DOP-C02 SDLC Automation Practice Test 26 — 15 Questions

Question 1

A DevOps team is implementing infrastructure as code using AWS CloudFormation. They want to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Accepted Answer

Change Sets. Change Sets allow you to preview the proposed changes to a CloudFormation stack before executing them. This enables the DevOps team to review and approve modifications, ensuring that only validated updates are applied. By creating a change set, you can see exactly which resources will be added, modified, or deleted, and then decide whether to execute it.

Answer

Drift detection

Answer

Stack policies

Answer

StackSets

Question 2

A company uses AWS CodePipeline with a manual approval stage before deploying to production. The approval notification is sent via Amazon SNS. The approvers report that they are not receiving the email notifications. What should the DevOps engineer check first?

Accepted Answer

Confirm that the email subscriptions to the SNS topic have been confirmed by clicking the link in the initial confirmation email.. Amazon SNS requires that email subscribers confirm their subscription by clicking the link in the initial confirmation email before they can receive notifications. If the approvers never confirmed the subscription, the SNS topic will not deliver any messages to them, even though the pipeline and IAM permissions are correctly configured. This is the most common cause of missing SNS email notifications and should be the first check.

Answer

Ensure that the IAM role for CodePipeline has permission to publish to the SNS topic.

Answer

Verify that the SNS topic's subscription has a filter policy that matches the approval event.

Answer

Check the email recipients' mailbox quota to see if it is full.

Question 3

A team uses AWS CodeBuild to run integration tests that require access to an Amazon RDS database. The database is in a private subnet. The CodeBuild project is configured to use a VPC. However, the builds are failing with a timeout connecting to the database. What could be the issue?

Accepted Answer

The security group for the RDS database does not allow inbound traffic from the security group assigned to the CodeBuild project.. The RDS database is in a private subnet and its security group must explicitly allow inbound traffic from the CodeBuild project's security group. Even though CodeBuild is configured with a VPC, the default security group rules deny all inbound traffic; without an inbound rule for the database port (e.g., 3306 for MySQL) from the CodeBuild security group, the connection is blocked, causing a timeout.

Answer

The CodeBuild project's VPC configuration does not include the subnet IDs where the database resides.

Answer

The security group for the CodeBuild project does not allow outbound traffic to the RDS database.

Answer

The CodeBuild project does not have a route to the internet via an internet gateway, so it cannot reach the RDS endpoint.

Question 4

A company is implementing a CI/CD pipeline for a microservices architecture on Amazon ECS. The pipeline must deploy to multiple environments (dev, test, prod) in sequence with manual approval gates between environments. Which two AWS services should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

AWS CodePipeline. AWS CodePipeline (A) is correct because it provides the orchestration framework to model the CI/CD pipeline with sequential stages for dev, test, and prod environments, including built-in support for manual approval gates between stages. AWS CodeDeploy (D) is correct because it integrates directly with CodePipeline to handle the actual deployment of containerized applications to Amazon ECS, supporting blue/green deployments and traffic shifting for microservices.

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Question 5

A company uses AWS CodePipeline to automate their software release process. They want to add a stage that runs security scanning on the code before deployment. Which two AWS services can be integrated into the pipeline for this purpose? (Choose TWO.)

Accepted Answer

Amazon Inspector. Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It can be integrated into a CodePipeline stage to perform automated security scanning on the code or infrastructure before deployment, helping to identify issues early in the SDLC.

Answer

Amazon GuardDuty

Answer

Amazon Detective

Answer

AWS CodeDeploy

Question 6

A development team uses AWS CodePipeline with multiple stages including source, build, and deploy. The pipeline uses an Amazon S3 source action that triggers on changes to a specific bucket. Recently, the pipeline stopped triggering automatically. The IAM role for CodePipeline has the necessary permissions. What is the most likely cause?

Accepted Answer

AWS CloudTrail is not configured to deliver S3 data events to CloudWatch Logs.. CodePipeline's S3 source action does not rely on S3 event notifications to trigger pipeline executions. Instead, it uses Amazon CloudWatch Events (now Amazon EventBridge) to detect changes to the S3 bucket. For this to work, AWS CloudTrail must be configured to deliver S3 data events (specifically `PutObject` API calls) to CloudWatch Logs, which then generates the event that triggers the pipeline. Without CloudTrail data event logging, CodePipeline cannot detect object uploads, even if the IAM role has proper permissions.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The S3 bucket policy denies access to CodePipeline.

Answer

The S3 bucket does not have event notifications configured.

Question 7

A DevOps engineer needs to automate the creation of an Amazon ECS cluster using AWS CloudFormation. The cluster will run a web application that requires a load balancer. Which resource should be used to define the ECS cluster?

Accepted Answer

AWS::ECS::Cluster. The AWS::ECS::Cluster resource is the correct CloudFormation resource to define an ECS cluster, which serves as the logical grouping of container instances or Fargate tasks. The question specifically asks for the resource that defines the cluster itself, not the services or tasks running within it. A load balancer can be associated with the cluster via an AWS::ECS::Service resource, but the cluster definition is solely handled by AWS::ECS::Cluster.

Answer

AWS::ECS::Service

Answer

AWS::ECS::TaskDefinition

Answer

AWS::ECS::ContainerInstance

Question 8

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The application is deployed to the instances using an in-place deployment. The instances are running Amazon Linux 2. What should the DevOps engineer check first?

Accepted Answer

Verify that the AWS CodeDeploy agent is installed and running on each EC2 instance.. The error message indicates that individual instances failed deployment, which is most commonly caused by the AWS CodeDeploy agent not running or not being installed on the EC2 instances. For an in-place deployment on Amazon Linux 2, the CodeDeploy agent must be installed and actively running to receive and execute deployment commands from the CodeDeploy service. If the agent is missing or stopped, the instance cannot participate in the deployment, leading to the 'too many individual instances failed' error.

Answer

Check the security group rules for the EC2 instances.

Answer

Check the application's port availability.

Answer

Verify that the IAM instance profile associated with the instances has the correct permissions.

Question 9

A DevOps engineer wants to automate the creation and cleanup of temporary development environments on AWS. Each environment consists of an Amazon EC2 instance and an Amazon RDS database. The environments should be isolated and cost-effective. Which AWS service is best suited for this?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is best suited because it allows you to define the entire temporary environment—EC2 instance and RDS database—as infrastructure as code (IaC) in a single template. You can create and delete the entire stack with one API call, ensuring isolation via separate stacks and cost-effectiveness by automating cleanup when the stack is deleted.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

Amazon ECS

Question 10

A company uses AWS CodePipeline with a GitHub source action. The pipeline is configured to trigger on changes to the main branch. After a recent commit, the pipeline did not trigger. The DevOps engineer verified that the webhook is configured correctly and the IAM role has the necessary permissions. What is the most likely cause?

Accepted Answer

The GitHub personal access token used for authentication has expired.. The most likely cause is that the GitHub personal access token used for authentication has expired. CodePipeline uses this token to authenticate with GitHub and trigger the webhook; when the token expires, GitHub rejects the webhook call, preventing the pipeline from starting even though the webhook configuration and IAM permissions are correct.

Answer

The pipeline is set to manual execution only.

Answer

The source action's branch filter is set to a different branch.

Answer

The GitHub webhook endpoint URL is incorrect.

Question 11

A company is using AWS CodeBuild to compile a Java application. The build takes over 30 minutes, which is too long. The project uses the standard build environment. The source code is stored in an S3 bucket. What is the most effective way to reduce build time?

Accepted Answer

Enable local caching for dependencies in the buildspec.yml.. Enabling local caching in the buildspec.yml allows CodeBuild to reuse previously downloaded dependency files (e.g., Maven .m2 repository) across builds, significantly reducing the time spent on dependency resolution. Since the build takes over 30 minutes, caching avoids re-downloading dependencies on every build, which is the most effective optimization for a standard build environment.

Answer

Use a custom build environment with pre-installed Java.

Answer

Store the source code in AWS CodeCommit instead of S3.

Answer

Increase the compute type to a larger instance.

Question 12

A company has a CI/CD pipeline that builds a Docker image and pushes it to Amazon ECR. The build step uses AWS CodeBuild. The engineer wants to ensure that the ECR repository has a lifecycle policy to expire untagged images after 14 days. Which TWO actions are required? (Choose 2.)

Accepted Answer

Create an ECR lifecycle policy for the repository.. ECR lifecycle policies are configured at the repository level, not in CodeBuild or buildspec files. Option E is correct because the rule must specifically target untagged images and set an expiration of 14 days using the `expire` action with `sinceImagePushed` and `countType` set to `sinceImagePushed` and `countNumber` set to 14. Together, these two actions ensure the lifecycle policy exists and contains the correct rule to expire untagged images after 14 days.

Answer

Use the docker tag command to tag images with a timestamp.

Answer

Add a lifecycle policy rule in the buildspec.yml file.

Answer

Configure the lifecycle policy in the CodeBuild project settings.

Question 13

A company is migrating to a microservices architecture on Amazon ECS with AWS Fargate. They want to automate the deployment process using AWS CodePipeline. The pipeline should build a Docker image, push it to Amazon ECR, and deploy the updated service to ECS. Which THREE components are required in the pipeline? (Choose 3.)

Accepted Answer

Deploy stage with AWS CodeDeploy to ECS.. AWS CodeDeploy is the native deployment service that integrates with Amazon ECS to perform blue/green deployments, rolling updates, and traffic shifting. In a CodePipeline, the Deploy stage uses CodeDeploy to orchestrate the ECS service update, ensuring zero-downtime deployments by managing task set creation and load balancer target group routing.

Answer

Manual approval stage.

Answer

Test stage with AWS CodeBuild to run unit tests.

Question 14

A DevOps engineer is designing a CI/CD pipeline for a Python application using AWS CodeBuild and AWS CodeDeploy. The application is deployed to an Auto Scaling group of EC2 instances. The engineer wants to ensure that the deployment does not impact availability. Which TWO strategies can be used? (Choose 2.)

Accepted Answer

Rolling deployment with a small batch size.. Rolling deployment with a small batch size (Option B) updates a limited number of instances at a time, ensuring that the majority of the Auto Scaling group remains available throughout the deployment. Blue/green deployment (Option D) creates a separate, fully-provisioned environment (green) and switches traffic to it only after validation, which eliminates downtime during the cutover. Both strategies directly preserve application availability by avoiding full-scale disruption.

Answer

In-place deployment with a large batch size.

Answer

Immutable deployment.

Answer

Canary deployment.

Question 15

You are a DevOps engineer at a company that runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed using AWS CodeDeploy with an in-place deployment strategy. The deployment group contains 10 EC2 instances in an Auto Scaling group. Recently, a deployment failed with the error 'The overall deployment failed because too many individual instances failed deployment.' You check the CodeDeploy agent logs on one of the failed instances and see the error 'Script at /opt/codedeploy-agent/deployment-root/deployment-logs/scripts/application_start.sh failed with exit code 1.' The application_start.sh script is part of the AppSpec file. The script attempts to restart the web server. You notice that the script uses a path that exists only on some instances. What should you do to resolve this issue and prevent future failures?

Accepted Answer

Modify the application_start.sh script to check for the existence of the path before running the restart command.. The error indicates that application_start.sh failed because it references a path that does not exist on all instances. The correct fix is to make the script robust by checking for the path's existence before attempting the restart, so it does not fail on instances where the path is absent. This addresses the root cause and prevents future deployment failures.

Answer

Increase the deployment timeout in CodeDeploy.

Answer

Remove the application_start.sh script from the AppSpec file.

Answer

Reinstall the CodeDeploy agent on all instances.