DOP-C02 SDLC Automation Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. The deployment succeeded but the application fails. What is the MOST likely cause?

Accepted Answer

The new task definition has a misconfigured database connection string or security group.. The most common cause of a deployment succeeding but the application failing is a misconfiguration in the new task definition, such as an incorrect database connection string or a security group that does not allow traffic to the database. CodePipeline can successfully deploy the new task definition to ECS, but if the application cannot connect to its backend services due to these configuration errors, the application will fail at runtime. This aligns with the scenario where the deployment pipeline reports success but the application itself is non-functional.

Answer

The CodePipeline deployment action uses the wrong cluster.

Answer

The ECS service is not registered with a target group.

Answer

The database is not available in the same Availability Zone.

Question 2

Refer to the exhibit. A developer is using this buildspec.yml in AWS CodeBuild to build and push a Docker image to Amazon ECR. The build fails with the error: 'Error: No region specified'. Which change should the developer make to resolve this error?

Accepted Answer

Set the AWS_DEFAULT_REGION environment variable in the CodeBuild project's environment configuration.. The error occurs because the $AWS_DEFAULT_REGION environment variable is not set in the CodeBuild project. The developer must explicitly set the AWS_DEFAULT_REGION environment variable in the CodeBuild project configuration.

Answer

Add a pre_build command to export AWS_DEFAULT_REGION using the AWS CLI.

Answer

Replace $AWS_DEFAULT_REGION with a hardcoded region like us-east-1.

Answer

Use the AWS_REGION environment variable instead of AWS_DEFAULT_REGION in the buildspec.

Question 3

Refer to the exhibit. An IAM policy is attached to a user. The user tries to push a commit to the 'develop' branch of 'MyRepo' using Git. What is the outcome?

Accepted Answer

The push is denied because the user is not pushing to the 'main' branch.. The policy allows GitPull and GitPush on the repo, but denies GitPush when the reference is not 'refs/heads/main'. Since the user is pushing to 'develop', the condition is met, and the Deny applies. An explicit Deny overrides any Allow, so the push is denied.

Answer

The push is denied only if the user is pushing to the 'main' branch.

Answer

The push succeeds because the Allow statement grants GitPush.

Answer

The push is denied because the Deny statement blocks all GitPush actions.

Question 4

Refer to the exhibit. A CloudFormation stack has been deployed. A developer wants to use the S3 bucket name in a subsequent AWS CLI command. Which command will correctly retrieve the bucket name?

Accepted Answer

aws cloudformation describe-stacks --stack-name my-stack --query "Stacks[0].Outputs[?OutputKey=='BucketName'].OutputValue" --output text. The developer can use the --query parameter with the describe-stacks command to extract the OutputValue for the specific OutputKey 'BucketName'. Option C uses the correct JMESPath syntax with the filter [?OutputKey=='BucketName'] to select the matching output and then retrieves its OutputValue. Option A attempts to list all S3 buckets and grep for 'my-stack', which is unreliable and not the intended method. Option B uses describe-stack-resources but incorrectly assumes the bucket name is a physical resource ID when it is actually an output value. Option D uses incorrect JMESPath syntax (single bracket with equality) which is invalid.

Answer

aws s3 ls | grep my-stack

Answer

aws cloudformation describe-stack-resources --stack-name my-stack --logical-resource-id BucketName --query "StackResources[0].PhysicalResourceId" --output text

Answer

aws cloudformation describe-stacks --stack-name my-stack --query "Stacks[0].Outputs[OutputKey='BucketName'].OutputValue" --output text

Question 5

A company uses AWS CodePipeline with a source stage from GitHub (via CodeStar Connections). The pipeline has a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy. The team wants to ensure that a new pipeline execution starts automatically whenever a pull request is merged into the main branch. Which configuration change should be made to meet this requirement?

Accepted Answer

Configure the CodeStar Connection to use a webhook that triggers the pipeline on push events to the main branch.. For GitHub sources, CodePipeline uses CodeStar Connections, which create webhooks. When a pull request is merged, a push event to the target branch occurs, and the webhook automatically starts the pipeline. This is the native, recommended method. Polling is not supported for connections, and custom EventBridge rules or manual approvals do not provide automatic triggering.

Answer

Enable the 'Poll for source changes' option on the source action and set the poll interval to 1 minute.

Answer

Create an Amazon EventBridge rule that monitors GitHub pull request merge events and invokes the pipeline via a Lambda function.

Answer

Add a manual approval action before the source stage that triggers the pipeline when a pull request is merged.

Question 6

A company runs a standard AWS CodePipeline with a CodeCommit source and a CodeBuild build stage. Compliance requires that every source revision be built with a buildspec that is immutable and shared across all pipelines in the organization; developers must not be able to change build instructions by editing files in the source repository. Which approach enforces this requirement with the least operational overhead?

Accepted Answer

Configure the CodeBuild project to use an inline buildspec defined in the project, and reference that project from every pipeline stage.. Storing the buildspec inline in the CodeBuild project makes build instructions part of the project definition rather than the source tree, so source repository changes cannot affect them. Because pipelines reference the same CodeBuild project, the definition is shared and consistent across the organization, which satisfies both immutability and low operational overhead without per-repository controls.

Answer

Move the buildspec into an Amazon S3 object and use the S3 object URL in the CodeBuild project's source configuration.

Answer

Create a separate CodeCommit repository that holds only buildspec.yml and add it as a second source action with a lower runOrder than the application source.

Answer

Store the buildspec.yml in the CodeCommit repository and protect the branch with an approval rule template that requires senior approval.

Question 7

A DevOps engineer manages a CodePipeline with a CodeCommit source, a CodeBuild test stage, and a manual approval before a production deploy stage. Audit requires that only the specific commit that passed testing can be deployed, and that no new commits pushed to the branch between test and approval can reach production. What should the engineer configure to guarantee this?

Accepted Answer

Keep the same pipeline execution through approval so the approved execution deploys the artifact produced earlier in that same execution.. The requirement is that the tested artifact, not just the branch, is what reaches production. Within one CodePipeline execution, artifacts are immutable across stages, so approving and continuing that execution deploys the tested revision. A later push starts a separate execution that cannot bypass test and approval, which preserves the audit guarantee without custom comparison logic.

Answer

Configure the source action to use a specific commit ID as the source revision and disable polling so the pipeline only runs for that commit.

Answer

Add a stage-level condition or gate that fails the pipeline if the source artifact revision differs from the revision recorded at test time.

Answer

Enable the pipeline's artifact bucket versioning and add a lifecycle rule that expires old artifact versions after 30 days.

Question 8

A team wants to run a CodeBuild project that builds a container image and pushes it to Amazon ECR, but the build currently fails with an access denied error when calling ecr:InitiateLayerUpload. The CodeBuild project uses a service role and runs in a VPC. Which TWO actions should the engineer take to resolve the error while keeping the build functional? (Choose two.)

Accepted Answer

Attach an IAM policy to the CodeBuild service role granting the required Amazon ECR push actions on the target repository.. The failure is an authorization and connectivity issue, not a Docker capability issue. Adding the required ECR push permissions to the CodeBuild service role authorizes the API calls, and ensuring the VPC can reach ECR endpoints allows the push to complete. Together these address both the permission and network dimensions of the error without introducing static credentials or unnecessary privileges.

Answer

Set the CodeBuild project's privileged mode to true so the Docker daemon can authenticate to Amazon ECR.

Answer

Change the buildspec to use the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables stored in plaintext.

Answer

Disable the CodeBuild service role and switch the project to use an IAM user's access keys for authentication.

Question 9

A company deploys an AWS CloudFormation stack that creates an Auto Scaling group and a launch template. The team wants every code change merged to the main branch to automatically update the stack, and they want to be able to roll back to the previous stack state if the update fails. Which combination of services should they use?

Accepted Answer

AWS CodePipeline with a CodeCommit source and a CloudFormation deploy action configured to create or update the stack.. The requirement is automated deployment on main branch commits plus automatic rollback on failure. CodePipeline with a CodeCommit source and a CloudFormation deploy action provides both: the source action triggers on branch changes, and the deploy action creates or updates the stack with CloudFormation's built-in rollback on failure, requiring minimal custom code.

Answer

Amazon EventBridge with a rule that matches CodeCommit events and targets an AWS Step Functions state machine that calls cloudformation update-stack.

Answer

AWS CodeCommit with a repository trigger that invokes an AWS Lambda function to call cloudformation create-stack.

Answer

AWS CodeBuild with a buildspec that runs the AWS CLI cloudformation deploy command and ignores failures.

Question 10

A DevOps engineer maintains a CodePipeline whose deploy stage uses the AWS CloudFormation deploy action. The team needs to add a step that runs a custom validation script against the generated CloudFormation template, and the validation must run before the stack is updated but must not modify the template. The validation script is stored in the same CodeCommit repository as the template. What is the most appropriate way to insert this step?

Accepted Answer

Add a CodeBuild action in the same stage before the deploy action, with a buildspec that runs the validation script on the input artifact.. The validation must run before the stack update, operate on the pipeline's template artifact, and leave the template unchanged. A CodeBuild action placed earlier in the same stage with a lower runOrder consumes the input artifact, runs the repository's script, and gates the subsequent CloudFormation deploy action, preserving native deploy behavior and artifact consistency.

Answer

Configure the CloudFormation deploy action to use a change set and require manual approval of the change set before execution.

Answer

Replace the CloudFormation deploy action with a CodeBuild action that runs the validation script and then calls cloudformation deploy.

Answer

Add a Lambda invoke action in the deploy stage before the CloudFormation deploy action and have the function pull the template from CodeCommit to validate it.

Question 11

A development team uses AWS CodeCommit to store their application code. They want to enforce that all code changes to the main branch are reviewed and approved by at least one other team member before being merged. Which AWS service or feature should they use to implement this requirement?

Accepted Answer

AWS CodeCommit approval rule templates. CodeCommit approval rule templates define the number of approvals required for a pull request to be merged. By applying a template to the repository, you can enforce that at least one approval is needed before merging into the main branch. This is the native feature for implementing mandatory code reviews in CodeCommit.

Answer

AWS Identity and Access Management (IAM) policies

Answer

AWS CodePipeline manual approval action

Answer

AWS CodeCommit repository triggers

Question 12

A DevOps engineer is setting up an AWS CodeBuild project to build a Node.js application. The buildspec.yml file includes a pre_build phase that runs npm install and a build phase that runs npm run build. The build is failing with an error indicating that the 'node' command is not found. The CodeBuild project uses a standard Ubuntu image with the 'aws/codebuild/standard:5.0' image. What is the most likely cause of the failure?

Accepted Answer

The buildspec.yml file is missing a runtime-versions section specifying Node.js.. CodeBuild standard images require the runtime-versions section in the buildspec.yml to install and configure the desired runtime, such as Node.js. Without it, the image may not have Node.js installed, leading to a 'command not found' error. Specifying runtime-versions ensures the correct version is available in the PATH for all phases.

Answer

The CodeBuild service role lacks permissions to download Node.js from the internet.

Answer

The build phase is using a different shell that does not have Node.js in its PATH.

Answer

The pre_build phase must include a command to install Node.js manually using apt-get.

Question 13

A DevOps engineer is setting up an AWS CodePipeline for a serverless application. The source code is in AWS CodeCommit, and the build and deploy stages use AWS CodeBuild and AWS CloudFormation respectively. The engineer wants to ensure that the pipeline automatically creates a new stack for each feature branch and deletes the stack when the branch is deleted. Which combination of actions should the engineer take to achieve this with minimal operational overhead?

Accepted Answer

Use AWS CodePipeline with a source action that triggers on all branches, and configure the build stage to pass the branch name to CloudFormation, creating a stack per branch with a naming convention, and use a cleanup Lambda triggered by CodeCommit branch deletion events.. To automatically create and delete CloudFormation stacks per feature branch, the engineer should use CodePipeline's branch-based triggering and pass the branch name to CloudFormation to create uniquely named stacks. A Lambda function triggered by CodeCommit branch deletion events can then delete the corresponding stack. This leverages native AWS services for automation, minimizing operational overhead. The other options either use inappropriate services, lack automation, or do not provide isolation.

Answer

Configure the pipeline to trigger on all branches and use a single CloudFormation stack with a parameter that includes the branch name.

Answer

Create a separate pipeline for each branch using AWS CloudFormation templates and AWS Lambda to manage stack creation and deletion.

Answer

Configure CodePipeline to use a single stage that deploys to AWS Elastic Beanstalk environments named after each branch, and rely on Elastic Beanstalk's environment lifecycle policies to delete environments when branches are deleted.

Question 14

A company stores its application source in an AWS CodeCommit repository. The security team requires that all code changes be reviewed and approved by at least one other developer before being merged into the `main` branch. A DevOps engineer needs to enforce this policy and prevent direct pushes to `main`. Which combination of actions should the engineer take?

Accepted Answer

Create an IAM policy that denies `codecommit:GitPush` to the `main` branch for all developers, and require pull requests via a repository approval rule template.. To prevent direct pushes to a specific branch in CodeCommit, an IAM policy must deny the `codecommit:GitPush` action for that branch reference. This is done using the `codecommit:References` condition key. To require approvals before merging, an approval rule template can be applied to the repository, mandating a minimum number of approvals. Together, these native features enforce both aspects of the security policy without custom code.

Answer

Configure an Amazon EventBridge rule that triggers an AWS Lambda function to revert any direct push to `main` and send a notification.

Answer

Enable branch protection on `main` in the CodeCommit console and configure an approval rule that requires one approver.

Answer

Use AWS CodePipeline to automatically reject any commit to `main` that does not have an approved pull request, and notify the security team.

Question 15

A company uses AWS CodeBuild to run unit tests for a Python application. The buildspec.yml file specifies a build phase that runs 'pytest'. The team wants to ensure that the build fails if any test fails, and that test results are available in the CodeBuild console. Which change should they make to the buildspec.yml?

Accepted Answer

Add a 'reports' section to the buildspec.yml that specifies the test report group and the location of the test results file.. To make test results available in the CodeBuild console, the buildspec.yml must include a 'reports' section that specifies the report group and the location of the test results file. CodeBuild automatically fails the build if a command in the build phase returns a non-zero exit code, so 'pytest' failures will cause the build to fail. The 'reports' section integrates with CodeBuild's test reporting feature, providing detailed test outcomes. The other options either describe non-existent features or do not provide the required reporting integration.

Answer

Modify the build phase to run 'pytest --junitxml=results.xml' and add an artifacts section to upload results.xml.

Answer

Add a post_build phase that checks the exit code of the build phase and fails the build if tests failed.

Answer

Set the 'fail-fast' option to true in the build phase to stop the build immediately if any test fails.