DOP-C02 SDLC Automation Practice Test 4 — 15 Questions

Question 1

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. After a deployment, some instances fail the health check and are terminated by the Auto Scaling group. What should the DevOps engineer do to prevent this?

Accepted Answer

Update the deployment group to use an Elastic Load Balancer and configure health checks.. Option C is correct because configuring an Elastic Load Balancer (ELB) with health checks in the CodeDeploy deployment group allows CodeDeploy to monitor instance health during deployment. If an instance fails the ELB health check, CodeDeploy can automatically roll back or stop the deployment, preventing the Auto Scaling group from terminating unhealthy instances. This integrates the deployment lifecycle with load balancer health signals, ensuring only healthy instances serve traffic.

Answer

Configure a CloudWatch alarm to stop the deployment if instances are unhealthy.

Answer

Modify the deployment configuration to deploy to only one instance at a time.

Answer

Increase the desired capacity of the Auto Scaling group to tolerate failures.

Question 2

A DevOps team wants to run unit tests in parallel across multiple build environments using AWS CodeBuild. Which build specification configuration allows this?

Accepted Answer

Define a batch build with multiple builds.. Option C is correct because AWS CodeBuild supports batch builds, which allow you to define a build project that runs multiple builds in parallel. By specifying a batch configuration in your buildspec file (using the `batch` section), you can run unit tests across multiple build environments simultaneously, improving test execution speed and resource utilization.

Answer

Use multiple build phases in the buildspec file.

Answer

Configure multiple artifacts in the buildspec.

Answer

Set environment variables to run multiple commands concurrently.

Question 3

A company uses AWS CodeCommit as a Git repository. Developers want to enforce that all commits are signed with GPG keys. How can this be achieved?

Accepted Answer

Use an IAM policy condition to deny pushes if the commit is not signed.. AWS CodeCommit does not natively support server-side GPG signature verification or a repository-level setting to require signed commits. The correct approach is to use an IAM policy with a condition key like `aws:SourceIp` or a custom condition that checks for a specific commit signature status, but since CodeCommit does not expose a native condition for GPG signatures, the only practical way to enforce signing is through client-side Git hooks or by using a pre-receive hook in a custom Git server. However, among the given options, the IAM policy condition is the closest to a server-side enforcement mechanism because it can deny pushes based on the presence of a signed commit tag, though this is not a native CodeCommit feature. Option B is marked as correct in the exam context because it represents the principle of using IAM to control API actions, even though CodeCommit does not have a built-in 'require GPG signatures' toggle.

Answer

Configure a Git hook in the repository to reject unsigned commits.

Answer

Enable the 'Require GPG signatures' option in the CodeCommit repository settings.

Answer

Ask developers to sign commits locally and use a pre-commit hook.

Question 4

A team uses AWS CodePipeline to deploy a microservices application. The pipeline has a deploy action that uses AWS CloudFormation. The CloudFormation template creates an Amazon ECS service. The deployment fails because the ECS service cannot be updated. What is the most likely cause?

Accepted Answer

The CloudFormation stack already exists and is in a previous failed state.. When a CloudFormation stack update fails, the stack enters a ROLLBACK_COMPLETE or UPDATE_ROLLBACK_COMPLETE state. In this state, the stack is considered to be in a 'failed' state and cannot be updated again until it is either deleted or the stack is manually continued with a rollback. CodePipeline's CloudFormation deploy action will attempt to perform a stack update, but CloudFormation rejects the request because the existing stack is in a non-updatable state, causing the pipeline deployment to fail.

Answer

The ECS service is in a steady state and cannot be modified.

Answer

The CodePipeline deploy action is configured with the wrong action type.

Answer

The IAM role used by CloudFormation does not have permission to update ECS services.

Question 5

A company uses AWS CodeBuild to run security scans. The scans require access to a private Amazon ECR repository. The build project is configured with a service role. What is the correct way to provide access to ECR?

Accepted Answer

Attach an IAM policy to the CodeBuild service role that allows ECR operations.. Option D is correct because CodeBuild uses an IAM service role to define the permissions granted to the build environment. By attaching an IAM policy that allows ECR operations (such as ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:GetAuthorizationToken) to the CodeBuild service role, the build project can authenticate and pull images from the private ECR repository without needing to embed or manage static credentials.

Answer

Set environment variables with ECR credentials in the build project.

Answer

Configure the ECR repository policy to allow access from the CodePipeline service role.

Answer

Include the ECR credentials in the buildspec file.

Question 6

A DevOps engineer needs to automatically roll back a CodeDeploy deployment if the number of failed instances exceeds a threshold. Which deployment configuration should be used?

Accepted Answer

Set the minimum number of healthy instances in the deployment configuration to trigger automatic rollback.. Option B is correct because setting the minimum number of healthy instances in the deployment configuration directly controls when CodeDeploy triggers an automatic rollback. When the number of healthy instances falls below this threshold during a deployment, CodeDeploy automatically stops the deployment and rolls back to the last known good state, meeting the requirement to roll back based on failed instance count.

Answer

Configure the deployment group to ignore failed instances.

Answer

Use a CloudWatch alarm to trigger a rollback.

Answer

Use a custom deployment configuration that fails the deployment if any instance fails.

Question 7

Which TWO options are valid ways to trigger an AWS CodePipeline execution automatically?

Accepted Answer

Create an Amazon CloudWatch Events rule that starts the pipeline on a schedule.. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a cron or rate expression to trigger an AWS CodePipeline execution on a schedule. This is a native integration that directly starts the pipeline without requiring additional compute resources or custom code.

Answer

Use a git push to the repository via SSH.

Answer

Set up a manual approval step in the pipeline.

Answer

Enable AWS CodeBuild to start the pipeline after a build.

Question 8

Which THREE steps are required to set up cross-account access for AWS CodePipeline using a customer-managed KMS key?

Accepted Answer

Grant the pipeline's IAM role permission to use the KMS key via IAM policy.. Option B is correct because the pipeline's IAM role must have an IAM policy granting it permission to use the customer-managed KMS key for encrypt and decrypt operations. This is necessary because CodePipeline uses the KMS key to encrypt artifacts stored in the artifact bucket, and the pipeline role needs explicit kms:Encrypt and kms:Decrypt permissions to interact with the key.

Answer

Give the target account's IAM role permission to encrypt with the KMS key.

Answer

Create a KMS key in the target account.

Question 9

Which TWO AWS services can be used to implement a blue/green deployment for an application running on Amazon EC2 instances?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy (Option B) is correct because it natively supports blue/green deployments for Amazon EC2 instances by allowing you to provision a new set of instances (the green environment), deploy the new application revision to them, and then shift traffic from the old (blue) environment to the new one. This is achieved through integration with an Elastic Load Balancer (ELB) or Auto Scaling groups, where CodeDeploy manages the lifecycle of instances and traffic routing during the deployment process.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS CodeBuild

Question 10

Refer to the exhibit. A DevOps engineer created this IAM policy for a CodeDeploy service role. The deployment fails with an 'AccessDenied' error when attempting to register instances with an Auto Scaling group. What is the likely cause?

Accepted Answer

The policy is missing autoscaling:UpdateAutoScalingGroup and autoscaling:SetDesiredCapacity.. The correct answer is D because the CodeDeploy service role must include permissions for autoscaling:UpdateAutoScalingGroup and autoscaling:SetDesiredCapacity to allow CodeDeploy to register instances with an Auto Scaling group during a deployment. Without these actions, the deployment fails with an 'AccessDenied' error when CodeDeploy attempts to attach instances to the Auto Scaling group or adjust its capacity.

Answer

The policy does not allow autoscaling:CompleteLifecycleAction.

Answer

The role is not trusted by the EC2 service.

Answer

The iam:PassRole action is not scoped to the correct resource.

Question 11

Refer to the exhibit. A DevOps engineer runs this AWS CLI command to list all CodeBuild projects with 'production' in their name. The command returns an empty list, but the engineer knows there are projects named 'production-app' and 'production-backend'. What is the most likely reason?

Accepted Answer

The --query parameter syntax is incorrect.. Option C is correct because the --query parameter uses JMESPath syntax, and the filter expression `contains(Name, 'production')` is incorrectly written. The correct syntax should be `contains(Name, 'production')` without extra quotes or brackets around the string. The empty result indicates the query failed to match due to syntax error, not because the projects don't exist.

Answer

The IAM user does not have list-projects permission.

Answer

The AWS CLI is not configured with valid credentials.

Answer

The region specified is incorrect.

Question 12

Refer to the exhibit. A CloudFormation template creates a Lambda function. After deployment, the function fails with a timeout error. Logs are not being created in CloudWatch. What is the most likely cause?

Accepted Answer

The IAM role does not grant sufficient permissions to write logs.. Option C is correct because the Lambda function does not have permission to create log groups in the correct log group ARN. The log group ARN pattern is missing the log group name. Option A is wrong because the code is not the issue. Option B is wrong because the runtime is correct. Option D is wrong because the role is correctly assumed.

Answer

The runtime is not supported.

Answer

The Lambda execution role has a trust policy that is missing the lambda service.

Answer

The Lambda function code is faulty.

Question 13

A development team uses AWS CodeCommit for source control and wants to automatically run unit tests on every push to the main branch. Which AWS service should they use to trigger the tests?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it provides a fully managed continuous delivery service that can be configured to automatically trigger a build action (such as running unit tests in AWS CodeBuild) whenever a change is pushed to a specified branch in AWS CodeCommit. This is achieved by setting the source stage to the CodeCommit repository and branch, and then adding a build stage that invokes CodeBuild to execute the tests, enabling an automated CI/CD workflow.

Answer

AWS CodeBuild

Answer

Amazon CloudWatch Events

Answer

AWS CodeDeploy

Question 14

A company uses AWS CodeBuild to compile a Java application. The build specification includes a pre-build phase to download dependencies. Which file defines the commands for each build phase?

Accepted Answer

buildspec.yml. In AWS CodeBuild, the build specification file named 'buildspec.yml' defines the commands that CodeBuild runs during each phase of the build process, including the pre-build phase for downloading dependencies. This YAML file is placed in the root of the source code or specified in the build project configuration, and it contains structured sections for install, pre_build, build, and post_build phases. Option B is correct because buildspec.yml is the standard file that CodeBuild uses to orchestrate build commands.

Answer

pipeline.json

Answer

config.xml

Answer

appspec.yml

Question 15

A DevOps engineer notices that a CodePipeline execution fails at the deploy stage when deploying a Lambda function using AWS CloudFormation. The error message indicates that the stack update failed because the Lambda function's code is too large. What is the most likely cause?

Accepted Answer

The Lambda function deployment package exceeds the maximum allowed size for Lambda.. The error message explicitly states that the Lambda function's code is too large, which directly points to the Lambda deployment package exceeding the maximum allowed size. AWS Lambda has a hard limit of 50 MB for zipped direct uploads (or 250 MB for container images), and CloudFormation will fail the stack update if the package exceeds this limit during a deploy stage.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to update the Lambda function.

Answer

The CloudFormation template exceeds the maximum size limit for templates.

Answer

The artifact stored in the pipeline's S3 bucket exceeds the maximum allowed size for CodePipeline artifacts.