DOP-C02 SDLC Automation Practice Test 3 — 15 Questions

Question 1

A development team uses AWS CodeCommit as a source control repository. A developer accidentally pushed a commit that contains sensitive information (e.g., AWS access keys) to the main branch. The team wants to remove the sensitive data from the repository history completely. Which action should the engineer take?

Accepted Answer

Use 'git filter-branch' to rewrite the repository history and remove the sensitive file. Option A is correct because 'git filter-branch' (or the modern 'git filter-repo') rewrites the repository history by removing or replacing the sensitive file in every commit, effectively purging it from the entire Git history. This is the only native Git method that completely eliminates the sensitive data from all past commits, preventing anyone from retrieving it via 'git log' or by cloning the repository. After rewriting history, a force push to the remote CodeCommit repository is required to overwrite the remote branches.

Answer

Delete the repository and create a new one, then force push the remaining branches

Answer

Use 'git revert' to create a new commit that undoes the changes

Answer

Create a new branch from the commit before the sensitive data was added and merge it to main

Question 2

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer. The application is deployed using AWS CodeDeploy with an in-place deployment configuration. During a recent deployment, the deployment failed because the new application version caused a health check failure, and CodeDeploy did not automatically roll back. What should the engineer do to ensure automatic rollback on health check failure?

Accepted Answer

Enable automatic rollback in the CodeDeploy deployment group and set up a CloudWatch alarm for the ALB health check. Option C is correct because CodeDeploy can automatically roll back a deployment when a CloudWatch alarm, such as one monitoring ALB health check failures, enters the ALARM state. By enabling automatic rollback in the deployment group and associating the CloudWatch alarm, the deployment will revert to the previous version as soon as the health check fails, without manual intervention.

Answer

Set up an EC2 instance lifecycle hook to trigger a rollback script when the instance enters a pending state

Answer

Configure an Amazon SQS queue to monitor health checks and invoke a rollback Lambda function

Answer

Modify the Auto Scaling group to replace unhealthy instances automatically

Question 3

A team uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that creates an S3 bucket and a DynamoDB table. The S3 bucket name must be unique across all AWS accounts. Which CloudFormation intrinsic function should be used to generate a unique bucket name?

Accepted Answer

!Sub 'mybucket-${AWS::AccountId}'. Option C is correct because the `!Sub 'mybucket-${AWS::AccountId}'` intrinsic function substitutes the AWS::AccountId pseudo parameter, which is guaranteed to be unique per AWS account. Since S3 bucket names must be globally unique across all AWS accounts, appending the account ID ensures the generated name does not conflict with buckets in other accounts. This approach is a common pattern for creating unique resource names in CloudFormation.

Answer

!Ref 'AWS::StackName'

Answer

!GetAtt S3Bucket.Arn

Answer

!Select [0, !Split ['-', !Ref 'AWS::Region']]

Question 4

A company uses AWS CodePipeline to orchestrate a multi-stage deployment. The pipeline has a source, build, test, and deploy stage. The test stage runs integration tests against a temporary environment. The team wants to ensure that the deploy stage only runs if the test stage succeeds. What configuration is needed?

Accepted Answer

No additional configuration needed; the pipeline will not proceed to deploy if the test stage fails. In AWS CodePipeline, each stage has a status (Succeeded, Failed, InProgress, etc.). By default, the pipeline transitions to the next stage only if the current stage completes with a status of Succeeded. If the test stage fails, the pipeline stops and does not proceed to the deploy stage. Therefore, no additional configuration is required to enforce this behavior.

Answer

Add a manual approval action in the test stage that requires a developer to confirm success

Answer

Set the test stage to retry on failure three times before allowing deploy to proceed

Answer

Configure the deploy stage to skip if the test stage fails using a condition

Question 5

A company deploys a serverless application using AWS SAM. The application includes an API Gateway REST API and multiple Lambda functions. The team wants to implement canary deployments for the API to gradually shift traffic to a new version. Which SAM template configuration should be used?

Accepted Answer

Use the CanaryDeployment property on the Serverless::Function resource with a DeploymentPreference. Option A is correct because AWS SAM's `CanaryDeployment` property on the `AWS::Serverless::Function` resource, combined with a `DeploymentPreference` of type `Canary10Percent5Minutes`, enables gradual traffic shifting for API Gateway integrations. This configuration automatically creates a Lambda alias, publishes new versions, and shifts a percentage of API traffic to the new version over a specified time window, all without manual intervention.

Answer

Create multiple Lambda function versions and use API Gateway stage variables to switch between them

Answer

Define the Lambda function with AutoPublishAlias: live and set the API Gateway integration to point to the alias

Answer

Use AWS CloudFormation's UpdatePolicy with AutoScalingRollingUpdate

Question 6

A developer is setting up AWS CodeBuild to compile a Go application. The build fails with the error: 'go: command not found'. What is the MOST likely cause?

Accepted Answer

The build environment image does not have the Go runtime installed. The error 'go: command not found' indicates that the Go executable is not available in the build environment's PATH. CodeBuild uses a managed or custom build environment image (e.g., Ubuntu, Amazon Linux 2) to run build commands. If the image does not include the Go runtime, the shell cannot locate the 'go' binary, causing the build to fail. The most direct fix is to select a build environment image that has Go pre-installed or to install Go in the install phase of the buildspec.

Answer

The environment variables in buildspec.yml are incorrectly set

Answer

The build project does not have enough memory to compile Go code

Answer

The CodeBuild service role does not have permission to access the S3 bucket for artifacts

Question 7

Which TWO actions should a DevOps engineer take to implement a CI/CD pipeline that automatically deploys a containerized application to Amazon ECS using AWS CodePipeline and AWS CodeBuild? (Choose TWO.)

Accepted Answer

Use CodeBuild to build the Docker image and push it to Amazon ECR. Option D is correct because AWS CodeBuild can be configured to build the Docker image from source code and then push it to Amazon ECR using the `post_build` phase with commands like `docker push`. This is a standard pattern for containerized CI/CD pipelines, as ECR serves as the private registry for storing and versioning container images. Option E is correct because CodePipeline can use Amazon ECR as a source action, which triggers the pipeline automatically when a new image is pushed to the specified repository, enabling continuous deployment to ECS.

Answer

Use AWS CloudFormation to deploy the ECS service

Answer

Use AWS CodeDeploy to deploy the container to ECS with a blue/green deployment

Answer

Store the Docker image in AWS CodeCommit

Question 8

Which THREE components are required to set up a fully automated CI/CD pipeline for a static website hosted on Amazon S3 using AWS CodePipeline? (Choose THREE.)

Accepted Answer

An AWS CodeBuild project to run build commands (e.g., minification). Option A is correct because AWS CodeBuild is required to execute build commands such as minification, bundling, or transpilation of static website assets before deployment. In a fully automated CI/CD pipeline, CodeBuild processes the source code from the repository and produces the deployable artifacts that are then uploaded to the S3 bucket.

Answer

An Amazon CloudFront distribution for content delivery

Answer

An AWS Lambda function to invalidate CloudFront cache

Question 9

Which TWO best practices should be followed when configuring AWS CodeBuild projects to improve build performance and security? (Choose TWO.)

Accepted Answer

Configure the build project to use a custom VPC to access resources like private Amazon RDS databases. Option C is correct because configuring a CodeBuild project to use a custom VPC allows it to access resources that are not publicly accessible, such as private Amazon RDS databases or internal services, which is essential for building applications that depend on those resources. This also enhances security by keeping traffic within the VPC and avoiding exposure to the public internet.

Answer

Run builds as the root user to avoid permission errors

Answer

Use the AWS managed policy 'AdministratorAccess' for the CodeBuild service role to avoid permission issues

Answer

Always use the 'latest' tag for the build environment image to ensure up-to-date software

Question 10

A DevOps engineer is reviewing the IAM policy attached to a CodeBuild service role. The policy allows starting builds and viewing logs. However, when CodeBuild tries to download artifacts from an S3 bucket in the same account, it fails with an access denied error. What is the missing permission?

Accepted Answer

s3:GetObject. The error occurs because CodeBuild needs to download artifacts from S3, which requires the s3:GetObject permission on the bucket or object. Without this permission, the service role cannot read the artifact files, even though it can start builds and view logs. The s3:GetObject action is the specific permission that grants read access to S3 objects.

Answer

kms:Decrypt

Answer

s3:PutObject

Answer

logs:DescribeLogGroups

Question 11

A CodeDeploy deployment group is configured as shown in the exhibit. During a deployment, the deployment fails because the instances are not found. What is the MOST likely reason?

Accepted Answer

The EC2 instances do not have the tag 'Environment' with value 'Production'. Option B is correct because the exhibit shows the deployment group is configured to match EC2 instances with the tag 'Environment' set to 'Production'. If the instances do not have this exact tag key-value pair, CodeDeploy cannot find them during the deployment, causing the failure. The error 'instances are not found' directly points to a tag mismatch, not to permissions or load balancer issues.

Answer

The deployment configuration 'CodeDeployDefault.AllAtOnce' is not compatible with in-place deployments

Answer

The service role ARN is incorrect and does not have the necessary permissions

Answer

The load balancer 'my-alb' is not registered with the instances

Question 12

A CloudFormation stack creation failed as shown in the exhibit. What is the MOST likely cause of the failure?

Accepted Answer

The subnet resource depends on a resource that was not created successfully. The exhibit shows that the VPC was created successfully, but the subnet creation failed with a 'dependency violation' error. In CloudFormation, when a resource depends on another resource that was not created successfully (or was deleted), the dependent resource cannot be created because the target resource (the VPC) no longer exists or is in a failed state. This is the most likely cause because the subnet depends on the VPC, and if the VPC was rolled back or deleted due to a prior failure, the subnet creation will fail with a dependency violation.

Answer

The VPC creation failed, so the subnet could not be created

Answer

The CloudFormation service role does not have permission to create subnets

Answer

The subnet logical ID conflicts with an existing resource in the stack

Question 13

A company uses AWS CodeBuild to compile and test code. The build takes 30 minutes, but the team wants to reduce build time by caching dependencies. Which approach should be used?

Accepted Answer

Enable local caching in the build project configuration.. Option D is correct because AWS CodeBuild's local caching feature allows you to cache intermediate build artifacts (such as dependencies) in a local directory on the build instance, which persists across builds for the same build project. This eliminates the need to re-download dependencies from external sources for every build, significantly reducing build time. The cache is stored in a Docker volume or S3 bucket, but the key benefit is that it is automatically managed by CodeBuild without manual download steps.

Answer

Remove unnecessary dependencies from the build specification.

Answer

Store dependencies in an S3 bucket and download them before each build.

Answer

Use AWS CodeArtifact to store dependencies and pull them during build.

Question 14

A team uses AWS CodePipeline with a source action from an Amazon S3 bucket. The pipeline triggers on changes to the S3 bucket, but sometimes runs twice for a single commit. What is the most likely cause?

Accepted Answer

S3 event notifications for the same object may be delivered more than once.. Amazon S3 event notifications are designed for at-least-once delivery, meaning the same event (e.g., an object PUT) can be delivered multiple times. When CodePipeline uses S3 as a source, it relies on these notifications to trigger the pipeline. If S3 sends duplicate notifications for the same object version, CodePipeline will start a new execution for each notification, causing the pipeline to run twice for a single commit.

Answer

CodePipeline has a deduplication setting that is disabled.

Answer

The S3 bucket has versioning enabled.

Answer

The pipeline is also triggered by a CloudWatch Events rule.

Question 15

A development team wants to automate infrastructure provisioning using AWS CloudFormation. Which tool is specifically designed to manage CloudFormation templates as part of a deployment pipeline?

Accepted Answer

AWS CodePipeline. Option C is correct because AWS CodePipeline natively integrates with CloudFormation to deploy infrastructure. Option A is wrong because AWS CodeCommit is a source control service. Option B is wrong because AWS CodeBuild is a build service. Option D is wrong because AWS CodeDeploy is for deploying applications, not infrastructure.

Answer

AWS CodeCommit

Answer

AWS CodeBuild

Answer

AWS CodeDeploy