DOP-C02 SDLC Automation Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A CloudFormation template creates a Lambda function. After deployment, the function fails with a timeout error. Logs are not being created in CloudWatch. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IAM role does not grant sufficient permissions to write logs.. The most likely cause is that the IAM execution role attached to the Lambda function lacks the necessary permissions to create and write log streams and log events to CloudWatch Logs. Without the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions, the Lambda runtime cannot send its output to CloudWatch, so even if the function code runs, no logs appear. The timeout error occurs because the function is waiting for log delivery or failing silently, but the absence of logs is the direct symptom of insufficient IAM permissions.

Answer

The runtime is not supported.

Answer

The Lambda execution role has a trust policy that is missing the lambda service.

Answer

The Lambda function code is faulty.

Question 2

A development team uses AWS CodeCommit for source control and wants to automatically run unit tests on every push to the main branch. Which AWS service should they use to trigger the tests?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it provides a fully managed continuous delivery service that can be configured to automatically trigger a build action (such as running unit tests in AWS CodeBuild) whenever a change is pushed to a specified branch in AWS CodeCommit. This is achieved by setting the source stage to the CodeCommit repository and branch, and then adding a build stage that invokes CodeBuild to execute the tests, enabling an automated CI/CD workflow.

Answer

AWS CodeBuild

Answer

Amazon CloudWatch Events

Answer

AWS CodeDeploy

Question 3

A company uses AWS CodeBuild to compile a Java application. The build specification includes a pre-build phase to download dependencies. Which file defines the commands for each build phase?

Accepted Answer

buildspec.yml. In AWS CodeBuild, the build specification file named 'buildspec.yml' defines the commands that CodeBuild runs during each phase of the build process, including the pre-build phase for downloading dependencies. This YAML file is placed in the root of the source code or specified in the build project configuration, and it contains structured sections for install, pre_build, build, and post_build phases. Option B is correct because buildspec.yml is the standard file that CodeBuild uses to orchestrate build commands.

Answer

pipeline.json

Answer

config.xml

Answer

appspec.yml

Question 4

A DevOps engineer notices that a CodePipeline execution fails at the deploy stage when deploying a Lambda function using AWS CloudFormation. The error message indicates that the stack update failed because the Lambda function's code is too large. What is the most likely cause?

Accepted Answer

The Lambda function deployment package exceeds the maximum allowed size for Lambda.. The error message explicitly states that the Lambda function's code is too large, which directly points to the Lambda deployment package exceeding the maximum allowed size. AWS Lambda has a hard limit of 50 MB for zipped direct uploads (or 250 MB for container images), and CloudFormation will fail the stack update if the package exceeds this limit during a deploy stage.

Answer

The IAM role used by CloudFormation does not have sufficient permissions to update the Lambda function.

Answer

The CloudFormation template exceeds the maximum size limit for templates.

Answer

The artifact stored in the pipeline's S3 bucket exceeds the maximum allowed size for CodePipeline artifacts.

Question 5

A company uses AWS CodeCommit and wants to enforce that all commits to the main branch are signed. What must be configured to enforce this requirement?

Accepted Answer

Configure a repository policy that requires signed commits.. AWS CodeCommit supports repository policies that can enforce commit signing by denying `codecommit:GitPush` unless the commit is signed with a GPG key. This is done using the `git:IsSigned` condition key in an IAM-based resource policy attached to the repository. Option A is correct because it directly configures this policy to reject unsigned pushes to the main branch.

Answer

Assign an IAM role that only allows signed API calls.

Answer

Use a pre-commit hook in the local repository.

Answer

Set up a CloudWatch Events rule to reject unsigned commits.

Question 6

A company uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that creates an Amazon RDS DB instance. The database password must be stored securely and rotated automatically. Which approach meets these requirements?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation. Reference the secret in the template using a dynamic reference.. AWS Secrets Manager provides built-in capabilities for automatic password rotation, which is a requirement. By storing the password in Secrets Manager and referencing it in the CloudFormation template using a dynamic reference (e.g., `{{resolve:secretsmanager:secret-id:SecretString:password}}`), the password is never exposed in the template or parameter logs, and rotation can be configured without updating the stack. This approach meets both security and automation requirements.

Answer

Hardcode the password in the CloudFormation template and use a NoEcho parameter.

Answer

Use AWS Key Management Service (KMS) to encrypt the password and pass it as a parameter.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it using a dynamic reference.

Question 7

A company uses AWS CodePipeline with multiple stages: Source, Build, Test, Deploy. The Test stage runs integration tests using AWS CodeBuild. If the Test stage fails, what happens to the pipeline execution?

Accepted Answer

The pipeline execution stops and the status is set to 'Failed'.. In AWS CodePipeline, by default, if a stage (such as Test) fails, the pipeline execution immediately stops and the overall pipeline status is set to 'Failed'. This is because CodePipeline treats each stage as a sequential gate; a failure in any stage blocks progression to subsequent stages unless explicitly configured otherwise (e.g., with a 'Blocker' or 'Manual Approval' action). Option B correctly describes this default behavior.

Answer

The pipeline continues to the next stage but marks the Test stage as failed.

Answer

The pipeline skips the Test stage and proceeds to Deploy.

Answer

The pipeline automatically retries the Test stage up to three times.

Question 8

A DevOps engineer wants to use AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment must ensure that only a certain percentage of instances are taken out of service at a time. Which deployment configuration supports this requirement?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime is the correct deployment configuration because it ensures that only one instance in the Auto Scaling group is taken out of service at a time, which directly satisfies the requirement of limiting the percentage of instances removed during deployment. This configuration is designed for EC2/On-Premises deployments and uses a fixed number of instances (one) rather than a percentage, making it ideal for gradual, safe rollouts.

Answer

CodeDeployDefault.LambdaCanary10Percent5Minutes

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.LambdaLinear10PercentEvery1Minute

Question 9

A company uses AWS CodeStar to manage software development projects. The team wants to integrate a third-party issue tracking system with CodeStar. Which AWS service should they use to achieve this integration?

Accepted Answer

AWS CodePipeline webhooks. AWS CodePipeline webhooks allow you to connect external systems, such as a third-party issue tracking system, to your CodePipeline pipeline. When the external system triggers an event (e.g., an issue status change), the webhook sends an HTTP POST request to a configured endpoint in CodePipeline, which then starts the pipeline. This is the native integration mechanism for CodeStar to receive events from outside AWS.

Answer

Amazon API Gateway

Answer

Amazon CloudWatch Events

Answer

Amazon Simple Notification Service (SNS)

Question 10

A company is designing a CI/CD pipeline for a serverless application using AWS CodePipeline. Which TWO actions are valid ways to deploy an AWS Lambda function?

Accepted Answer

Use AWS CloudFormation to update the Lambda function's stack.. AWS CloudFormation can manage Lambda function deployments as part of a stack update. By defining the Lambda function resource in a CloudFormation template, CodePipeline can trigger a stack update that creates or updates the function, ensuring infrastructure-as-code best practices and consistent deployments.

Answer

Use Amazon S3 to trigger the Lambda function deployment.

Answer

Use AWS CodeBuild to directly deploy the Lambda function.

Answer

Use AWS CodeCommit to push the Lambda code.

Question 11

A DevOps team uses AWS CloudFormation to manage infrastructure. They want to implement a change management process that requires approval before making changes to production stacks. Which TWO approaches can be used to enforce this?

Accepted Answer

Use AWS CodePipeline with a manual approval stage.. AWS CodePipeline can include a manual approval stage that pauses the pipeline and requires explicit approval before proceeding to deploy changes to production stacks. Option E is correct because CloudFormation Change Sets allow you to review the proposed changes and then manually execute them, ensuring that no changes are applied without human review and approval.

Answer

Use CloudFormation StackSets to manage approvals.

Answer

Use CloudFormation Stack Policies to prevent updates.

Answer

Use CloudFormation Drift Detection to detect changes.

Question 12

A company uses AWS CodeBuild to build and test a Node.js application. The buildspec.yml currently runs npm install and npm test. They want to also run a security scan using a third-party tool. Which THREE steps are required to integrate the security scan into the CodeBuild build?

Accepted Answer

Ensure the build fails if the scanner finds vulnerabilities by checking the exit code.. CodeBuild phases (install, pre_build, build, post_build) run shell commands sequentially, and a non-zero exit code from any command causes the build to fail. By checking the exit code of the security scanner (e.g., via `$?` or relying on the tool's default exit behavior), the build will stop and report failure if vulnerabilities are found, enforcing a security gate. This is the standard mechanism to integrate third-party tools without custom scripting.

Answer

Create a new 'security' phase in the buildspec.yml.

Answer

Upload the security scanner configuration to an S3 bucket and reference it in the buildspec.

Question 13

A DevOps engineer runs the above AWS CLI commands and notices that the CodeBuild project 'my-project' exists but builds fail with the error 'Access Denied' when trying to fetch source code from CodeCommit. The IAM role 'CodeBuildServiceRole' has a policy that allows 'codecommit:GitPull' on all repositories. What is the most likely cause of the failure?

Accepted Answer

The IAM role does not have a trust policy that allows CodeBuild to assume the role.. The error 'Access Denied' when CodeBuild tries to fetch source code from CodeCommit typically indicates that the IAM role CodeBuild is using does not have the necessary permissions to perform the action. Even though the role 'CodeBuildServiceRole' has a policy allowing 'codecommit:GitPull', the role itself must have a trust policy that allows the CodeBuild service to assume it. Without a proper trust policy, CodeBuild cannot assume the role, and any attached permissions are irrelevant, leading to an access denied error.

Answer

The IAM role does not have permissions to access the CodeCommit repository.

Answer

The CodeCommit repository does not exist.

Answer

The source location in the build project is incorrect.

Question 14

A DevOps engineer creates a CloudFormation stack with the above template. After creation, they want to update the Lambda function code by uploading a new zip file to the S3 bucket and updating the S3Key property. However, the stack update fails because the Lambda function is published as a version and the alias points to that version. What is the most likely reason for the update failure?

Accepted Answer

The AWS::Lambda::Version resource is immutable and cannot be updated.. The AWS::Lambda::Version resource is immutable by design; once created, it cannot be updated or replaced. When a CloudFormation stack includes a Lambda version and an alias pointing to that version, any attempt to update the function code (e.g., by changing the S3Key property) triggers an update to the AWS::Lambda::Version resource, which CloudFormation cannot perform because versions are immutable. This causes the stack update to fail.

Answer

The alias must be deleted before updating the function code.

Answer

The IAM role does not have permission to update the function.

Answer

The function code cannot be updated because the S3 bucket is in a different region.

Question 15

A DevOps team uses AWS CodeBuild to compile code and run unit tests. The team notices that builds are failing with a timeout error after 60 minutes. What is the most likely cause and solution?

Accepted Answer

The build timeout limit is exceeded; increase the timeout in CodeBuild project settings.. The default build timeout for AWS CodeBuild is 60 minutes. When a build runs longer than this limit, it fails with a timeout error. The correct solution is to increase the timeout value in the CodeBuild project settings, which can be set up to a maximum of 8 hours (480 minutes) for on-demand compute environments.

Answer

The buildspec has syntax errors; validate the YAML.

Answer

The build environment is too small; increase compute type.

Answer

The source code repository is too large; use shallow clone.