DOP-C02 SDLC Automation Practice Test 3 — 15 Questions

Question 1

A CodeDeploy deployment group is configured as shown in the exhibit. During a deployment, the deployment fails because the instances are not found. What is the MOST likely reason?

Accepted Answer

The EC2 instances do not have the tag 'Environment' with value 'Production'. The exhibit shows the deployment group is configured to match EC2 instances with the tag 'Environment' set to 'Production'. If the instances do not have this exact tag key-value pair, CodeDeploy cannot find them during the deployment, causing the failure. The error 'instances are not found' directly points to a tag mismatch, not to permissions or load balancer issues.

Answer

The deployment configuration 'CodeDeployDefault.AllAtOnce' is not compatible with in-place deployments

Answer

The service role ARN is incorrect and does not have the necessary permissions

Answer

The load balancer 'my-alb' is not registered with the instances

Question 2

A CloudFormation stack creation failed as shown in the exhibit. What is the MOST likely cause of the failure?

Accepted Answer

The subnet resource depends on a resource that was not created successfully. The exhibit shows that the VPC was created successfully (CREATE_COMPLETE), but later the stack experienced a failure in another resource, triggering a rollback. During rollback, CloudFormation deletes all created resources, starting with the VPC. The subnet, which depends on the VPC, then fails with a 'dependency violation' because the VPC no longer exists at the time the subnet's creation is attempted or during the rollback process. Therefore, the subnet fails because it depends on a resource (the VPC) that was not successfully retained in the final stack state, making option A correct.

Answer

The VPC creation failed, so the subnet could not be created

Answer

The CloudFormation service role does not have permission to create subnets

Answer

The subnet logical ID conflicts with an existing resource in the stack

Question 3

A company uses AWS CodeBuild to compile and test code. The build takes 30 minutes, but the team wants to reduce build time by caching dependencies. Which approach should be used?

Accepted Answer

Enable local caching in the build project configuration.. AWS CodeBuild's local caching feature allows you to cache intermediate build artifacts (such as dependencies) in a local directory on the build instance, which persists across builds for the same build project. This eliminates the need to re-download dependencies from external sources for every build, significantly reducing build time. The cache is stored in a Docker volume or S3 bucket, but the key benefit is that it is automatically managed by CodeBuild without manual download steps.

Answer

Remove unnecessary dependencies from the build specification.

Answer

Store dependencies in an S3 bucket and download them before each build.

Answer

Use AWS CodeArtifact to store dependencies and pull them during build.

Question 4

A team uses AWS CodePipeline with a source action from an Amazon S3 bucket. The pipeline triggers on changes to the S3 bucket, but sometimes runs twice for a single commit. What is the most likely cause?

Accepted Answer

S3 event notifications for the same object may be delivered more than once.. Amazon S3 event notifications are designed for at-least-once delivery, meaning the same event (e.g., an object PUT) can be delivered multiple times. When CodePipeline uses S3 as a source, it relies on these notifications to trigger the pipeline. If S3 sends duplicate notifications for the same object version, CodePipeline will start a new execution for each notification, causing the pipeline to run twice for a single commit.

Answer

CodePipeline has a deduplication setting that is disabled.

Answer

The S3 bucket has versioning enabled.

Answer

The pipeline is also triggered by a CloudWatch Events rule.

Question 5

A development team wants to automate infrastructure provisioning using AWS CloudFormation. Which tool is specifically designed to manage CloudFormation templates as part of a deployment pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct answer because it is a fully managed continuous delivery service that allows you to model, visualize, and automate the steps required to release your infrastructure changes. You can integrate CloudFormation as a deployment action within a pipeline stage, enabling the automated creation, update, or deletion of stacks based on template changes committed to a source repository.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 6

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. After a deployment, some instances fail the health check and are terminated by the Auto Scaling group. What should the DevOps engineer do to prevent this?

Accepted Answer

Update the deployment group to use an Elastic Load Balancer and configure health checks.. Configuring an Elastic Load Balancer (ELB) with health checks in the CodeDeploy deployment group allows CodeDeploy to monitor instance health during deployment. If an instance fails the ELB health check, CodeDeploy can automatically roll back or stop the deployment, preventing the Auto Scaling group from terminating unhealthy instances. This integrates the deployment lifecycle with load balancer health signals, ensuring only healthy instances serve traffic.

Answer

Configure a CloudWatch alarm to stop the deployment if instances are unhealthy.

Answer

Modify the deployment configuration to deploy to only one instance at a time.

Answer

Increase the desired capacity of the Auto Scaling group to tolerate failures.

Question 7

A DevOps team wants to run unit tests in parallel across multiple build environments using AWS CodeBuild. Which build specification configuration allows this?

Accepted Answer

Define a batch build with multiple builds.. AWS CodeBuild supports batch builds, which allow you to define a build project that runs multiple builds in parallel. By specifying a batch configuration in your buildspec file (using the `batch` section), you can run unit tests across multiple build environments simultaneously, improving test execution speed and resource utilization.

Answer

Use multiple build phases in the buildspec file.

Answer

Configure multiple artifacts in the buildspec.

Answer

Set environment variables to run multiple commands concurrently.

Question 8

A company uses AWS CodeCommit as a Git repository. Developers want to enforce that all commits are signed with GPG keys. How can this be achieved?

Accepted Answer

Ask developers to sign commits locally and use a pre-commit hook.. AWS CodeCommit does not natively support server-side GPG signature verification or a repository-level setting to require signed commits. The most practical way to enforce signed commits is through client-side Git hooks. Option D describes this approach: developers sign commits locally and a pre-commit hook ensures that every commit is signed before it is created. While not foolproof (developers can bypass the hook), it is the only viable method among the options that aligns with CodeCommit's capabilities. Option A misinterprets 'Git hook in the repository' as a server-side hook, which CodeCommit does not support. Option B is incorrect because IAM policies cannot evaluate commit signature status. Option C is incorrect because CodeCommit lacks such a native setting.

Answer

Configure a Git hook in the repository to reject unsigned commits.

Answer

Use an IAM policy condition to deny pushes if the commit is not signed.

Answer

Enable the 'Require GPG signatures' option in the CodeCommit repository settings.

Question 9

A team uses AWS CodePipeline to deploy a microservices application. The pipeline has a deploy action that uses AWS CloudFormation. The CloudFormation template creates an Amazon ECS service. The deployment fails because the ECS service cannot be updated. What is the most likely cause?

Accepted Answer

The CloudFormation stack already exists and is in a previous failed state.. When a CloudFormation stack update fails, the stack enters a ROLLBACK_COMPLETE or UPDATE_ROLLBACK_COMPLETE state. In this state, the stack is considered to be in a 'failed' state and cannot be updated again until it is either deleted or the stack is manually continued with a rollback. CodePipeline's CloudFormation deploy action will attempt to perform a stack update, but CloudFormation rejects the request because the existing stack is in a non-updatable state, causing the pipeline deployment to fail.

Answer

The ECS service is in a steady state and cannot be modified.

Answer

The CodePipeline deploy action is configured with the wrong action type.

Answer

The IAM role used by CloudFormation does not have permission to update ECS services.

Question 10

A company uses AWS CodeBuild to run security scans. The scans require access to a private Amazon ECR repository. The build project is configured with a service role. What is the correct way to provide access to ECR?

Accepted Answer

Attach an IAM policy to the CodeBuild service role that allows ECR operations.. CodeBuild uses an IAM service role to define the permissions granted to the build environment. By attaching an IAM policy that allows ECR operations (such as ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:GetAuthorizationToken) to the CodeBuild service role, the build project can authenticate and pull images from the private ECR repository without needing to embed or manage static credentials.

Answer

Set environment variables with ECR credentials in the build project.

Answer

Configure the ECR repository policy to allow access from the CodePipeline service role.

Answer

Include the ECR credentials in the buildspec file.

Question 11

Which TWO options are valid ways to trigger an AWS CodePipeline execution automatically?

Accepted Answer

Create an Amazon CloudWatch Events rule that starts the pipeline on a schedule.. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a cron or rate expression to trigger an AWS CodePipeline execution on a schedule. This is a native integration that directly starts the pipeline without requiring additional compute resources or custom code.

Answer

Use a git push to the repository via SSH.

Answer

Set up a manual approval step in the pipeline.

Answer

Enable AWS CodeBuild to start the pipeline after a build.

Question 12

Which THREE steps are required to set up cross-account access for AWS CodePipeline using a customer-managed KMS key?

Accepted Answer

Grant the pipeline's IAM role permission to use the KMS key via IAM policy.. To set up cross-account access for CodePipeline with a customer-managed KMS key, you must: (1) Grant the pipeline's IAM role permissions to use the KMS key via an IAM policy (Option B). (2) Add the pipeline's IAM role ARN from the source account to the KMS key policy (Option C). (3) Configure the artifact bucket policy to allow the target account's IAM role to access the bucket. Option E incorrectly states 'pipeline's IAM role in the other account'; it should be the target account's IAM role.

Answer

Give the target account's IAM role permission to encrypt with the KMS key.

Answer

Create a KMS key in the target account.

Answer

Configure the artifact bucket policy to allow access from the pipeline's IAM role in the other account.

Question 13

Which TWO AWS services can be used to implement a blue/green deployment for an application running on Amazon EC2 instances?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy (Option B) is correct because it natively supports blue/green deployments for Amazon EC2 instances by allowing you to provision a new set of instances (the green environment), deploy the new application revision to them, and then shift traffic from the old (blue) environment to the new one. This is achieved through integration with an Elastic Load Balancer (ELB) or Auto Scaling groups, where CodeDeploy manages the lifecycle of instances and traffic routing during the deployment process.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS CodeBuild

Question 14

Refer to the exhibit. A DevOps engineer created this IAM policy for a CodeDeploy service role. The deployment fails with an 'AccessDenied' error when attempting to register instances with an Auto Scaling group. What is the likely cause?

Accepted Answer

The policy is missing autoscaling:UpdateAutoScalingGroup and autoscaling:SetDesiredCapacity.. The CodeDeploy service role must include permissions for autoscaling:UpdateAutoScalingGroup and autoscaling:SetDesiredCapacity to allow CodeDeploy to register instances with an Auto Scaling group during a deployment. Without these actions, the deployment fails with an 'AccessDenied' error when CodeDeploy attempts to attach instances to the Auto Scaling group or adjust its capacity.

Answer

The policy does not allow autoscaling:CompleteLifecycleAction.

Answer

The role is not trusted by the EC2 service.

Answer

The iam:PassRole action is not scoped to the correct resource.

Question 15

Refer to the exhibit. A DevOps engineer runs this AWS CLI command to list all CodeBuild projects with 'production' in their name. The command returns an empty list, but the engineer knows there are projects named 'production-app' and 'production-backend'. What is the most likely reason?

Accepted Answer

The --query parameter syntax is incorrect.. The --query parameter uses JMESPath syntax, and the filter expression `contains(Name, 'production')` is incorrectly written. The correct syntax should be `contains(Name, 'production')` without extra quotes or brackets around the string. The empty result indicates the query failed to match due to syntax error, not because the projects don't exist.

Answer

The IAM user does not have list-projects permission.

Answer

The AWS CLI is not configured with valid credentials.

Answer

The region specified is incorrect.