DOP-C02 SDLC Automation Practice Test 4 — 15 Questions

Question 1

A team uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is configured with a deployment configuration that uses the 'CodeDeployDefault.OneAtATime' traffic routing. However, during deployment, the new instances are failing health checks and the deployment is rolling back. The team wants to minimize the impact on users. What should the team do to detect issues earlier?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a canary deployment configuration that shifts 10% of traffic initially.. A canary deployment (e.g., shifting 10% of traffic initially) allows the team to detect health check failures on a small subset of new instances before the full rollout. This minimizes user impact by limiting exposure to potentially faulty code, while still catching issues earlier than a one-at-a-time deployment. The 'CodeDeployDefault.OneAtATime' configuration already deploys to one instance at a time, but a canary reduces the blast radius further by routing only a fraction of traffic to the new instances.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce'.

Answer

Increase the batch size to deploy to multiple instances at once.

Answer

Add a manual approval step in the pipeline before the deployment.

Question 2

Refer to the exhibit. An AWS CloudFormation template includes a Lambda function with the ARN shown. The function is part of a custom resource to create an S3 bucket. The stack creation fails with the error 'Function not found: arn:aws:lambda:us-east-1:123456789012:function:my-function'. The Lambda function exists in the same account and region. What is the most likely cause?

Accepted Answer

The Lambda function is defined in the same template and has a circular dependency. CloudFormation automatically infers resource creation order from intrinsic references (e.g., !GetAtt LambdaFunction.Arn or !Ref). If the custom resource's ServiceToken instead uses a hard-coded ARN string for a Lambda function defined elsewhere in the same template, CloudFormation has no implicit dependency edge between them and no explicit DependsOn was added, so it may attempt to invoke the custom resource's Lambda before that function has finished being created. This produces exactly the 'Function not found: arn:...' runtime error. This is an ordering/race problem caused by a missing dependency reference, not a true circular dependency: an actual cycle (A depends on B depends on A) is caught by CloudFormation during stack validation and fails immediately with an explicit 'Circular dependency between resources' error, never reaching a runtime invoke failure. The fix is to reference the function via !GetAtt (or !Ref) so CloudFormation infers the correct order automatically, or add an explicit DependsOn.

Answer

The Lambda function is not in the same AWS region

Answer

The Lambda function lacks necessary IAM permissions

Answer

The Lambda function ARN is malformed

Question 3

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The pipeline has a source stage (S3), a build stage (CodeBuild), and a deploy stage (Elastic Beanstalk). Recently, the deployment started failing with the error 'The Elastic Beanstalk environment is not in a ready state'. The team found that the environment was in an 'Updating' state because a previous deployment was still in progress. They need a solution that prevents concurrent deployments and ensures that the environment is ready before starting a new deployment. Which action should the DevOps engineer take?

Accepted Answer

Configure a 'Wait for Environment to be Ready' action before the deploy stage. Configuring a 'Wait for Environment to be Ready' action before the deploy stage ensures that CodePipeline checks the Elastic Beanstalk environment's health and waits until it is in a Ready state before starting a new deployment. This prevents concurrent deployments and avoids the 'not in a ready state' error. It is the standard solution for serializing deployments in CodePipeline.

Answer

Increase the deployment timeout in the Elastic Beanstalk environment

Answer

Disable rolling updates in the Elastic Beanstalk environment

Answer

Create multiple Elastic Beanstalk environments for blue/green deployment

Question 4

A large enterprise uses AWS CodePipeline with multiple stages including source, build, test, and deploy. The test stage runs a suite of integration tests that take 30 minutes. The team wants to reduce the overall pipeline execution time by running the test stage in parallel across different test environments (e.g., different browsers, operating systems). However, they also need to aggregate the test results into a single report. Which approach should they use?

Accepted Answer

Configure parallel actions in the test stage and use a custom action to aggregate results. CodePipeline supports parallel actions within a stage. You can define multiple test actions (e.g., one for each browser or OS) and run them in parallel. To aggregate results, you can add a post-test action that runs after all parallel actions complete, or use a custom action to collect and combine test reports. Option D correctly describes this approach. Option A (separate pipelines) adds complexity and doesn't aggregate easily. Option B (sequential) increases time. Option C (batch builds) is for running multiple builds in parallel with CodeBuild, but it doesn't inherently handle different environments like browsers/OS; also, the scenario asks for parallel actions in the pipeline stage, not batch builds.

Answer

Create separate pipelines for each test environment

Answer

Create a sequential test stage that runs each environment one after another

Answer

Use CodeBuild batch builds with a single buildspec to run tests in parallel

Question 5

A company uses AWS CloudFormation to deploy infrastructure. They have a template that creates an Amazon EC2 instance and an Elastic IP address. The template uses the AWS::EC2::EIP resource. The team notices that when they delete the stack, the Elastic IP address is not released, leading to charges. They want to ensure that the Elastic IP is automatically released when the stack is deleted. What should they do?

Accepted Answer

Set the DeletionPolicy attribute to 'Delete' on the EIP resource. Setting the DeletionPolicy attribute to 'Delete' on the EIP resource ensures that CloudFormation releases the Elastic IP address when the stack is deleted. By default, the DeletionPolicy is 'Delete' for most resources, but for some resources like EIP, it may be 'Retain' if specified. Explicitly setting it to 'Delete' guarantees release.

Answer

Set the DeletionPolicy attribute to 'Retain' to keep the EIP

Answer

Create a custom resource to release the EIP before stack deletion

Answer

Add a DependsOn clause to ensure proper order of deletion

Question 6

A company runs a containerized microservices application on Amazon ECS with Fargate. The application is deployed using AWS CodePipeline with CodeBuild as the build stage and ECS as the deploy stage. The pipeline uses a deployment controller of type CODE_DEPLOY with a blue/green deployment strategy. Recently, the team noticed that during deployments, the new task set fails health checks and the deployment is rolled back. The application logs indicate that the new containers fail because they cannot connect to the Redis cluster, which is a required dependency. The Redis cluster is running on Amazon ElastiCache and is in the same VPC as the ECS tasks. The team has verified that the security group for the ElastiCache cluster allows inbound traffic from the ECS tasks' security group. The ECS task definition includes the Redis endpoint as an environment variable. What is the MOST likely cause of the connection failure?

Accepted Answer

The security group for the ElastiCache cluster only allows inbound traffic from the security group of the original task set, not the new task set created during deployment.. In a blue/green deployment with CODE_DEPLOY, the new task set is created in a separate target group and may have a different security group automatically assigned (or rely on the service's security group). However, the security group rule on the ElastiCache cluster must explicitly allow inbound traffic from the security group of the new task set. If the rule only allows traffic from the original task set's security group, the new task set will fail to connect. Option A is incorrect because the ECS service is configured to use the same subnets for both task sets, so subnet routing is not the issue. Option B is incorrect because the environment variable is passed via the task definition, which is the same for both task sets; the connection failure occurs despite the variable being correct. Option D is incorrect because both task sets are in the same VPC as the ElastiCache cluster.

Answer

The new task set is being launched in different private subnets that do not have a route to the ElastiCache cluster.

Answer

The Redis endpoint environment variable is not being passed correctly to the new task set because of a misconfiguration in the task definition.

Answer

The new task set is using a different VPC than the ElastiCache cluster.

Question 7

A team uses AWS CodePipeline with a multi-branch strategy. They want to run different build projects based on the branch name: 'main' triggers a production build, 'develop' triggers a staging build, and feature branches trigger a test build. Which CodePipeline feature should they use?

Accepted Answer

Configure the source action with a branch filter using a regular expression.. To run different build projects based on branch, create separate pipelines, each configured with a specific source branch (e.g., main, develop, feature branches). This is the native and straightforward approach. AWS CodePipeline does not provide regex branch filtering in source actions.

Answer

Use AWS Lambda to dynamically change the pipeline definition.

Answer

Create separate pipelines for each branch and use tags.

Answer

Use a manual approval action to select the branch.

Question 8

An organization uses AWS Elastic Beanstalk to deploy a web application. The deployment fails with a '502 Bad Gateway' error after the environment update. The health status shows 'Severe'. Investigation reveals that the application is not binding to the port that the nginx proxy expects. What is the most efficient way to diagnose and resolve this issue?

Accepted Answer

Check the application's listening port by viewing the nginx configuration files in the platform hooks and ensure the app listens on the expected port (e.g., 8080).. The 502 Bad Gateway error in Elastic Beanstalk typically occurs when the nginx reverse proxy cannot forward requests to the application because the application is not listening on the expected port (default 8080). Checking the nginx configuration files in the platform hooks and verifying the application's listening port directly addresses the root cause, as the proxy expects the app to bind to a specific port. This is the most efficient diagnostic step because it targets the exact mismatch between the proxy and the application.

Answer

Rebuild the environment with a larger instance type to handle the load.

Answer

Use the Elastic Beanstalk console to update the environment's software configuration.

Answer

Review the application logs in CloudWatch Logs for error messages.

Question 9

A company uses AWS CloudFormation with nested stacks to manage a microservices application. The root stack creates a VPC, and nested stacks create ECS services. A developer updates the root stack, but the update fails with 'UPDATE_ROLLBACK_IN_PROGRESS'. The rollback also fails. Which THREE steps should the team take to recover the stack? (Choose THREE.)

Accepted Answer

Use the 'SignalResource' action to send a success signal to the failed resource if it is a custom resource.. Option B is correct because when a stack is stuck in UPDATE_ROLLBACK_FAILED due to a custom resource that never received its expected signal, calling the CloudFormation SignalResource API with a SUCCESS status allows the rollback to proceed past that resource. Option D is correct because ContinueUpdateRollback is the AWS CLI/console operation specifically designed to resume a rollback that has entered UPDATE_ROLLBACK_FAILED, optionally skipping resources that cannot be rolled back. Option E is correct because a common cause of a failed rollback is a resource that cannot be deleted or reverted in its current state, such as a non-empty S3 bucket; manually remediating the resource (for example, emptying the bucket) and then continuing the rollback resolves the blocker. Option A is not correct because a stack policy controls which resources can be updated or replaced, but it does not resolve a rollback that has already failed. Option C is not correct because manually deleting a nested stack from the console bypasses CloudFormation's state tracking and can corrupt the parent stack's resource references rather than recovering it.

Answer

Set the stack policy to allow all updates and retry the update.

Answer

Manually delete the failed nested stack from the AWS CloudFormation console.

Question 10

A DevOps team uses AWS OpsWorks for Chef Automate to manage configuration. They want to ensure that all EC2 instances automatically register with OpsWorks and are assigned to the correct layer. Which THREE steps are required? (Choose THREE.)

Accepted Answer

Install the AWS OpsWorks agent on each EC2 instance.. Option A is correct because the AWS OpsWorks agent (opsworks-agent-installer) must be installed on each EC2 instance so the instance can communicate with the OpsWorks service and receive configuration commands. Option D is correct because the instance must be registered with the specific OpsWorks stack, either through the AWS CLI (e.g., register-instance) or the console, to become a managed instance in that stack. Option E is correct because after registration the instance must be assigned to the appropriate layer (such as web or app) so it receives the correct Chef recipes and configuration for its role. Option B is not required because the OpsWorks agent, not user data running the Chef client, handles Chef runs on the instance. Option C is not required because OpsWorks uses its own service role and instance profile (aws-opsworks-ec2-role) rather than the AmazonEC2RoleforOpsWorks policy for this registration workflow.

Answer

Configure the instance's user data to run the Chef client.

Answer

Attach an IAM role with the AmazonEC2RoleforOpsWorks policy to the EC2 instance.

Question 11

The exhibit shows an IAM policy attached to an AWS Lambda execution role. The Lambda function is triggered by an S3 event and writes to the same bucket. However, the function fails with a permission error when trying to write to 'my-bucket'. What is the likely issue?

Accepted Answer

The policy grants s3:PutObject only on objects (my-bucket/*), but the action also requires permission on the bucket (my-bucket) for certain operations like s3:PutObject with ACLs.. The provided explanation falsely claims that s3:PutObject with ACLs or cross-account access requires additional permission on the bucket resource. In AWS, s3:PutObject is an object-level action; the ARN used is the object ARN. If the Lambda function fails to write, likely causes include missing s3:PutObjectAcl (if setting an ACL), missing kms:GenerateDataKey (if using SSE-KMS), or an explicit bucket policy denial. Option D is not the correct answer.

Answer

The S3 bucket is in a different region than the Lambda function.

Answer

The policy is missing the 'lambda:InvokeFunction' permission on the function itself.

Answer

The Lambda function does not have an S3 trigger configured.

Question 12

A DevOps team is using AWS CodePipeline to automate build, test, and deploy phases. The team notices that the pipeline is failing intermittently during the deploy stage due to a timeout when updating an Auto Scaling group. The deploy stage uses CodeDeploy with a blue/green deployment configuration. What is the MOST likely cause and solution?

Accepted Answer

The CodeDeploy deployment group has a low original revision timeout. Increase the original revision timeout.. The intermittent timeout during the deploy stage when updating an Auto Scaling group with a blue/green deployment is most likely caused by the CodeDeploy deployment group's original revision timeout being too low. This timeout controls how long CodeDeploy waits for the new instances in the green environment to become healthy and complete their lifecycle hooks before considering the original revision as failed. Increasing this timeout allows sufficient time for instance initialization, application deployment, and health checks, resolving the intermittent failures.

Answer

The CloudFormation stack update is failing. Update the stack with a longer timeout.

Answer

The CodeCommit repository has too many branches. Clean up unused branches.

Answer

The CodeBuild project has a low build timeout. Increase the build timeout.

Question 13

A company uses AWS CodePipeline with a cross-account action where the source account (Account A) triggers a deploy action in a target account (Account B). The pipeline is failing with an 'Access Denied' error when trying to assume the deployment role. What is the MOST likely cause?

Accepted Answer

The KMS key used to encrypt artifacts is not shared with Account B.. In a cross-account CodePipeline setup, if the source account (Account A) uses a KMS key to encrypt artifacts in the S3 bucket, the target account (Account B) must have access to that KMS key to decrypt the artifacts during the deploy action. Without the KMS key being shared via a cross-account key policy that grants the deployment role in Account B the `kms:Decrypt` permission, the pipeline fails with an 'Access Denied' error when attempting to assume the deployment role, because the role assumption process itself may require decrypting pipeline metadata or artifacts.

Answer

The S3 artifact bucket in Account A does not have a bucket policy allowing Account B.

Answer

The deployment role in Account B does not exist.

Answer

The CloudFormation service role in Account B is missing.

Question 14

A company uses AWS CloudFormation to manage infrastructure. The DevOps engineer wants to ensure that stack updates are rolled back if a new Amazon RDS instance fails to be created. Which CloudFormation feature should the engineer use?

Accepted Answer

Add a CreationPolicy to the RDS instance with a timeout. A CreationPolicy with a timeout ensures that CloudFormation waits for a specified period for the RDS instance to be fully created and signal success. If the instance fails to create within the timeout, CloudFormation treats it as a failure and triggers a stack update rollback, which is exactly what the engineer needs to automatically revert changes when the RDS creation fails.

Answer

Use a WaitCondition and a WaitHandle to pause creation

Answer

Set the RDS instance's DeletionPolicy to Retain

Answer

Define a StackPolicy that denies updates to the RDS instance

Question 15

A development team uses AWS CodeCommit and wants to enforce that all commits include a JIRA issue key in the commit message. They want to reject any push that does not contain a valid JIRA key. Which approach should the engineer use?

Accepted Answer

Configure a pre-commit hook in the Git client. Correct. To validate commit message content client-side (e.g., requiring a JIRA key), Git provides a commit-msg hook, which receives the path to a file containing the proposed commit message and can reject the commit if it doesn't match a required pattern. (A pre-commit hook runs earlier, before the message is captured, and only has access to staged file changes, not message text.) Because AWS CodeCommit has no server-side pre-receive hook capability, this client-side enforcement is the only viable approach among the options given.

Answer

Create a CloudWatch Events rule that triggers a Lambda function on push

Answer

Use AWS CodeCommit hooks to validate commit messages

Answer

Use a Lambda function triggered by CodeCommit push events that calls codecommit:PutRepositoryTriggers to reject