DOP-C02 SDLC Automation Practice Test 5 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a multi-tier application. The engineer wants to ensure that the stack is not accidentally deleted and that critical resources like databases are retained even if the stack is deleted. Which THREE steps should the engineer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the DeletionPolicy attribute to Retain on the RDS instance. Option D is correct because setting the DeletionPolicy attribute to Retain on the RDS instance ensures that CloudFormation preserves the database resource even if the stack is deleted, which directly satisfies the requirement to retain critical resources. Option E is correct because enabling termination protection on the stack prevents the stack from being accidentally deleted, directly addressing the requirement that the stack not be accidentally deleted. Option A is incorrect because a StackPolicy denying updates to the RDS instance would block legitimate modifications, not prevent stack deletion or resource loss. Option B is incorrect because nested stacks only organize resources into separate stacks; they do not inherently prevent deletion or retain the database. Option C is incorrect because StackPolicy does not support denying delete actions on stack deletion; StackPolicy applies to update operations, not delete operations.

Answer

Create a StackPolicy that denies updates to the RDS instance

Answer

Use nested stacks to isolate the database

Answer

Use a StackPolicy to deny delete actions

Question 2

A DevOps team uses AWS CodePipeline with an Amazon S3 source action. The pipeline deploys a static website to an S3 bucket. The engineer wants to ensure that only approved changes are deployed to production. The team uses Git feature branches and wants to deploy only when a pull request is merged to the main branch. Which THREE actions should the engineer take?

Accepted Answer

Configure a CloudWatch Events rule to start the pipeline when a CodeCommit pull request is merged. Option A is correct because an Amazon CloudWatch Events (EventBridge) rule can match CodeCommit pull request state-change events (for example, detail.eventName of pullRequestMerge or pullRequestStatusChanged with merge) and start the CodePipeline execution, so deployments occur only when a PR is merged. Option C is correct because switching the pipeline source to AWS CodeCommit and configuring a trigger for pull request merge events provides the native, supported mechanism to gate pipeline runs on merges to the main branch, replacing the S3 source action that cannot distinguish approved changes. Option E is correct because adding a manual approval stage in CodePipeline requires a designated approver to sign off via the console or CLI before the deploy stage proceeds, enforcing the 'only approved changes' requirement even after a merge. Option B is not appropriate because S3 event notifications fire on every object upload and cannot distinguish merged, approved changes, so it would deploy unapproved content. Option D is wrong because executing on every push to any branch bypasses the merge-to-main gate and would deploy unapproved feature-branch changes.

Answer

Use an S3 source and configure event notifications for all object uploads

Answer

Set the pipeline to execute on every push to any branch

Question 3

Refer to the exhibit. A DevOps engineer is troubleshooting a cross-account deployment where an AWS CodeBuild project in Account A needs to upload build artifacts to an S3 bucket in Account B. The engineer attaches this IAM policy to the CodeBuild service role in Account A. However, the upload fails. What is the most likely reason?

Accepted Answer

The condition requires bucket-owner-full-control ACL, but the bucket policy may not allow it. The IAM policy includes a condition that requires the `bucket-owner-full-control` canned ACL (`s3:x-amz-acl: bucket-owner-full-control`). For this condition to be satisfied, the bucket policy in Account B must explicitly allow the `s3:PutObject` action with that ACL. If the bucket policy does not include a statement granting `s3:PutObject` with the condition that the ACL is `bucket-owner-full-control`, the upload will fail with an access denied error, even if the IAM policy in Account A appears permissive.

Answer

The bucket policy in Account B grants s3:PutObject to Account A

Answer

The policy does not include s3:PutObjectAcl permission

Answer

The policy does not include s3:GetObject permission

Question 4

A company uses AWS CodePipeline with an Amazon S3 source, AWS CodeBuild, and AWS CodeDeploy. The deployment stage fails intermittently with the error 'Deployment failed because the deployment group does not exist'. The pipeline has been working for months. What is the MOST likely cause?

Accepted Answer

The pipeline's cross-region action configuration references the deployment group in a different region without specifying the region.. The error 'deployment group does not exist' occurs when CodePipeline attempts to use a CodeDeploy deployment group that is not present in the region being accessed. If the deployment group is in a different region from the pipeline, the action must explicitly specify that region. Without it, CodePipeline defaults to the pipeline's home region, which does not contain the deployment group, causing the error every time the action runs. This is a common misconfiguration for cross-region deployments.

Answer

The deployment group name contains a typo in the pipeline definition.

Answer

The IAM role for CodePipeline does not have sufficient permissions in all regions.

Answer

The pipeline was recreated without specifying the deployment group.

Question 5

An organization uses AWS CodeBuild to compile and test their code. They want to reuse build artifacts across multiple build projects to reduce build time. What is the BEST approach?

Accepted Answer

Store build artifacts in an Amazon S3 bucket and configure each build project to download them from S3.. EFS file systems can actually be mounted in CodeBuild build environments (a supported feature since 2021), so this is technically usable, but S3 remains the simpler, standard way to share artifacts across multiple build projects without extra VPC/mount configuration, making B the best general-purpose approach.

Answer

Use the local cache feature in CodeBuild to store artifacts on the build instance.

Answer

Use Docker layer caching to store intermediate build layers.

Answer

Mount an Amazon EFS file system to each build environment to share artifacts.

Question 6

A team uses AWS CodeBuild to run unit tests. They notice that builds are taking longer than expected. The build environment includes many dependencies that are downloaded every time. Which change would MOST reduce build time?

Accepted Answer

Store dependencies in an Amazon S3 bucket and configure CodeBuild to use S3 cache.. AWS CodeBuild does natively support mounting an Amazon EFS file system into the build container (via the project's fileSystemLocations setting, which requires the CodeBuild project to run inside a VPC). However, it is not the best fix here: EFS mounts require VPC/ENI setup that adds startup latency to every build, and CodeBuild's purpose-built S3 cache (or local cache) is a simpler, natively integrated mechanism specifically designed to persist dependency directories between builds without the networking overhead of a shared file system. S3 caching remains the most direct way to cut repeated dependency downloads.

Answer

Enable local caching for dependencies.

Answer

Increase the compute type to a larger instance.

Answer

Use Amazon EFS to share dependencies across builds.

Question 7

A company uses AWS CodeDeploy with a blue/green deployment configuration. After a deployment, the new instances are not registered with the load balancer, causing downtime. What is the MOST likely cause?

Accepted Answer

The CodeDeploy deployment group does not have a load balancer configured or the deregistration delay is too long.. CodeDeploy only performs load balancer registration when the deployment group has a load balancer/target group explicitly configured in the blue/green settings; without that configuration, CodeDeploy has no target group ARN to call RegisterTargets with, so the new instances are never attached to the load balancer, causing downtime.

Answer

The IAM role for CodeDeploy does not have permission to register instances with the load balancer.

Answer

The original instances are still registered with the load balancer.

Answer

The load balancer health check is misconfigured.

Question 8

Refer to the exhibit. A DevOps engineer attaches this IAM policy to a user. The user reports that they cannot start a pipeline execution for 'my-pipeline' using the AWS CLI. What is the MOST likely reason?

Accepted Answer

The user is missing the 'codepipeline:ListPipelines' permission needed to list pipelines before execution.. The IAM policy shown in the exhibit grants permissions for specific actions on the 'my-pipeline' resource, but it does not include the 'codepipeline:ListPipelines' action. When a user runs the AWS CLI command to start a pipeline execution, the AWS CLI first calls 'ListPipelines' to resolve the pipeline name to its ARN, and if that permission is missing, the request fails with an access denied error even though the 'StartPipelineExecution' action is allowed.

Answer

The IAM policy does not allow the 'codepipeline:StartPipelineExecution' action.

Answer

The resource ARN for the pipeline is incorrect.

Answer

The policy has a condition that restricts execution to certain times.

Question 9

A company uses AWS CodeBuild to run unit tests. The buildspec.yaml file includes commands to install dependencies and run tests. Which TWO environment variables are automatically set by CodeBuild and can be used in the build commands? (Choose TWO.)

Accepted Answer

CODEBUILD_SRC_DIR. CODEBUILD_SRC_DIR (A) is correct because CodeBuild automatically sets this variable to the absolute path of the source code's root directory in the build environment, allowing build commands to reference the checked-out source location. CODEBUILD_BUILD_ID (B) is correct because CodeBuild automatically sets this variable to a unique identifier for the current build (formatted as project-name:build-id), which is useful for logging, tagging, or referencing the build. AWS_REGION (B) is not automatically set by CodeBuild itself; it is a standard AWS SDK/CLI environment variable that must be configured or is provided by the runtime in some contexts, not guaranteed by CodeBuild. CODEBUILD_BUILD_NUMBER (D) is not a CodeBuild-provided variable; the build number is exposed via CODEBUILD_BUILD_NUMBER only in some CI systems, but CodeBuild uses CODEBUILD_BUILD_ID and CODEBUILD_BUILD_NUMBER is not part of its documented automatic variables. CI (E) is a common convention variable set by many CI systems, but CodeBuild does not automatically set CI.

Answer

AWS_REGION

Answer

CODEBUILD_BUILD_NUMBER

Answer

CI

Question 10

Refer to the exhibit. A developer has the IAM policy shown. The developer can push code to the CodeCommit repository and start the pipeline. However, the pipeline fails at the Source stage with an access denied error. What additional permission is needed?

Accepted Answer

codecommit:GitPull. The pipeline fails at the Source stage because CodePipeline needs to pull the source code from CodeCommit to start the build. The `codecommit:GitPull` permission is required for the pipeline's service role to perform a Git pull operation (fetching the repository contents). Without it, the pipeline cannot retrieve the source code, even though the developer has push and pipeline start permissions.

Answer

codecommit:GetBranch

Answer

codecommit:CreateCommit

Answer

codecommit:UploadArchive

Question 11

Refer to the exhibit. A DevOps engineer runs the CLI command to view stack events. The output shows that a Lambda function update was cancelled by the stack update. What is the most likely cause?

Accepted Answer

A concurrent stack update was initiated while a previous update was in progress.. When a stack update is in progress, AWS CloudFormation locks the stack to prevent concurrent operations. If a second update is initiated, CloudFormation cancels the first update and returns an error. The Lambda function update was cancelled because a concurrent stack update was started while the previous update was still running, which is a known limitation of CloudFormation's stack management.

Answer

The stack had a drift detection operation that overrode the update.

Answer

The IAM role for the Lambda function lacked permissions to update the function.

Answer

The Lambda function code exceeded the maximum size limit for inline code.

Question 12

A team is using AWS CodeCommit as their version control system. They want to ensure that all commits are signed with a GPG key. What is the simplest way to enforce this?

Accepted Answer

Enable the 'Require signed commits' option in the CodeCommit repository settings.. AWS CodeCommit provides a built-in repository setting called 'Require signed commits' that, when enabled, rejects any push containing unsigned commits at the server side. This is the simplest and most reliable enforcement mechanism because it does not rely on client-side configurations or custom scripts, and it leverages CodeCommit's native integration with GPG signature verification.

Answer

Use AWS CloudTrail to monitor unsigned commits and automatically revert them.

Answer

Use a pre-commit hook in the local repository to enforce signing.

Answer

Configure an IAM policy that denies PutFile if the commit is not signed.

Question 13

A company uses AWS CodePipeline to orchestrate builds and deployments. The build stage uses CodeBuild to run unit tests and generate a report. The team wants to fail the pipeline if the test coverage drops below 80%. How should the engineer configure this?

Accepted Answer

Add a post-build action in the buildspec that checks coverage and exits with non-zero if below threshold.. CodeBuild's `reports` section in the buildspec allows you to specify a `file-format` (e.g., Cobertura, JaCoCo) and set a `coverage` threshold under the `reports` group. When the coverage falls below the defined percentage, CodeBuild automatically marks the build as FAILED, which propagates to CodePipeline and stops the pipeline. This is the native, supported mechanism for failing builds based on test coverage without requiring custom scripting.

Answer

Configure CodeBuild to fail the build if the test report indicates coverage below 80% using the buildspec's reports section.

Answer

Enable CodeBuild's 'Test Reporting' feature and set a threshold in the CodeBuild project configuration.

Answer

Use a CodePipeline condition to check the test report artifact and fail the pipeline if coverage is low.

Question 14

Refer to the exhibit. A CloudTrail log shows a failed GitPush event to a CodeCommit repository by the IAM user 'jenkins'. The DevOps engineer has attached the following IAM policy to the user: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "codecommit:*",
      "Resource": "*"
    }
  ]
}
What is the MOST likely reason for the failure?

Accepted Answer

The user has not generated a Git credential for CodeCommit in the IAM console.. The IAM policy allows all codecommit actions, but for Git operations via HTTPS, the user must have Git credentials (username/password) generated in the IAM console. Without these credentials, the Git client cannot authenticate, resulting in a failed GitPush event even though the IAM policy is permissive. Option A correctly identifies this as the most likely cause.

Answer

The user is trying to push via HTTPS but the repository only allows SSH.

Answer

The user's IAM policy includes a condition that restricts access based on source IP, and the push originates from a different IP.

Answer

The policy is attached but the user has a permissions boundary that denies codecommit:GitPush.

Question 15

A development team is using AWS CodeCommit as the source for a CI/CD pipeline. They want to automatically run unit tests when a pull request is created, but only for changes to the 'src' directory. Which approach should they use?

Accepted Answer

Set up an Amazon EventBridge rule that matches CodeCommit pull request events and invoke CodeBuild. Add a condition in the CodeBuild buildspec to check if changes are in 'src' directory.. AWS CodeCommit does not support CodeBuild webhooks. The correct solution is to create an Amazon EventBridge rule that matches CodeCommit pull request creation events (e.g., 'codecommit: PullRequestCreated') and triggers an AWS CodeBuild project. The buildspec must include a condition to check that the PR contains changes under 'src/' before running unit tests. This meets the requirement without relying on invalid webhook configuration.

Answer

Use an AWS Lambda function that polls CodeCommit for new pull requests and invokes CodeBuild when changes in 'src' directory are detected.

Answer

Create an AWS CodeBuild project with a source provider of CodeCommit and configure 'WEBHOOK' events with a filter for pull requests and path filter for 'src/**'.

Answer

Configure an AWS CodePipeline with a Source stage for CodeCommit and a Test stage for CodeBuild. Use a manual approval step to trigger on pull requests.