DOP-C02 SDLC Automation Practice Test 26 — 15 Questions

Question 1

An organization uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment strategy is 'Blue/Green'. After a successful deployment, traffic is routed to the new instances. However, the application experiences errors because the new instances cannot connect to the database. Which TWO configuration changes could resolve this issue?

Accepted Answer

Update the security group of the new instances to allow outbound traffic to the database security group.. Option B is correct because the new instances need proper security group rules to access the database. Option D is correct because if the database uses an internal DNS that resolves to old instances, updating it ensures connectivity. Option A is wrong because increasing instance count does not fix connectivity. Option C is wrong because CodeDeploy agent does not affect network connectivity. Option E is wrong because the deployment group is already configured; the issue is network.

Answer

Modify the CodeDeploy deployment group to include the database security group.

Answer

Increase the number of instances in the Auto Scaling group.

Answer

Reinstall the CodeDeploy agent on the new instances.

Question 2

Refer to the exhibit. An IAM policy is attached to a user who needs to start a CodePipeline pipeline and view its details. The user reports that they cannot see the pipeline in the AWS Management Console. What is the MOST likely reason?

Accepted Answer

The policy does not include the codepipeline:ListPipelines action, which is needed to view pipelines in the console.. Option B is correct because the policy only allows specific actions on a specific resource, but the console also requires the codepipeline:ListPipelines action to list pipelines. Without ListPipelines, the user cannot see the pipeline in the console. Option A is wrong because the actions are allowed. Option C is wrong because there is no explicit deny. Option D is wrong because the pipeline exists.

Answer

There is an explicit deny statement elsewhere that is overriding the allow.

Answer

The user does not have permission to start the pipeline execution.

Answer

The pipeline ARN is incorrect.

Question 3

Refer to the exhibit. A developer is troubleshooting a failed AWS CodeBuild build. The buildspec file contains the following build commands: 'pre_build' - run linting, 'build' - './gradlew build', 'post_build' - package artifact. The error occurs in the build phase. Which of the following is the MOST likely cause?

Accepted Answer

The Gradle build encountered compilation or test errors.. Option B is correct because a Gradle build failure (exit status 1) typically indicates compilation errors or test failures. Option A is wrong because linting is in pre_build and would have failed earlier. Option C is wrong because disk space would cause a different error. Option D is wrong because the error is from the Gradle command itself.

Answer

The build environment ran out of disk space.

Answer

The artifact packaging step failed.

Answer

The linting step failed.

Question 4

A startup is using AWS CodeCommit to store their application code. They have set up a CI/CD pipeline with AWS CodePipeline and AWS CodeBuild. The pipeline consists of a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using AWS CodeDeploy to deploy to an Auto Scaling group of EC2 instances. Recently, a developer committed code that introduced a critical bug, and the pipeline automatically deployed the bug to production, causing an outage. The team wants to implement a manual approval step before production deployment. They also want to ensure that the approval step is only required for deployments to the production environment, not for development or testing. Which solution should they implement?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline before the production deployment stage. Configure the approval to require a designated approver.. Option A is correct because CodePipeline supports manual approval actions that can be added as a stage before production deployment. By configuring separate pipelines or stages for different environments, the approval step can be limited to production. Option B is wrong because CodeDeploy does not have approval workflows. Option C is wrong because CloudWatch Events does not provide manual approval. Option D is wrong because SNS is for notifications, not approvals.

Answer

Configure the CodeDeploy deployment group to require approval before deploying to any instance.

Answer

Use Amazon Simple Notification Service (SNS) to send a notification to the team and have them manually stop the pipeline if needed.

Answer

Use Amazon CloudWatch Events to trigger an AWS Lambda function that sends an approval request via email and pauses the pipeline until approved.

Question 5

A large enterprise is using AWS CloudFormation to manage their infrastructure. They have a master template that orchestrates nested stacks for different components: VPC, application, and database. The VPC stack creates subnets, route tables, and security groups. The application stack creates EC2 instances and an Application Load Balancer. The database stack creates an RDS instance. The master template uses parameters to pass configuration values. Recently, when updating the application stack, the update failed because the security group ID from the VPC stack changed, and the application stack references the old security group ID. The team wants to ensure that when the VPC stack is updated, dependent stacks are automatically updated to use the new outputs. Which approach should they take?

Accepted Answer

Use the Fn::ImportValue intrinsic function in the application stack to import the security group ID from the VPC stack's exports.. Option B is correct because using Fn::ImportValue to import exported outputs from other stacks ensures that the dependent stack always gets the latest value. Option A is wrong because hardcoding is error-prone. Option C is wrong because CloudFormation does not automatically update nested stacks when parent outputs change; the parent stack must be updated. Option D is wrong because cross-stack references using Fn::ImportValue are the recommended pattern.

Answer

Use the Fn::GetAtt intrinsic function in the application stack to directly reference the security group from the VPC stack.

Answer

Hardcode the security group ID in the application template to avoid changes.

Answer

Configure the master template to automatically update all nested stacks whenever any output changes.

Question 6

A company uses AWS CodeBuild to compile and test their Java application. The build takes about 20 minutes. They have enabled Amazon S3 cache to store the Maven repository to speed up subsequent builds. However, they notice that the build time has not improved significantly. The buildspec file includes the 'cache' section with 'paths' pointing to '/root/.m2'. The CodeBuild project has cache type set to 'S3' and a valid bucket. The build logs show that the cache is being downloaded and uploaded, but the Maven dependencies are still being downloaded from the internet each time. What is the most likely cause?

Accepted Answer

The Maven dependencies are not being stored in the local repository path specified in the cache.. Option C is correct because if the Maven local repository is not configured to store dependencies, the cache will not help. The build might be using a different repository or the dependencies are not cached properly. Option A is wrong because the cache bucket is configured. Option B is wrong because the cache is being used. Option D is wrong because the paths are correct.

Answer

The cache is too large and takes as long to download as the build itself.

Answer

The S3 bucket is in a different region than the CodeBuild project.

Answer

The buildspec file does not include the 'cache' section correctly.

Question 7

A team is using AWS CodePipeline to deploy a serverless application using AWS Lambda and Amazon API Gateway. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild (which runs unit tests and packages the Lambda code), and a deploy stage using AWS CloudFormation to update a stack that contains the Lambda function and API Gateway. The deployment stage uses a CloudFormation template that creates the Lambda function and API Gateway. Recently, the deployment stage started failing with the error: 'The API Gateway deployment already exists'. The team has not changed the template. What is the most likely cause?

Accepted Answer

The CloudFormation template uses a fixed physical name for the deployment resource, causing a conflict when CloudFormation tries to create a new deployment with the same name.. Option D is correct because CloudFormation creates a deployment resource with a unique ID each time; if the template does not change the logical ID, it may try to create a new deployment with the same name, causing a conflict. Option A is wrong because the stage name is not changed. Option B is wrong because permissions would cause a different error. Option C is wrong because API Gateway limits are higher.

Answer

The Lambda function does not have permission to be invoked by API Gateway.

Answer

The account has reached the limit for API Gateway deployments.

Answer

The API Gateway stage name is being changed in the template.

Question 8

A company uses multiple AWS accounts: one for development, one for testing, and one for production. They want to implement a CI/CD pipeline using AWS CodePipeline that deploys the same application to all three accounts. The source code is stored in a CodeCommit repository in the development account. The pipeline should first build the application, then deploy to development, then after approval, deploy to testing, and finally after another approval, deploy to production. The deployment uses AWS CodeDeploy to deploy to EC2 instances in each account. The pipeline will be created in the development account. Which configuration will allow the pipeline to deploy to the testing and production accounts?

Accepted Answer

Create IAM roles in the testing and production accounts that grant CodeDeploy permissions, and configure the pipeline to assume those roles using the CodePipeline cross-account action.. Option C is correct because using cross-account roles allows the pipeline in the development account to assume a role in the target accounts to perform deployments. The pipeline can use the CodePipeline cross-account action with a role ARN. Option A is wrong because IAM users cannot be used programmatically by CodePipeline. Option B is wrong because VPC peering is not relevant to cross-account permissions. Option D is wrong because AWS Organizations does not grant cross-account access automatically.

Answer

Establish VPC peering between the accounts and allow the pipeline to communicate directly with CodeDeploy in the other accounts.

Answer

Create IAM users in testing and production accounts with programmatic access, and configure the pipeline to use those credentials.

Answer

Use AWS Organizations to create a shared service and grant the pipeline full access to all accounts.

Question 9

A company uses AWS Elastic Beanstalk to deploy a web application. They have set up a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from GitHub (using the GitHub source action) and a deploy stage that deploys to Elastic Beanstalk. The deployment is configured to use the 'Immutable' deployment policy. Recently, the deployment started failing with the error: 'The environment is in an unhealthy state. The deployment failed.' The developer checks the Elastic Beanstalk environment and sees that the new instances are not passing health checks. The application logs show that the new instances cannot connect to the existing Amazon RDS database. What is the most likely cause?

Accepted Answer

The security group attached to the Elastic Beanstalk environment does not allow the new instances to connect to the RDS database.. Option B is correct because with immutable deployments, new instances are launched in a new Auto Scaling group, and they may not have the correct security group rules to access the RDS database. Option A is wrong because the deployment policy is immutable, not rolling. Option C is wrong because the database is existing and shouldn't cause issues. Option D is wrong because the source code is unchanged.

Answer

The RDS database is not available because it is being updated during the deployment.

Answer

The deployment policy should be changed to 'Rolling' to ensure instances are updated in place.

Answer

The application code has a bug that causes the health check to fail.

Question 10

A DevOps team is implementing a CI/CD pipeline for a microservices application deployed on Amazon ECS. They want to automatically build, test, and deploy container images to Amazon ECR and then update the ECS service. Which TWO steps are essential to achieve this goal?

Accepted Answer

Use AWS CodeDeploy to update the ECS service with a new task definition.. Option A is needed to build and push the image. Option D is needed to update the ECS service. Option B is for secrets retrieval, but not essential for the pipeline flow. Option C is for static analysis, not required. Option E is for load testing, not required.

Answer

Use AWS Secrets Manager to store Docker credentials.

Answer

Use AWS X-Ray for tracing.

Answer

Use Amazon CodeGuru for code review.

Question 11

A company is using AWS CodePipeline with multiple stages: Source (GitHub), Build (CodeBuild), Test (CodeBuild), and Deploy (CloudFormation). The deployment stage is failing intermittently with a 'Rate exceeded' error. The team needs to reduce deployment failures. Which TWO actions should the team take?

Accepted Answer

Implement a manual approval step before deployment to stagger multiple pipeline executions.. Option A reduces the chance of hitting API rate limits. Option E implements retry logic. Option B is not related to rate limits. Option C could cause new issues. Option D is irrelevant.

Answer

Increase the timeout of the deploy action.

Answer

Enable CloudWatch detailed monitoring for the deployed resources.

Answer

Change the deployment to use an in-place deployment type.

Question 12

A company uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. They want to enforce that every commit triggers a build, but only if the commit message contains a specific pattern 'BUILD:'. Which THREE steps are required?

Accepted Answer

Configure a webhook in CodeBuild that filters events by commit message pattern.. Option B creates the trigger. Option C adds a condition for the commit message. Option E ensures the build runs in a VPC. Option A is not needed for filtering. Option D is for Lambda integration, not required.

Answer

Create an AWS Lambda function that processes the commit message and calls CodeBuild.

Answer

Create a CloudWatch Events rule to invoke CodeBuild on every push to CodeCommit.

Question 13

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is failing because the new instances are not passing the health checks. The team wants to automatically roll back the deployment if health checks fail. Which THREE steps should the team take?

Accepted Answer

Create a CloudWatch alarm based on the ELB health check metric.. Option A configures rollback. Option B configures alarms. Option C configures health check grace period. Option D is not needed. Option E is not for rollback.

Answer

Use a deployment configuration with a high minimum healthy host percentage.

Answer

Store the deployment artifacts in an S3 bucket with versioning enabled.

Question 14

A company runs a critical application on Amazon EC2 instances managed by an Auto Scaling group behind an Application Load Balancer. They use AWS CodeDeploy for blue/green deployments. The deployment process creates a new Auto Scaling group (green) and routes traffic to it after a successful deployment. Recently, the deployment succeeded but the green instances are not receiving traffic; users are still served by the old (blue) instances. The deployment logs show that the 'AllowTraffic' step succeeded. The team checked the ALB target groups; the green target group has healthy instances but the ALB listener default action still points to the blue target group. What is the most likely cause and remediation?

Accepted Answer

The CodeDeploy deployment group is not configured to update the ALB listener rule. Update the deployment group to include the ALB listener ARN so that CodeDeploy can switch the listener to the green target group.. Option A is correct because CodeDeploy blue/green with an ALB uses a target group for the green environment, and the listener rule should be updated to route traffic to the green target group. Option B is about deregistration delay, which affects traffic drain, not routing. Option C is about stickiness, which doesn't prevent new traffic. Option D is about deployment configuration, which doesn't affect traffic routing.

Answer

The ALB has sticky sessions enabled, causing traffic to stick to the blue instances. Disable sticky sessions.

Answer

The deployment configuration uses 'AllAtOnce' traffic shifting, which is not supported for blue/green with an ALB. Change to 'Canary' or 'Linear'.

Answer

The deregistration delay on the blue target group is too long, preventing traffic from shifting. Reduce the deregistration delay to 0 seconds.

Question 15

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an Amazon RDS DB instance with automated backups enabled. The DevOps team needs to modify the DB instance to use a larger instance type. They update the CloudFormation template and execute a stack update. The update fails with the error: 'Cannot modify DB instance class because the instance is in a state that does not allow modification.' The DB instance is in the 'available' state. The team needs to successfully update the instance type without data loss. What should the team do?

Accepted Answer

Modify the CloudFormation template to change the 'DBInstanceClass' property and set 'UpdateReplacePolicy' to 'Snapshot', then update the stack. This will create a new DB instance and delete the old one after taking a snapshot.. Option C is correct because modifying the DB instance class for RDS often requires a replacement (not just modification) when using CloudFormation, and a snapshot ensures data is preserved. Option A is wrong because stopping the instance is not allowed for RDS. Option B is wrong because deleting the stack would cause data loss. Option D is wrong because the error is not about lack of permissions.

Answer

Stop the RDS instance, then update the stack, then start it.

Answer

Add the 'AllowMajorVersionUpgrade' property to the DB instance in the template and update the stack.

Answer

Delete the CloudFormation stack, create a new stack with the new instance type, and restore from the automated backup.