new files are uploaded to the S3 bucket. The S3 bucket has versioning enabled. What is the most likely reason?

Accepted Answer

The pipeline is configured to detect changes based on object key, but the uploaded file uses the same key as an existing object.. CodePipeline's S3 source action detects changes based on object key and ETag. When a file is uploaded with the same key as an existing object, even with versioning enabled, the ETag may not change if the content is identical, or the pipeline may not trigger if it only monitors for new keys. Versioning creates a new version ID, but CodePipeline's default detection relies on object key changes or ETag changes, not version ID changes, so uploading a file with the same key may not start the pipeline.

Answer

The S3 bucket is the same bucket used for the deploy action.

Answer

The S3 bucket is not configured to send Amazon SQS notifications to CodePipeline.

Answer

The S3 bucket does not have versioning enabled.

Question 3

A team is using AWS CloudFormation to manage infrastructure. They want to implement a change management process where any modifications to the stack must be reviewed and approved. Which feature should they use?

Accepted Answer

Change Sets. Change Sets allow you to preview how proposed changes to a CloudFormation stack will impact your running resources before you execute them. This enables a review-and-approve workflow because you can generate a change set, have a team member or automated process inspect the list of resource additions, modifications, or deletions, and then either execute or discard the change set. This directly supports the required change management process.

Answer

StackSets

Answer

Drift Detection

Answer

Stack Policy

Question 4

An organization uses AWS CodePipeline to deploy a serverless application using AWS Lambda and Amazon API Gateway. The pipeline includes a manual approval action. The team wants to ensure that the approval email is sent to multiple approvers and that any one of them can approve or reject. How should the approval action be configured?

Accepted Answer

Create an Amazon SNS topic with multiple subscribers, and configure the approval action to use that SNS topic ARN.. AWS CodePipeline's manual approval action can be configured to send notifications through an Amazon SNS topic. By creating an SNS topic with multiple subscribers (e.g., email addresses), any one of the subscribers can receive the approval request and take action (approve or reject). This satisfies the requirement for multiple approvers where any single approver can act.

Answer

Specify multiple email addresses in the 'ApproverEmail' field of the approval action.

Answer

Set the 'Approvers' field in the approval action to a comma-separated list of IAM user ARNs.

Answer

Add multiple IAM users to the pipeline's service role.

Question 5

A DevOps engineer is creating an AWS CloudFormation template to deploy a stack that includes an Amazon EC2 instance. The instance needs to be launched in a specific subnet. How should the engineer reference the subnet ID in the template?

Accepted Answer

Define a parameter (Parameters) of type AWS::EC2::Subnet::Id and reference it.. Defining a parameter of type `AWS::EC2::Subnet::Id` allows the CloudFormation template to accept a subnet ID as input at stack creation or update time, making the template reusable across different environments without modification. This approach follows infrastructure-as-code best practices by avoiding hardcoded values and enabling parameterized deployments.

Answer

Hardcode the subnet ID in the template.

Answer

Use a mapping (Mappings) to define the subnet ID based on the stack name.

Answer

Use the Fn::GetAtt function to retrieve the subnet ID from a VPC resource.

Question 6

Which TWO steps are required to set up a cross-account CI/CD pipeline where the source stage is in Account A (CodeCommit) and the deploy stage is in Account B (ECS)? (Choose 2.)

Accepted Answer

Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action.. For a cross-account CI/CD pipeline where the source stage (CodeCommit) is in Account A and the deploy stage (ECS) is in Account B, only two steps are required: 1) Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action (Option A). 2) Update the CodePipeline service role in Account A to include a trust policy that allows assuming the role in Account B (Option C). You do not need a KMS key in Account B; if the artifact bucket in Account A is encrypted with a customer-managed AWS KMS key, the key is in Account A and its policy must grant Account B's role kms:Decrypt, but that is not one of the required setup steps in the options. Option D is incorrect because the CodeCommit repository is in Account A, not Account B. Option E is incorrect because the pipeline artifact bucket should reside in Account A, not Account B.

Answer

Configure an AWS KMS key in Account B and share it with Account A for encrypting artifacts.

Answer

Create a resource-based policy on the CodeCommit repository in Account B that grants access to the CodePipeline service role in Account A.

Answer

Create an S3 bucket in Account B to store the artifacts and grant cross-account access.

Question 7

An organization is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails because the target group is not configured correctly. Which CodeDeploy component is responsible for registering instances with the load balancer?

Accepted Answer

The deployment group configuration. The deployment group configuration in AWS CodeDeploy specifies the target group or load balancer for the deployment. CodeDeploy automatically registers instances in the Auto Scaling group with the specified target group as part of the deployment process. The AppSpec file hooks section defines custom lifecycle event hooks for scripts, but instance registration is handled by the CodeDeploy service based on the deployment group settings, not by hooks.

Answer

The CodeDeploy agent configuration

Answer

The AppSpec file hooks section

Answer

The application revision bundle

Question 8

A company uses AWS CloudFormation to manage infrastructure. The development team wants to promote changes from a development environment to a production environment using change sets. They need to ensure that the production stack is not updated if there are any changes to the stack's IAM policies. Which approach should the team use?

Accepted Answer

Create a ChangeSet from the updated template, review the changes for IAM modifications, and execute only if no IAM changes are present.. AWS CloudFormation change sets allow you to review the proposed changes to a stack before executing them. By creating a change set from the updated template, the team can inspect the list of changes and specifically look for any modifications to IAM resources (e.g., AWS::IAM::Role, AWS::IAM::Policy). If the change set contains IAM-related changes, they can choose not to execute it, thereby preventing unintended updates to the production stack's IAM policies.

Answer

Enable drift detection on the production stack and compare with the development stack.

Answer

Use AWS CloudFormation StackSets to deploy to multiple accounts and use stack instance filters.

Answer

Use a custom resource in the template that checks for IAM changes and fails the update.

Question 9

A company runs a critical e-commerce application on AWS. They use AWS CodePipeline to manage deployments. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy to an Auto Scaling group). Recently, a deployment caused a 5-minute outage because the new application version had a bug that caused the health checks to fail. The Auto Scaling group marked instances as unhealthy and replaced them, but during the replacement, traffic was routed to the remaining instances, which also failed health checks, causing a full outage. The company wants to implement a deployment strategy that prevents any traffic from being routed to unhealthy instances and automatically rolls back if the deployment fails. They also want to minimize deployment time and cost. Which solution should the DevOps team implement?

Accepted Answer

Use CodeDeploy blue/green deployment with automatic rollback enabled. The correct solution is to use a blue/green deployment with CodeDeploy and automatic rollback enabled. In a blue/green deployment, a new Auto Scaling group (green) is created alongside the existing one (blue). Traffic is shifted to the green group only after all health checks pass. If health checks fail, the deployment is automatically rolled back by terminating the green group, ensuring no traffic is routed to unhealthy instances. This prevents any outage. Option B (in-place deployment with rollback) updates instances in place, which can cause downtime if instances fail health checks, as the Auto Scaling group replaces them sequentially, potentially routing traffic to unhealthy instances. Option A (manual approval) slows down deployment and does not automate rollback based on health checks. Option D (increasing health check grace period) only delays detection of failures and does not prevent traffic from being routed to unhealthy instances.

Answer

Add a manual approval step in CodePipeline before deploy

Answer

Use CodeDeploy in-place deployment with automatic rollback enabled

Answer

Increase the health check grace period in the Auto Scaling group

Question 10

A company uses AWS CodeCommit and wants to enforce that all commits to the 'main' branch are signed with a GPG key. Which steps should the DevOps engineer take to enforce this?

Accepted Answer

Create an IAM policy that denies git push actions unless the commit is signed.. AWS CodeCommit integrates with IAM to evaluate policies at the time of a `git push`. By creating an IAM policy that uses the `codecommit:GitPush` action with a `ForAnyValue:StringLike` condition key `codecommit:References` set to `refs/heads/main` and a `Bool` condition on `codecommit:IsSigned` set to `true`, you can deny pushes that are not signed. This enforces GPG signature verification at the IAM authorization layer, blocking unsigned commits before they reach the repository.

Answer

Use the AWS CLI to verify commit signatures and reject pushes.

Answer

Enable CloudWatch Logs to monitor commits and trigger a Lambda to rollback.

Answer

Configure a pre-receive hook in CodeCommit to reject unsigned commits.

Question 11

A company uses AWS CloudFormation to deploy infrastructure. They have a template that creates an Amazon EC2 instance and an Elastic IP address. The template uses the AWS::EC2::EIP resource. The team notices that when they delete the stack, the Elastic IP address is not released, leading to charges. They want to ensure that the Elastic IP is automatically released when the stack is deleted. What should they do?

Accepted Answer

Set the DeletionPolicy attribute to 'Delete' on the EIP resource. The default DeletionPolicy for AWS::EC2::EIP is 'Retain', meaning the Elastic IP address is preserved after stack deletion, leading to charges. To ensure it is automatically released, you must explicitly set the DeletionPolicy attribute to 'Delete' on the EIP resource. This overrides the default and causes the Elastic IP to be deleted upon stack deletion. Option A (Retain) would keep the EIP, which is the default and would still incur charges. Option B (custom resource) is unnecessary. Option D (DependsOn) does not control deletion behavior. Therefore, Option C is the correct solution.

Answer

Set the DeletionPolicy attribute to 'Retain' to keep the EIP

Answer

Create a custom resource to release the EIP before stack deletion

Answer

Add a DependsOn clause to ensure proper order of deletion

Question 12

A DevOps team uses AWS CodePipeline with an S3 source action and CodeBuild as a build provider. The pipeline has a manual approval step before deployment. Recently, the team noticed that the pipeline automatically starts when a new object is uploaded to the S3 bucket, even if the object is not the source code. They want to ensure that the pipeline only triggers on changes to the source code directory. What is the MOST efficient solution?

Accepted Answer

Configure the S3 event notification to use a prefix filter that matches the source code directory.. S3 event notifications support prefix and suffix filters, allowing you to specify that only objects uploaded to a particular directory (e.g., 'source-code/') trigger the event. By configuring the S3 event notification with a prefix filter matching the source code directory, the pipeline will only start when a new object is uploaded to that specific path, ignoring uploads to other directories. This is the most efficient solution as it avoids unnecessary pipeline executions without adding extra components or manual intervention.

Answer

Use Amazon CloudWatch Events to create a custom rule that matches the source code path and triggers the pipeline.

Answer

Enable versioning on the S3 bucket and configure the pipeline to use the latest version.

Answer

Disable the S3 trigger and manually start the pipeline after each code commit.

Question 13

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration uses a linear traffic shifting with a 10-minute interval. The application logs show that the new version of the application crashes on startup. What is the MOST effective way to handle this situation to ensure successful future deployments?

Accepted Answer

Add a script in the AppSpec file's 'Validate Service' lifecycle hook to check the application health and fail the deployment if the application does not start successfully.. The 'Validate Service' lifecycle hook in the AppSpec file runs after the application is installed and started, allowing you to execute a custom script that verifies the application is healthy. If the script detects that the new version crashes on startup, it can return a non-zero exit code, which causes CodeDeploy to mark that instance as failed and trigger the deployment failure. This provides an early, automated validation that prevents the deployment from proceeding with a broken application, directly addressing the root cause of the crash.

Answer

Increase the interval in the linear traffic shifting to 30 minutes to allow more time for instances to stabilize.

Answer

Configure the deployment to automatically roll back when a failure occurs and ignore the error.

Answer

Switch to a blue/green deployment strategy to minimize the impact on existing instances.

Question 14

A DevOps team uses AWS CodePipeline to deploy a microservices application. The pipeline includes a CodeBuild project that runs unit tests. Recently, builds have been failing intermittently due to test timeouts. The team wants to improve the reliability of the pipeline without increasing the build timeout. Which action should the team take?

Accepted Answer

Configure the CodeBuild project to run tests in parallel by using separate build environments or test splits.. Running unit tests in parallel using separate build environments or test splits directly addresses intermittent timeouts by reducing the total execution time without increasing the build timeout. This approach leverages CodeBuild's ability to run multiple build jobs concurrently, distributing the test load and improving pipeline reliability.

Answer

Increase the build timeout to the maximum allowed value of 8 hours.

Answer

Use AWS CodeDeploy to run the unit tests on EC2 instances with more CPU and memory.

Answer

Modify the unit tests to be non-flaky by adding retries for network calls.

Question 15

An organization uses AWS CloudFormation to manage infrastructure across multiple accounts using AWS Organizations. They want to enforce that all S3 buckets are encrypted with SSE-S3. A DevOps engineer creates a service control policy (SCP) to deny the creation of any S3 bucket without encryption. However, CloudFormation stack creation fails with an access denied error even when the template includes encryption. What is the most likely cause?

Accepted Answer

The CloudFormation template specifies SSE-KMS encryption, which is not allowed by the SCP.. The SCP denies the creation of S3 buckets without encryption, but it specifically allows only SSE-S3 encryption. If the CloudFormation template specifies SSE-KMS encryption, the SCP will deny the request, causing an access denied error—even though encryption is present. This mismatch between the encryption type required by the SCP (SSE-S3) and what the template requests (SSE-KMS) is the most likely cause of the failure.

Answer

The SCP is denying the s3:PutBucketPublicAccessBlock action, which is required for all bucket creation requests.

Answer

The SCP is incorrectly scoped to the management account instead of the member accounts.

Answer

The CloudFormation service role does not have permissions to create buckets in the target account.